[Tue Nov 11 11:38:14.547751 2025] [:error] [pid 59670:tid 59679] [client 140.245.126.6:54416] [client 140.245.126.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aRKvpqk2Cnts0y-hpfqiTwAAAIY"]
[Tue Nov 11 11:38:14.745031 2025] [:error] [pid 53356:tid 53387] [client 140.245.126.6:54464] [client 140.245.126.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "aRKvpukdmt0kzjVcUN9c3wAAAEI"]
[Tue Nov 11 11:38:14.942275 2025] [:error] [pid 53414:tid 53433] [client 140.245.126.6:54496] [client 140.245.126.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feed/"] [unique_id "aRKvpgs6pHd_Z5oc1ecpVwAAARE"]
[Wed Nov 12 22:30:07.868160 2025] [:error] [pid 23737:tid 23770] [client 34.72.179.202:47574] [client 34.72.179.202] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aRSZ7xQUsVVfOZWgW_XpMAAAAZU"]
[Wed Nov 12 23:00:51.050184 2025] [:error] [pid 60095:tid 60109] [client 93.123.109.7:35394] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aRShI3lw2elroagFF1pe2QAAAEo"]
[Thu Nov 13 17:55:44.633499 2025] [:error] [pid 62215:tid 62234] [client 150.241.107.255:56738] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aRWrIEvClof1c6XaOBWsPAAAAM8"]
[Thu Nov 13 17:55:45.191788 2025] [:error] [pid 6086:tid 6102] [client 150.241.107.255:56959] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aRWrIX9_6CRZzjZnAe0zdgAAAQ0"]
[Thu Nov 13 17:55:45.743906 2025] [:error] [pid 62217:tid 62293] [client 150.241.107.255:57386] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRWrIRjGU3T9wKBmdNc2-gAAAFM"]
[Sat Nov 15 11:22:49.190862 2025] [:error] [pid 20313:tid 20318] [client 3.106.213.153:51652] [client 3.106.213.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aRfyCRI9DXIgPadBLUZLXgAAAsI"]
[Sat Nov 15 11:43:28.213782 2025] [:error] [pid 27911:tid 27974] [client 3.76.44.7:56918] [client 3.76.44.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aRf24MGzUdrhGBIfiKQiPwAAAIY"]
[Sat Nov 15 11:49:15.792797 2025] [:error] [pid 27997:tid 28003] [client 13.40.69.184:53516] [client 13.40.69.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aRf4O9pja_6cDxKbxFmKwwAAAMQ"]
[Sat Nov 15 12:41:10.407000 2025] [:error] [pid 27909:tid 27921] [client 54.255.246.144:59782] [client 54.255.246.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aRgEZiTfZ6B57n8HepXyWQAAAAg"]
[Sat Nov 15 12:43:13.064856 2025] [:error] [pid 27909:tid 27929] [client 3.99.42.39:51396] [client 3.99.42.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aRgE4STfZ6B57n8HepXyxQAAABA"]
[Sat Nov 15 21:50:25.560794 2025] [:error] [pid 20654:tid 20678] [client 35.178.235.22:59896] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dist"] [unique_id "aRiFIXcS7eC8vO76_yccKAAAA5U"]
[Sat Nov 15 21:50:25.563719 2025] [:error] [pid 27911:tid 27986] [client 35.178.235.22:59838] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "aRiFIcGzUdrhGBIfiKSBawAAAJI"]
[Sat Nov 15 21:50:25.564090 2025] [:error] [pid 27909:tid 27924] [client 35.178.235.22:59848] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "aRiFISTfZ6B57n8HepVIcgAAAAs"]
[Sat Nov 15 21:50:25.568075 2025] [:error] [pid 22765:tid 22777] [client 35.178.235.22:59880] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.orig"] [unique_id "aRiFIabrQzjuZmPIWDYNmQAAAoc"]
[Sat Nov 15 21:50:25.571605 2025] [:error] [pid 20346:tid 20351] [client 35.178.235.22:59768] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "aRiFIZ7hsydZdIoVTlteWQAAAwI"]
[Sat Nov 15 21:50:25.572658 2025] [:error] [pid 27909:tid 27927] [client 35.178.235.22:59820] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "aRiFISTfZ6B57n8HepVIcwAAAA4"]
[Sat Nov 15 21:50:25.579423 2025] [:error] [pid 22765:tid 22776] [client 35.178.235.22:59950] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env"] [unique_id "aRiFIabrQzjuZmPIWDYNmgAAAoY"]
[Sat Nov 15 21:50:25.579915 2025] [:error] [pid 20346:tid 20358] [client 35.178.235.22:59754] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aRiFIZ7hsydZdIoVTlteWgAAAwk"]
[Sat Nov 15 21:50:25.580272 2025] [:error] [pid 20654:tid 20681] [client 35.178.235.22:59914] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.sample"] [unique_id "aRiFIXcS7eC8vO76_yccKQAAA5g"]
[Sat Nov 15 21:50:25.581286 2025] [:error] [pid 19961:tid 20001] [client 35.178.235.22:59790] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dev"] [unique_id "aRiFITar7Si-84EApVSPlwAAAcg"]
[Sat Nov 15 21:50:25.581717 2025] [:error] [pid 27909:tid 27921] [client 35.178.235.22:59836] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env~"] [unique_id "aRiFISTfZ6B57n8HepVIdAAAAAg"]
[Sat Nov 15 21:50:25.594568 2025] [:error] [pid 19961:tid 20017] [client 35.178.235.22:59930] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env.save"] [unique_id "aRiFITar7Si-84EApVSPmAAAAdg"]
[Sat Nov 15 21:50:25.597500 2025] [:error] [pid 20654:tid 20666] [client 35.178.235.22:59802] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "aRiFIXcS7eC8vO76_yccKgAAA4k"]
[Sat Nov 15 21:50:25.627455 2025] [:error] [pid 20654:tid 20671] [client 35.178.235.22:59864] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.swp"] [unique_id "aRiFIXcS7eC8vO76_yccKwAAA44"]
[Sat Nov 15 21:50:25.628901 2025] [:error] [pid 22765:tid 22785] [client 35.178.235.22:59910] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env.save"] [unique_id "aRiFIabrQzjuZmPIWDYNnAAAAo8"]
[Sat Nov 15 21:50:25.640276 2025] [:error] [pid 19959:tid 19976] [client 35.178.235.22:59874] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.old"] [unique_id "aRiFIcjejiTUP1-IawP7_gAAAYo"]
[Sat Nov 15 21:50:25.643431 2025] [:error] [pid 20313:tid 20319] [client 35.178.235.22:59818] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.backup"] [unique_id "aRiFIRI9DXIgPadBLUaoBwAAAsM"]
[Sat Nov 15 21:50:25.650236 2025] [:error] [pid 27909:tid 27917] [client 35.178.235.22:59938] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.bak"] [unique_id "aRiFISTfZ6B57n8HepVIdQAAAAQ"]
[Sat Nov 15 21:50:25.653859 2025] [:error] [pid 22765:tid 22771] [client 35.178.235.22:59780] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.prod"] [unique_id "aRiFIabrQzjuZmPIWDYNnQAAAoM"]
[Sat Nov 15 21:50:25.857112 2025] [:error] [pid 20654:tid 20657] [client 35.178.235.22:60250] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/.env.old"] [unique_id "aRiFIXcS7eC8vO76_yccLAAAA4A"]
[Sat Nov 15 21:50:25.858299 2025] [:error] [pid 20313:tid 20338] [client 35.178.235.22:60140] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/includes/.env.bak"] [unique_id "aRiFIRI9DXIgPadBLUaoCAAAAtY"]
[Sat Nov 15 21:50:25.861773 2025] [:error] [pid 27997:tid 28009] [client 35.178.235.22:60086] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application/.env.bak"] [unique_id "aRiFIdpja_6cDxKbxFn3vAAAAMo"]
[Sat Nov 15 21:50:25.863011 2025] [:error] [pid 20313:tid 20318] [client 35.178.235.22:60026] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config/.env.bak"] [unique_id "aRiFIRI9DXIgPadBLUaoCQAAAsI"]
[Sat Nov 15 21:50:25.863045 2025] [:error] [pid 22613:tid 22623] [client 35.178.235.22:60036] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/.env.save"] [unique_id "aRiFISoyR3cDsIRGPRnd3gAAAgg"]
[Sat Nov 15 21:50:25.864117 2025] [:error] [pid 20346:tid 20359] [client 35.178.235.22:60114] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/src/.env.bak"] [unique_id "aRiFIZ7hsydZdIoVTlteWwAAAwo"]
[Sat Nov 15 21:50:25.867051 2025] [:error] [pid 20654:tid 20662] [client 35.178.235.22:60212] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config/.env"] [unique_id "aRiFIXcS7eC8vO76_yccLQAAA4U"]
[Sat Nov 15 21:50:25.867430 2025] [:error] [pid 20654:tid 20672] [client 35.178.235.22:60266] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/system/.env.save"] [unique_id "aRiFIXcS7eC8vO76_yccLgAAA48"]
[Sat Nov 15 21:50:25.869909 2025] [:error] [pid 20313:tid 20321] [client 35.178.235.22:59976] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/src/.env.save"] [unique_id "aRiFIRI9DXIgPadBLUaoCgAAAsU"]
[Sat Nov 15 21:50:25.870059 2025] [:error] [pid 20654:tid 20673] [client 35.178.235.22:59994] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/src/.env"] [unique_id "aRiFIXcS7eC8vO76_yccLwAAA5A"]
[Sat Nov 15 21:50:25.871287 2025] [:error] [pid 20654:tid 20660] [client 35.178.235.22:60054] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env.old"] [unique_id "aRiFIXcS7eC8vO76_yccMAAAA4M"]
[Sat Nov 15 21:50:25.872528 2025] [:error] [pid 20654:tid 20674] [client 35.178.235.22:60264] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/system/.env.bak"] [unique_id "aRiFIXcS7eC8vO76_yccMQAAA5E"]
[Sat Nov 15 21:50:25.884240 2025] [:error] [pid 27997:tid 28023] [client 35.178.235.22:60148] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env"] [unique_id "aRiFIdpja_6cDxKbxFn3vQAAANg"]
[Sat Nov 15 21:50:25.890437 2025] [:error] [pid 20313:tid 20324] [client 35.178.235.22:60096] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env"] [unique_id "aRiFIRI9DXIgPadBLUaoCwAAAsg"]
[Sat Nov 15 21:50:25.891301 2025] [:error] [pid 27997:tid 28008] [client 35.178.235.22:60052] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/.env.save"] [unique_id "aRiFIdpja_6cDxKbxFn3vgAAAMk"]
[Sat Nov 15 21:50:25.891348 2025] [:error] [pid 20313:tid 20322] [client 35.178.235.22:60042] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env.bak"] [unique_id "aRiFIRI9DXIgPadBLUaoDAAAAsY"]
[Sat Nov 15 21:50:25.899638 2025] [:error] [pid 27911:tid 27971] [client 35.178.235.22:60228] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/includes/.env.old"] [unique_id "aRiFIcGzUdrhGBIfiKSBbAAAAIM"]
[Sat Nov 15 21:50:25.901201 2025] [:error] [pid 20654:tid 20676] [client 35.178.235.22:59988] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.tmp"] [unique_id "aRiFIXcS7eC8vO76_yccMgAAA5M"]
[Sat Nov 15 21:50:25.901318 2025] [:error] [pid 27997:tid 28019] [client 35.178.235.22:60190] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/includes/.env"] [unique_id "aRiFIdpja_6cDxKbxFn3vwAAANQ"]
[Sat Nov 15 21:50:25.904257 2025] [:error] [pid 27997:tid 28004] [client 35.178.235.22:60138] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/.env.bak"] [unique_id "aRiFIdpja_6cDxKbxFn3wAAAAMU"]
[Sat Nov 15 21:50:25.904257 2025] [:error] [pid 22613:tid 22616] [client 35.178.235.22:60132] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/.env.old"] [unique_id "aRiFISoyR3cDsIRGPRnd3wAAAgE"]
[Sat Nov 15 21:50:25.904292 2025] [:error] [pid 20654:tid 20668] [client 35.178.235.22:60070] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/.env"] [unique_id "aRiFIXcS7eC8vO76_yccMwAAA4s"]
[Sat Nov 15 21:50:25.907288 2025] [:error] [pid 20313:tid 20333] [client 35.178.235.22:60020] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.save"] [unique_id "aRiFIRI9DXIgPadBLUaoDQAAAtE"]
[Sat Nov 15 21:50:25.931259 2025] [:error] [pid 27997:tid 28013] [client 35.178.235.22:60116] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/.env.bak"] [unique_id "aRiFIdpja_6cDxKbxFn3wQAAAM4"]
[Sat Nov 15 21:50:25.931861 2025] [:error] [pid 19959:tid 19979] [client 35.178.235.22:59998] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env.bak"] [unique_id "aRiFIcjejiTUP1-IawP7_wAAAY0"]
[Sat Nov 15 21:50:25.933440 2025] [:error] [pid 20346:tid 20360] [client 35.178.235.22:59962] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env.old"] [unique_id "aRiFIZ7hsydZdIoVTlteXAAAAws"]
[Sat Nov 15 21:50:25.934025 2025] [:error] [pid 22765:tid 22788] [client 35.178.235.22:60014] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config/.env.save"] [unique_id "aRiFIabrQzjuZmPIWDYNnwAAApI"]
[Sat Nov 15 21:50:25.934437 2025] [:error] [pid 20313:tid 20325] [client 35.178.235.22:60082] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/.env"] [unique_id "aRiFIRI9DXIgPadBLUaoDgAAAsk"]
[Sat Nov 15 21:50:25.935048 2025] [:error] [pid 20654:tid 20667] [client 35.178.235.22:60200] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/.env"] [unique_id "aRiFIXcS7eC8vO76_yccNAAAA4o"]
[Sat Nov 15 21:50:25.935986 2025] [:error] [pid 19959:tid 19970] [client 35.178.235.22:60028] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env.old"] [unique_id "aRiFIcjejiTUP1-IawP8AAAAAYQ"]
[Sat Nov 15 21:50:25.958975 2025] [:error] [pid 20346:tid 20368] [client 35.178.235.22:60176] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application/.env"] [unique_id "aRiFIZ7hsydZdIoVTlteXQAAAxM"]
[Sat Nov 15 21:50:25.971540 2025] [:error] [pid 20654:tid 20675] [client 35.178.235.22:60194] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/.env.bak"] [unique_id "aRiFIXcS7eC8vO76_yccNQAAA5I"]
[Sat Nov 15 21:50:25.971801 2025] [:error] [pid 20346:tid 20372] [client 35.178.235.22:60244] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/includes/.env.save"] [unique_id "aRiFIZ7hsydZdIoVTlteXgAAAxc"]
[Sat Nov 15 21:50:25.974403 2025] [:error] [pid 27997:tid 28017] [client 35.178.235.22:60204] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/.env.save"] [unique_id "aRiFIdpja_6cDxKbxFn3wgAAANI"]
[Sat Nov 15 21:50:25.976267 2025] [:error] [pid 27909:tid 27915] [client 35.178.235.22:60208] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env.save"] [unique_id "aRiFISTfZ6B57n8HepVIdgAAAAI"]
[Sat Nov 15 21:50:25.976358 2025] [:error] [pid 27909:tid 27936] [client 35.178.235.22:60106] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config/.env.old"] [unique_id "aRiFISTfZ6B57n8HepVIdwAAABc"]
[Sat Nov 15 21:50:25.976760 2025] [:error] [pid 20313:tid 20326] [client 35.178.235.22:60252] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/system/.env.old"] [unique_id "aRiFIRI9DXIgPadBLUaoDwAAAso"]
[Sat Nov 15 21:50:25.993515 2025] [:error] [pid 20313:tid 20323] [client 35.178.235.22:60238] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/system/.env"] [unique_id "aRiFIRI9DXIgPadBLUaoEQAAAsc"]
[Sat Nov 15 21:50:25.993515 2025] [:error] [pid 20313:tid 20330] [client 35.178.235.22:60164] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/.env.old"] [unique_id "aRiFIRI9DXIgPadBLUaoEAAAAs4"]
[Sat Nov 15 21:50:25.994596 2025] [:error] [pid 20346:tid 20353] [client 35.178.235.22:60056] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env.bak"] [unique_id "aRiFIZ7hsydZdIoVTlteXwAAAwQ"]
[Sat Nov 15 21:50:25.996806 2025] [:error] [pid 27909:tid 27930] [client 35.178.235.22:60202] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application/.env.old"] [unique_id "aRiFISTfZ6B57n8HepVIeAAAABE"]
[Sat Nov 15 21:50:25.997371 2025] [:error] [pid 27997:tid 28020] [client 35.178.235.22:60088] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application/.env.save"] [unique_id "aRiFIdpja_6cDxKbxFn3wwAAANU"]
[Sat Nov 15 21:50:25.997499 2025] [:error] [pid 19961:tid 20014] [client 35.178.235.22:60154] [client 35.178.235.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/src/.env.old"] [unique_id "aRiFITar7Si-84EApVSPmQAAAdU"]
[Sun Nov 16 15:52:16.094284 2025] [:error] [pid 52469:tid 52490] [client 54.241.83.49:43164] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aRmCsE6HaXpHeEZ98Z2m0AAAAA0"]
[Sun Nov 16 15:52:23.200569 2025] [:error] [pid 34165:tid 34199] [client 54.241.83.49:44822] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "aRmCt3hG2YTKEjXchwkNFQAAAcQ"]
[Sun Nov 16 15:52:27.638344 2025] [:error] [pid 20556:tid 20577] [client 54.241.83.49:35310] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dev"] [unique_id "aRmCu0kbyEckbWtBcCJfPgAAARM"]
[Sun Nov 16 15:52:29.869953 2025] [:error] [pid 34164:tid 34176] [client 54.241.83.49:35378] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "aRmCve93ccBCLD8-Q4Yr4gAAAYg"]
[Sun Nov 16 15:52:29.871948 2025] [:error] [pid 34164:tid 34181] [client 54.241.83.49:35370] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "aRmCve93ccBCLD8-Q4Yr4wAAAY0"]
[Sun Nov 16 15:52:29.909935 2025] [:error] [pid 34227:tid 34233] [client 54.241.83.49:35398] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.prod"] [unique_id "aRmCvX108zGLYs9eMugbxwAAAgQ"]
[Sun Nov 16 15:52:29.927506 2025] [:error] [pid 34164:tid 34187] [client 54.241.83.49:35384] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "aRmCve93ccBCLD8-Q4Yr5QAAAZM"]
[Sun Nov 16 15:52:49.310196 2025] [:error] [pid 52469:tid 52488] [client 54.241.83.49:41010] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "aRmC0U6HaXpHeEZ98Z2m6gAAAAs"]
[Sun Nov 16 15:52:51.222432 2025] [:error] [pid 20556:tid 20573] [client 54.241.83.49:41022] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.backup"] [unique_id "aRmC00kbyEckbWtBcCJfWgAAAQ8"]
[Sun Nov 16 15:52:51.223841 2025] [:error] [pid 52563:tid 52587] [client 54.241.83.49:41038] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.old"] [unique_id "aRmC08-l3ey-hVJ5AuuNtQAAANU"]
[Sun Nov 16 15:52:51.258497 2025] [:error] [pid 52563:tid 52582] [client 54.241.83.49:41052] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env.bak"] [unique_id "aRmC08-l3ey-hVJ5AuuNtgAAANA"]
[Sun Nov 16 15:52:51.265892 2025] [:error] [pid 34133:tid 34148] [client 54.241.83.49:41072] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.orig"] [unique_id "aRmC0_SAB3iwXVRY0gF5WgAAAU0"]
[Sun Nov 16 15:52:51.270563 2025] [:error] [pid 52563:tid 52573] [client 54.241.83.49:41062] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.bak"] [unique_id "aRmC08-l3ey-hVJ5AuuNtwAAAMc"]
[Sun Nov 16 15:52:51.333660 2025] [:error] [pid 52471:tid 52548] [client 54.241.83.49:41146] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env"] [unique_id "aRmC09mWsFzjR5CEgDU0cwAAAJA"]
[Sun Nov 16 15:52:51.364588 2025] [:error] [pid 34133:tid 34141] [client 54.241.83.49:41090] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env.save"] [unique_id "aRmC0_SAB3iwXVRY0gF5WwAAAUY"]
[Sun Nov 16 15:52:51.366926 2025] [:error] [pid 34227:tid 34230] [client 54.241.83.49:41162] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.sample"] [unique_id "aRmC03108zGLYs9eMugb2wAAAgE"]
[Sun Nov 16 15:52:51.372223 2025] [:error] [pid 52471:tid 52541] [client 54.241.83.49:41080] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env"] [unique_id "aRmC09mWsFzjR5CEgDU0dAAAAIk"]
[Sun Nov 16 15:52:51.380419 2025] [:error] [pid 52469:tid 52494] [client 54.241.83.49:41164] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env.old"] [unique_id "aRmC006HaXpHeEZ98Z2m6wAAABE"]
[Sun Nov 16 15:52:51.386485 2025] [:error] [pid 34133:tid 34145] [client 54.241.83.49:41178] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env.save"] [unique_id "aRmC0_SAB3iwXVRY0gF5XAAAAUo"]
[Sun Nov 16 15:52:51.388396 2025] [:error] [pid 34133:tid 34146] [client 54.241.83.49:41110] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.tmp"] [unique_id "aRmC0_SAB3iwXVRY0gF5XQAAAUs"]
[Sun Nov 16 15:52:51.405854 2025] [:error] [pid 52469:tid 52485] [client 54.241.83.49:41106] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.save"] [unique_id "aRmC006HaXpHeEZ98Z2m7AAAAAg"]
[Sun Nov 16 15:52:51.446956 2025] [:error] [pid 34133:tid 34143] [client 54.241.83.49:41134] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env~"] [unique_id "aRmC0_SAB3iwXVRY0gF5XgAAAUg"]
[Sun Nov 16 15:52:51.473866 2025] [:error] [pid 34133:tid 34137] [client 54.241.83.49:41024] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dist"] [unique_id "aRmC0_SAB3iwXVRY0gF5XwAAAUI"]
[Sun Nov 16 15:52:51.505369 2025] [:error] [pid 34133:tid 34151] [client 54.241.83.49:41124] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.swp"] [unique_id "aRmC0_SAB3iwXVRY0gF5YAAAAVA"]
[Sun Nov 16 15:52:55.066173 2025] [:error] [pid 52471:tid 52556] [client 54.241.83.49:41184] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env.bak"] [unique_id "aRmC19mWsFzjR5CEgDU0egAAAJg"]
[Sun Nov 16 15:52:55.931612 2025] [:error] [pid 52469:tid 52479] [client 54.241.83.49:41186] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env.old"] [unique_id "aRmC106HaXpHeEZ98Z2m8wAAAAI"]
[Sun Nov 16 15:52:56.112678 2025] [:error] [pid 52563:tid 52566] [client 54.241.83.49:41200] [client 54.241.83.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env"] [unique_id "aRmC2M-l3ey-hVJ5AuuNugAAAMA"]
[Tue Nov 18 04:21:29.219686 2025] [:error] [pid 61393:tid 61476] [client 93.123.109.175:64764] [client 93.123.109.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aRuDyWH9XjlbVPv9gQUBqwAAAJQ"]
[Wed Nov 19 02:18:51.331833 2025] [:error] [pid 3052:tid 3137] [client 134.209.230.234:62000] [client 134.209.230.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aRy4i1NM6bOMTTuJnz2ZwgAAAMg"]
[Wed Nov 19 02:18:51.877432 2025] [:error] [pid 43880:tid 43908] [client 134.209.230.234:62313] [client 134.209.230.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aRy4i-1q1HNbKyNr9SZ5jAAAAFc"]
[Wed Nov 19 02:18:52.433248 2025] [:error] [pid 44063:tid 44132] [client 134.209.230.234:64919] [client 134.209.230.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aRy4jEVOSC7H33BBqQ0HfwAAAI8"]
[Wed Nov 19 02:18:52.938357 2025] [:error] [pid 14439:tid 14448] [client 134.209.230.234:49154] [client 134.209.230.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aRy4jFat0cKFYVAxpdDiZgAAAQc"]
[Wed Nov 19 02:18:53.534343 2025] [:error] [pid 14439:tid 14446] [client 134.209.230.234:49548] [client 134.209.230.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aRy4jVat0cKFYVAxpdDidgAAAQU"]
[Thu Nov 20 18:51:06.746203 2025] [:error] [pid 34405:tid 34408] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:06.954283 2025] [:error] [pid 34405:tid 34420] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.de/
[Thu Nov 20 18:51:07.562706 2025] [:error] [pid 34405:tid 34424] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/ava.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:07.779718 2025] [:error] [pid 34405:tid 34407] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:08.002064 2025] [:error] [pid 34405:tid 34409] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/pow.php, referer: https://www.google.com/
[Thu Nov 20 18:51:08.232817 2025] [:error] [pid 34405:tid 34422] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/zuk.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:08.453254 2025] [:error] [pid 34405:tid 34421] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/fss.php, referer: https://www.google.com/
[Thu Nov 20 18:51:08.662046 2025] [:error] [pid 34405:tid 34417] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:08.870739 2025] [:error] [pid 34405:tid 34415] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php, referer: https://www.google.com/
[Thu Nov 20 18:51:09.079698 2025] [:error] [pid 34405:tid 34416] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:09.289274 2025] [:error] [pid 34405:tid 34411] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.com/
[Thu Nov 20 18:51:09.500542 2025] [:error] [pid 34405:tid 34419] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/fox.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:10.352659 2025] [:error] [pid 34405:tid 34430] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:10.585755 2025] [:error] [pid 34405:tid 34408] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:11.080629 2025] [:error] [pid 34405:tid 34413] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.google.com/
[Thu Nov 20 18:51:11.290377 2025] [:error] [pid 34405:tid 34429] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:11.500531 2025] [:error] [pid 34405:tid 34409] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.de/
[Thu Nov 20 18:51:11.711451 2025] [:error] [pid 34405:tid 34421] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:11.929098 2025] [:error] [pid 34405:tid 34417] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:12.145029 2025] [:error] [pid 34405:tid 34412] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:12.564105 2025] [:error] [pid 34405:tid 34431] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php, referer: https://www.google.de/
[Thu Nov 20 18:51:12.790214 2025] [:error] [pid 34405:tid 34411] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:13.000941 2025] [:error] [pid 34405:tid 34419] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:13.218325 2025] [:error] [pid 34405:tid 34410] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:13.428447 2025] [:error] [pid 34405:tid 34426] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:13.664029 2025] [:error] [pid 34405:tid 34414] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.de/
[Thu Nov 20 18:51:17.894479 2025] [:error] [pid 34405:tid 34408] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:18.105169 2025] [:error] [pid 34405:tid 34424] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php, referer: https://www.google.com/
[Thu Nov 20 18:51:18.353215 2025] [:error] [pid 34405:tid 34413] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php, referer: https://www.google.fr/
[Thu Nov 20 18:51:18.774732 2025] [:error] [pid 34405:tid 34429] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:20.748131 2025] [:error] [pid 34405:tid 34409] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php, referer: https://www.google.com/
[Thu Nov 20 18:51:20.994418 2025] [:error] [pid 34405:tid 34417] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php, referer: https://www.google.de/
[Thu Nov 20 18:51:21.467819 2025] [:error] [pid 34405:tid 34415] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:21.687029 2025] [:error] [pid 34405:tid 34427] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:21.939930 2025] [:error] [pid 34405:tid 34416] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:22.156658 2025] [:error] [pid 34405:tid 34411] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php, referer: https://www.google.com/
[Thu Nov 20 18:51:22.386209 2025] [:error] [pid 34405:tid 34419] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.com/
[Thu Nov 20 18:51:22.595565 2025] [:error] [pid 34405:tid 34410] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:25.343687 2025] [:error] [pid 34405:tid 34408] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:29.451096 2025] [:error] [pid 34405:tid 34416] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:29.899234 2025] [:error] [pid 34405:tid 34411] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:31.351124 2025] [:error] [pid 34405:tid 34411] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:31.586451 2025] [:error] [pid 34405:tid 34414] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:31.795962 2025] [:error] [pid 34405:tid 34428] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/.__info.php, referer: https://www.google.com/
[Thu Nov 20 18:51:32.001837 2025] [:error] [pid 34405:tid 34430] [client 20.1.200.61:2201] [client 20.1.200.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.1.200.61, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aR7yszFpvu8oRK7ATfsaqwAAARc"], referer: https://www.google.com/
[Thu Nov 20 18:51:32.007700 2025] [:error] [pid 34405:tid 34430] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php, referer: https://www.google.com/
[Thu Nov 20 18:51:32.442465 2025] [:error] [pid 34405:tid 34424] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:32.956769 2025] [:error] [pid 34405:tid 34429] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.de/
[Thu Nov 20 18:51:33.202086 2025] [:error] [pid 34405:tid 34407] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:33.413673 2025] [:error] [pid 34405:tid 34409] [client 20.1.200.61:2201] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:33.644366 2025] [:error] [pid 34405:tid 34417] [client 20.1.200.61:2201] [client 20.1.200.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aR7ytTFpvu8oRK7ATfsasgAAAQo"], referer: https://www.google.co.uk/
[Thu Nov 20 18:51:36.760705 2025] [:error] [pid 40636:tid 40661] [client 20.1.200.61:6208] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:37.668589 2025] [:error] [pid 40636:tid 40650] [client 20.1.200.61:6208] File does not exist: /usr/local/apache/htdocs/suspended-page/mari.php, referer: https://www.google.fr/
[Thu Nov 20 18:51:37.893503 2025] [:error] [pid 40636:tid 40641] [client 20.1.200.61:6208] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:38.323913 2025] [:error] [pid 40636:tid 40647] [client 20.1.200.61:6208] [client 20.1.200.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aR7yugK8BWUoW3xq0HAODwAAA4c"], referer: https://www.google.co.uk/
[Thu Nov 20 18:51:42.450292 2025] [:error] [pid 55430:tid 55445] [client 20.1.200.61:5508] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php, referer: https://www.google.fr/
[Thu Nov 20 18:51:43.606209 2025] [:error] [pid 55430:tid 55454] [client 20.1.200.61:5508] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:43.868585 2025] [:error] [pid 55430:tid 55436] [client 20.1.200.61:5508] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:44.558488 2025] [:error] [pid 55430:tid 55448] [client 20.1.200.61:5508] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:45.404926 2025] [:error] [pid 55430:tid 55434] [client 20.1.200.61:5508] [client 20.1.200.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aR7ywfPZXaIMEU4pE7sBCAAAAME"], referer: https://www.yahoo.com/
[Thu Nov 20 18:51:50.335560 2025] [:error] [pid 40508:tid 40526] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php, referer: https://www.google.de/
[Thu Nov 20 18:51:50.553592 2025] [:error] [pid 40508:tid 40530] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/god4m.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:50.988175 2025] [:error] [pid 40508:tid 40517] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:51.197113 2025] [:error] [pid 40508:tid 40513] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/07.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:51.408240 2025] [:error] [pid 40508:tid 40532] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:51.619423 2025] [:error] [pid 40508:tid 40512] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:51.839640 2025] [:error] [pid 40508:tid 40527] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php, referer: https://www.bing.com/
[Thu Nov 20 18:51:52.049236 2025] [:error] [pid 40508:tid 40520] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:53.760620 2025] [:error] [pid 40508:tid 40534] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php, referer: https://www.google.fr/
[Thu Nov 20 18:51:54.027724 2025] [:error] [pid 40508:tid 40516] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:54.236673 2025] [:error] [pid 40508:tid 40515] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:54.490038 2025] [:error] [pid 40508:tid 40510] [client 20.1.200.61:3883] [client 20.1.200.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.1.200.61, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aR7yyqxXNVCMW_ksxPup1QAAAoA"], referer: https://www.google.com/
[Thu Nov 20 18:51:54.496640 2025] [:error] [pid 40508:tid 40510] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Thu Nov 20 18:51:54.705558 2025] [:error] [pid 40508:tid 40523] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php, referer: https://www.google.fr/
[Thu Nov 20 18:51:54.949830 2025] [:error] [pid 40508:tid 40511] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://www.google.de/
[Thu Nov 20 18:51:56.442262 2025] [:error] [pid 40508:tid 40511] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/classsmtps.php, referer: https://www.google.com/
[Thu Nov 20 18:51:56.654269 2025] [:error] [pid 40508:tid 40524] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:56.922654 2025] [:error] [pid 40508:tid 40518] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php, referer: https://www.google.com/
[Thu Nov 20 18:51:57.299255 2025] [:error] [pid 40508:tid 40518] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:57.511663 2025] [:error] [pid 40508:tid 40522] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-comments-post.php, referer: https://www.google.de/
[Thu Nov 20 18:51:57.769416 2025] [:error] [pid 40508:tid 40517] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:57.989565 2025] [:error] [pid 40508:tid 40513] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:51:59.360655 2025] [:error] [pid 40508:tid 40513] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:51:59.569439 2025] [:error] [pid 40508:tid 40520] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:51:59.788433 2025] [:error] [pid 40508:tid 40529] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php, referer: https://www.google.de/
[Thu Nov 20 18:52:00.004168 2025] [:error] [pid 40508:tid 40528] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php, referer: https://www.google.com/
[Thu Nov 20 18:52:00.215021 2025] [:error] [pid 40508:tid 40534] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php, referer: https://www.bing.com/
[Thu Nov 20 18:52:00.434330 2025] [:error] [pid 40508:tid 40510] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.bing.com/
[Thu Nov 20 18:52:00.643192 2025] [:error] [pid 40508:tid 40523] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/hoot.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:00.882644 2025] [:error] [pid 40508:tid 40533] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:01.101701 2025] [:error] [pid 40508:tid 40514] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php, referer: https://www.google.de/
[Thu Nov 20 18:52:01.310045 2025] [:error] [pid 40508:tid 40521] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:52:01.519267 2025] [:error] [pid 40508:tid 40526] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php, referer: https://www.bing.com/
[Thu Nov 20 18:52:01.778232 2025] [:error] [pid 40508:tid 40511] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php, referer: https://www.google.com/
[Thu Nov 20 18:52:01.994233 2025] [:error] [pid 40508:tid 40524] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php, referer: https://www.google.com/
[Thu Nov 20 18:52:02.237119 2025] [:error] [pid 40508:tid 40530] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:02.488431 2025] [:error] [pid 40508:tid 40531] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:52:02.719762 2025] [:error] [pid 40508:tid 40522] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:52:02.955857 2025] [:error] [pid 40508:tid 40517] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:03.191922 2025] [:error] [pid 40508:tid 40532] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php, referer: https://www.bing.com/
[Thu Nov 20 18:52:03.403313 2025] [:error] [pid 40508:tid 40512] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:03.621937 2025] [:error] [pid 40508:tid 40513] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:52:03.870712 2025] [:error] [pid 40508:tid 40527] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php, referer: https://www.bing.com/
[Thu Nov 20 18:52:04.079698 2025] [:error] [pid 40508:tid 40520] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:52:04.341458 2025] [:error] [pid 40508:tid 40528] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:04.553561 2025] [:error] [pid 40508:tid 40525] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php, referer: https://www.google.fr/
[Thu Nov 20 18:52:04.815089 2025] [:error] [pid 40508:tid 40515] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php, referer: https://www.google.fr/
[Thu Nov 20 18:52:06.302519 2025] [:error] [pid 40508:tid 40515] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/123.php, referer: https://www.google.fr/
[Thu Nov 20 18:52:06.510880 2025] [:error] [pid 40508:tid 40514] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:52:06.720288 2025] [:error] [pid 40508:tid 40521] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php, referer: https://www.google.de/
[Thu Nov 20 18:52:06.929527 2025] [:error] [pid 40508:tid 40526] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:52:07.169520 2025] [:error] [pid 40508:tid 40511] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php, referer: https://www.google.com/
[Thu Nov 20 18:52:08.812276 2025] [:error] [pid 40508:tid 40530] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php, referer: https://www.bing.com/
[Thu Nov 20 18:52:09.028704 2025] [:error] [pid 40508:tid 40531] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/berax.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:09.251183 2025] [:error] [pid 40508:tid 40517] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php, referer: https://www.google.co.uk/
[Thu Nov 20 18:52:09.460212 2025] [:error] [pid 40508:tid 40532] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php, referer: https://www.google.com/
[Thu Nov 20 18:52:09.684949 2025] [:error] [pid 40508:tid 40512] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/form.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:09.894654 2025] [:error] [pid 40508:tid 40527] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php, referer: https://www.yahoo.com/
[Thu Nov 20 18:52:11.512238 2025] [:error] [pid 40508:tid 40534] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/kyami.php, referer: https://duckduckgo.com/
[Thu Nov 20 18:52:11.779363 2025] [:error] [pid 40508:tid 40529] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://www.google.de/
[Thu Nov 20 18:52:11.988170 2025] [:error] [pid 40508:tid 40518] [client 20.1.200.61:3883] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php, referer: https://duckduckgo.com/
[Fri Nov 21 00:44:37.689704 2025] [:error] [pid 13506:tid 13689] [client 34.26.122.161:34194] [client 34.26.122.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aR9FdaTbGYpGB-467xY6NwAAABM"]
[Fri Nov 21 14:59:58.340961 2025] [:error] [pid 25431:tid 25498] [client 213.21.239.4:37776] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aSAN7sklhXxmoIExII0HtQAAAIs"]
[Fri Nov 21 15:15:51.962637 2025] [:error] [pid 25554:tid 25563] [client 213.21.239.4:47870] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aSARpx-NtB-9AzFZrk4lCgAAAQU"]
[Fri Nov 21 15:55:41.828201 2025] [:error] [pid 25554:tid 25559] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Nov 21 15:55:42.340992 2025] [:error] [pid 25554:tid 25570] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Nov 21 15:55:42.772015 2025] [:error] [pid 25554:tid 25565] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Fri Nov 21 15:55:43.230487 2025] [:error] [pid 25554:tid 25561] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Nov 21 15:55:43.670772 2025] [:error] [pid 25554:tid 25578] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Nov 21 15:55:44.103303 2025] [:error] [pid 25554:tid 25582] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Nov 21 15:55:44.565003 2025] [:error] [pid 25554:tid 25559] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Nov 21 15:55:45.040080 2025] [:error] [pid 25554:tid 25581] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Nov 21 15:55:46.016822 2025] [:error] [pid 25554:tid 25577] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Nov 21 15:55:46.934839 2025] [:error] [pid 25554:tid 25564] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Nov 21 15:55:47.369823 2025] [:error] [pid 25554:tid 25575] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Nov 21 15:55:47.851802 2025] [:error] [pid 25554:tid 25558] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Nov 21 15:55:48.342475 2025] [:error] [pid 25554:tid 25566] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Nov 21 15:55:48.799451 2025] [:error] [pid 25554:tid 25562] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Nov 21 15:55:49.230090 2025] [:error] [pid 25554:tid 25580] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Nov 21 15:55:49.710350 2025] [:error] [pid 25554:tid 25576] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Nov 21 15:55:50.154699 2025] [:error] [pid 25554:tid 25570] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Nov 21 15:55:50.630382 2025] [:error] [pid 25554:tid 25580] [client 45.132.227.57:63989] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Nov 21 15:55:56.956399 2025] [:error] [pid 25554:tid 25563] [client 45.132.227.57:63989] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSAbDB-NtB-9AzFZrk5LbgAAAQU"]
[Fri Nov 21 15:55:59.161484 2025] [:error] [pid 25431:tid 25498] [client 172.98.32.91:49089] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSAbD8klhXxmoIExII0q0gAAAIs"]
[Fri Nov 21 15:56:01.485161 2025] [:error] [pid 25429:tid 25449] [client 172.98.32.82:60043] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Nov 21 15:56:02.822419 2025] [:error] [pid 25429:tid 25441] [client 172.98.32.82:60043] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSAbEj4rZbRSr7vu-NOfoAAAAAg"]
[Fri Nov 21 15:56:04.695398 2025] [:error] [pid 46939:tid 46965] [client 172.98.32.87:34873] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Nov 21 15:56:05.148687 2025] [:error] [pid 46939:tid 46943] [client 172.98.32.87:34873] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSAbFe0OmVoxD4VZ_ZlmQQAAAUE"]
[Fri Nov 21 15:56:07.442365 2025] [:error] [pid 25554:tid 25575] [client 172.98.32.99:33719] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Nov 21 15:56:09.645905 2025] [:error] [pid 25554:tid 25579] [client 172.98.32.99:33719] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSAbGR-NtB-9AzFZrk5LzgAAARU"]
[Fri Nov 21 15:56:10.971663 2025] [:error] [pid 25429:tid 25433] [client 136.144.42.73:31473] [client 136.144.42.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSAbGj4rZbRSr7vu-NOf0QAAAAA"]
[Fri Nov 21 15:56:11.866110 2025] [:error] [pid 46939:tid 46948] [client 45.132.227.53:62121] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSAbG-0OmVoxD4VZ_ZlmcAAAAUY"]
[Fri Nov 21 15:56:12.804198 2025] [:error] [pid 25429:tid 25446] [client 136.144.42.69:43299] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSAbHD4rZbRSr7vu-NOf4QAAAA0"]
[Fri Nov 21 15:56:13.701217 2025] [:error] [pid 25429:tid 25443] [client 172.98.32.86:38803] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSAbHT4rZbRSr7vu-NOf6AAAAAo"]
[Fri Nov 21 15:56:14.584349 2025] [:error] [pid 25521:tid 25535] [client 172.98.32.100:37341] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSAbHvhXnBMilDddn3Xg2AAAAMw"]
[Fri Nov 21 15:56:15.933491 2025] [:error] [pid 25521:tid 25536] [client 172.98.32.80:63733] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSAbH_hXnBMilDddn3Xg4wAAAM0"]
[Fri Nov 21 15:56:16.909467 2025] [:error] [pid 25430:tid 25469] [client 136.144.42.72:22699] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Fri Nov 21 15:56:17.800630 2025] [:error] [pid 25430:tid 25480] [client 136.144.42.72:22699] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aSAbIapnWJcWt_4foXk8uAAAAFQ"]
[Fri Nov 21 15:56:21.126482 2025] [:error] [pid 46939:tid 46943] [client 45.132.227.54:60605] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSAbJe0OmVoxD4VZ_ZlmowAAAUE"]
[Fri Nov 21 15:56:22.479471 2025] [:error] [pid 25429:tid 25435] [client 172.98.32.99:27641] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSAbJj4rZbRSr7vu-NOgCgAAAAI"]
[Fri Nov 21 15:56:23.346290 2025] [:error] [pid 25554:tid 25567] [client 45.132.227.68:60659] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Nov 21 15:56:23.826304 2025] [:error] [pid 25554:tid 25576] [client 45.132.227.68:60659] [client 45.132.227.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSAbJx-NtB-9AzFZrk5MPwAAARI"]
[Fri Nov 21 15:56:24.697142 2025] [:error] [pid 25429:tid 25456] [client 172.98.32.90:46281] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Nov 21 15:56:26.075197 2025] [:error] [pid 25429:tid 25443] [client 172.98.32.90:46281] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Nov 21 15:56:27.481705 2025] [:error] [pid 25429:tid 25446] [client 172.98.32.90:46281] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSAbKz4rZbRSr7vu-NOgJQAAAA0"]
[Fri Nov 21 15:56:28.396067 2025] [:error] [pid 25431:tid 25488] [client 172.98.32.83:53779] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Fri Nov 21 15:56:28.914505 2025] [:error] [pid 25431:tid 25490] [client 172.98.32.83:53779] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSAbLMklhXxmoIExII0rxgAAAIM"]
[Fri Nov 21 15:56:29.824063 2025] [:error] [pid 25429:tid 25444] [client 172.98.32.91:64195] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Nov 21 15:56:30.788263 2025] [:error] [pid 25429:tid 25442] [client 172.98.32.91:64195] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSAbLj4rZbRSr7vu-NOgNwAAAAk"]
[Fri Nov 21 15:56:32.202177 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.76:38509] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSAbMD4rZbRSr7vu-NOgRgAAABg"]
[Fri Nov 21 15:56:33.705294 2025] [:error] [pid 25431:tid 25501] [client 45.132.227.66:24471] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Fri Nov 21 15:56:34.305980 2025] [:error] [pid 25431:tid 25503] [client 45.132.227.66:24471] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Fri Nov 21 15:56:35.195151 2025] [:error] [pid 25431:tid 25491] [client 45.132.227.66:24471] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSAbM8klhXxmoIExII0r-wAAAIQ"]
[Fri Nov 21 15:56:36.592908 2025] [:error] [pid 25429:tid 25434] [client 45.132.227.56:57343] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSAbND4rZbRSr7vu-NOgVwAAAAE"]
[Fri Nov 21 15:56:37.978654 2025] [:error] [pid 25430:tid 25474] [client 172.98.32.88:53143] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSAbNapnWJcWt_4foXk9XQAAAE4"]
[Fri Nov 21 15:56:38.847413 2025] [:error] [pid 25554:tid 25579] [client 136.144.42.73:30369] [client 136.144.42.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSAbNh-NtB-9AzFZrk5MrgAAARU"]
[Fri Nov 21 15:56:39.730067 2025] [:error] [pid 25431:tid 25490] [client 172.98.32.77:40365] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSAbN8klhXxmoIExII0sKQAAAIM"]
[Fri Nov 21 15:56:41.456313 2025] [:error] [pid 25521:tid 25535] [client 172.98.32.77:25563] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Fri Nov 21 15:56:41.885171 2025] [:error] [pid 25521:tid 25526] [client 172.98.32.77:25563] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSAbOfhXnBMilDddn3XhjwAAAMM"]
[Fri Nov 21 15:56:42.741777 2025] [:error] [pid 25431:tid 25509] [client 172.98.32.100:24913] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSAbOsklhXxmoIExII0sQwAAAJY"]
[Fri Nov 21 15:56:43.597992 2025] [:error] [pid 25554:tid 25579] [client 45.132.227.65:23883] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSAbOx-NtB-9AzFZrk5M4wAAARU"]
[Fri Nov 21 15:56:45.324227 2025] [:error] [pid 46939:tid 46961] [client 45.132.227.60:43427] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Nov 21 15:56:46.195211 2025] [:error] [pid 46939:tid 46952] [client 45.132.227.60:43427] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Nov 21 15:56:47.921044 2025] [:error] [pid 46939:tid 46943] [client 45.132.227.60:43427] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSAbP-0OmVoxD4VZ_ZlncwAAAUE"]
[Fri Nov 21 15:56:50.090771 2025] [:error] [pid 25429:tid 25447] [client 172.98.32.76:34389] [client 172.98.32.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.76, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSAbQj4rZbRSr7vu-NOgqwAAAA4"]
[Fri Nov 21 15:56:50.562362 2025] [:error] [pid 25429:tid 25450] [client 172.98.32.76:34389] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Nov 21 15:56:52.762212 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.76:34389] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Fri Nov 21 15:56:53.239823 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.76:34389] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Nov 21 15:56:55.753656 2025] [:error] [pid 25429:tid 25448] [client 172.98.32.76:34389] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSAbRz4rZbRSr7vu-NOg1QAAAA8"]
[Fri Nov 21 15:56:57.136610 2025] [:error] [pid 25430:tid 25466] [client 45.132.227.62:20315] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Fri Nov 21 15:56:57.565935 2025] [:error] [pid 25430:tid 25460] [client 45.132.227.62:20315] [client 45.132.227.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.227.62, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSAbSapnWJcWt_4foXk-CAAAAEA"]
[Fri Nov 21 15:56:58.438400 2025] [:error] [pid 25430:tid 25469] [client 45.132.227.62:20315] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSAbSqpnWJcWt_4foXk-DwAAAEk"]
[Fri Nov 21 15:57:01.224625 2025] [:error] [pid 25431:tid 25490] [client 172.98.32.86:43409] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Nov 21 15:57:02.149101 2025] [:error] [pid 25431:tid 25488] [client 172.98.32.86:43409] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Fri Nov 21 15:57:03.092362 2025] [:error] [pid 25431:tid 25509] [client 172.98.32.86:43409] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSAbT8klhXxmoIExII0tPgAAAJY"]
[Fri Nov 21 15:57:03.957384 2025] [:error] [pid 25429:tid 25442] [client 172.98.32.87:63001] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Nov 21 15:57:05.375261 2025] [:error] [pid 25429:tid 25436] [client 172.98.32.87:63001] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Fri Nov 21 15:57:06.315185 2025] [:error] [pid 25429:tid 25448] [client 172.98.32.87:63001] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Fri Nov 21 15:57:07.202629 2025] [:error] [pid 25429:tid 25455] [client 172.98.32.87:63001] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Nov 21 15:57:07.631864 2025] [:error] [pid 25429:tid 25445] [client 172.98.32.87:63001] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSAbUz4rZbRSr7vu-NOhKAAAAAw"]
[Fri Nov 21 15:57:08.565190 2025] [:error] [pid 46939:tid 46942] [client 172.98.32.97:63145] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Nov 21 15:57:08.995177 2025] [:error] [pid 46939:tid 46966] [client 172.98.32.97:63145] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Nov 21 15:57:09.503121 2025] [:error] [pid 46939:tid 46961] [client 172.98.32.97:63145] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSAbVe0OmVoxD4VZ_ZloFQAAAVM"]
[Fri Nov 21 15:57:10.935645 2025] [:error] [pid 25429:tid 25455] [client 172.98.32.93:36229] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Nov 21 15:57:11.898299 2025] [:error] [pid 25429:tid 25446] [client 172.98.32.93:36229] [client 172.98.32.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.93, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSAbVz4rZbRSr7vu-NOhTwAAAA0"]
[Fri Nov 21 15:57:12.328895 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.93:36229] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSAbWD4rZbRSr7vu-NOhUwAAAAY"]
[Fri Nov 21 15:57:17.807283 2025] [:error] [pid 25554:tid 25559] [client 136.144.42.78:37485] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Fri Nov 21 15:57:20.519735 2025] [:error] [pid 25554:tid 25569] [client 136.144.42.78:37485] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Nov 21 15:57:21.443468 2025] [:error] [pid 25554:tid 25561] [client 136.144.42.78:37485] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSAbYR-NtB-9AzFZrk5OBAAAAQM"]
[Fri Nov 21 15:57:22.305950 2025] [:error] [pid 25554:tid 25577] [client 45.132.227.60:35483] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Nov 21 15:57:23.663377 2025] [:error] [pid 25554:tid 25564] [client 45.132.227.60:35483] [client 45.132.227.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.227.60, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSAbYx-NtB-9AzFZrk5OFQAAAQY"]
[Fri Nov 21 15:57:24.111370 2025] [:error] [pid 25554:tid 25570] [client 45.132.227.60:35483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Nov 21 15:57:24.610791 2025] [:error] [pid 25554:tid 25574] [client 45.132.227.60:35483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Fri Nov 21 15:57:25.095256 2025] [:error] [pid 25554:tid 25573] [client 45.132.227.60:35483] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Fri Nov 21 15:57:25.536670 2025] [:error] [pid 25554:tid 25571] [client 45.132.227.60:35483] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSAbZR-NtB-9AzFZrk5OHwAAAQ0"]
[Fri Nov 21 15:57:26.443710 2025] [:error] [pid 46939:tid 46953] [client 136.144.42.69:60673] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Nov 21 15:57:26.877168 2025] [:error] [pid 46939:tid 46952] [client 136.144.42.69:60673] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSAbZu0OmVoxD4VZ_ZlovAAAAUo"]
[Fri Nov 21 15:57:28.315320 2025] [:error] [pid 25554:tid 25577] [client 136.144.42.78:49059] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Nov 21 15:57:28.751778 2025] [:error] [pid 25554:tid 25558] [client 136.144.42.78:49059] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSAbaB-NtB-9AzFZrk5OMAAAAQA"]
[Fri Nov 21 15:57:30.512480 2025] [:error] [pid 25431:tid 25507] [client 45.132.227.55:50345] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Fri Nov 21 15:57:30.976694 2025] [:error] [pid 25431:tid 25488] [client 45.132.227.55:50345] [client 45.132.227.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSAbasklhXxmoIExII0uDAAAAIE"]
[Fri Nov 21 15:57:32.949455 2025] [:error] [pid 25521:tid 25530] [client 45.132.227.67:35043] [client 45.132.227.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSAbbPhXnBMilDddn3Xi4AAAAMc"]
[Fri Nov 21 15:57:33.805623 2025] [:error] [pid 25554:tid 25562] [client 172.98.32.98:39605] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Nov 21 15:57:34.305701 2025] [:error] [pid 25554:tid 25580] [client 172.98.32.98:39605] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Fri Nov 21 15:57:36.074850 2025] [:error] [pid 25554:tid 25574] [client 172.98.32.98:39605] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSAbcB-NtB-9AzFZrk5OXgAAARA"]
[Fri Nov 21 15:57:37.387315 2025] [:error] [pid 25429:tid 25442] [client 136.144.42.79:47967] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSAbcT4rZbRSr7vu-NOiNQAAAAk"]
[Fri Nov 21 15:57:40.802272 2025] [:error] [pid 25431:tid 25510] [client 172.98.32.94:35561] [client 172.98.32.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSAbdMklhXxmoIExII0uYgAAAJc"]
[Fri Nov 21 15:57:41.712262 2025] [:error] [pid 25431:tid 25508] [client 172.98.32.76:57415] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Fri Nov 21 15:57:42.624479 2025] [:error] [pid 25431:tid 25499] [client 172.98.32.76:57415] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Nov 21 15:57:43.057755 2025] [:error] [pid 25431:tid 25490] [client 172.98.32.76:57415] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSAbd8klhXxmoIExII0uewAAAIM"]
[Fri Nov 21 15:57:43.967310 2025] [:error] [pid 25429:tid 25444] [client 172.98.32.83:20805] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Nov 21 15:57:44.929118 2025] [:error] [pid 25429:tid 25440] [client 172.98.32.83:20805] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSAbeD4rZbRSr7vu-NOifQAAAAc"]
[Fri Nov 21 15:57:47.199674 2025] [:error] [pid 25431:tid 25509] [client 172.98.32.80:51443] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSAbe8klhXxmoIExII0unQAAAJY"]
[Fri Nov 21 15:57:48.636120 2025] [:error] [pid 25554:tid 25570] [client 172.98.32.90:29947] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Nov 21 15:57:50.006767 2025] [:error] [pid 25554:tid 25580] [client 172.98.32.90:29947] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Fri Nov 21 15:57:50.880801 2025] [:error] [pid 25554:tid 25570] [client 172.98.32.90:29947] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Nov 21 15:57:51.960348 2025] [:error] [pid 25554:tid 25576] [client 172.98.32.90:29947] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSAbfx-NtB-9AzFZrk5O0gAAARI"]
[Fri Nov 21 15:57:52.826879 2025] [:error] [pid 25431:tid 25497] [client 172.98.32.85:51121] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSAbgMklhXxmoIExII0uxAAAAIo"]
[Fri Nov 21 15:57:53.682378 2025] [:error] [pid 25554:tid 25571] [client 172.98.32.99:22297] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSAbgR-NtB-9AzFZrk5O4gAAAQ0"]
[Fri Nov 21 15:57:54.566472 2025] [:error] [pid 46939:tid 46956] [client 136.144.42.77:34511] [client 136.144.42.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSAbgu0OmVoxD4VZ_ZlptQAAAU4"]
[Fri Nov 21 15:57:55.467165 2025] [:error] [pid 25521:tid 25527] [client 172.98.32.88:40103] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Fri Nov 21 15:57:57.153598 2025] [:error] [pid 25521:tid 25527] [client 172.98.32.88:40103] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSAbhfhXnBMilDddn3XjfgAAAMQ"]
[Fri Nov 21 15:57:58.018928 2025] [:error] [pid 25431:tid 25492] [client 172.98.32.90:45827] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSAbhsklhXxmoIExII0vCQAAAIU"]
[Fri Nov 21 15:57:58.880229 2025] [:error] [pid 25429:tid 25453] [client 172.98.32.96:65279] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Fri Nov 21 15:57:59.739260 2025] [:error] [pid 25429:tid 25455] [client 172.98.32.96:65279] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSAbhz4rZbRSr7vu-NOi6AAAABY"]
[Fri Nov 21 15:58:00.606130 2025] [:error] [pid 25430:tid 25480] [client 45.132.227.66:21611] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSAbiKpnWJcWt_4foXk_0gAAAFQ"]
[Fri Nov 21 15:58:01.533226 2025] [:error] [pid 25521:tid 25535] [client 45.132.227.62:26023] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSAbifhXnBMilDddn3XjngAAAMw"]
[Fri Nov 21 15:58:02.456272 2025] [:error] [pid 46939:tid 46966] [client 45.132.227.66:38803] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSAbiu0OmVoxD4VZ_Zlp2gAAAVg"]
[Fri Nov 21 15:58:03.763429 2025] [:error] [pid 25431:tid 25497] [client 45.132.227.55:34511] [client 45.132.227.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSAbi8klhXxmoIExII0vOgAAAIo"]
[Fri Nov 21 15:58:05.499978 2025] [:error] [pid 25431:tid 25490] [client 172.98.32.82:55533] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSAbjcklhXxmoIExII0vTAAAAIM"]
[Fri Nov 21 15:58:06.434955 2025] [:error] [pid 25429:tid 25454] [client 136.144.42.72:60429] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Nov 21 15:58:07.753636 2025] [:error] [pid 25429:tid 25442] [client 136.144.42.72:60429] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Fri Nov 21 15:58:08.252272 2025] [:error] [pid 25429:tid 25455] [client 136.144.42.72:60429] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSAbkD4rZbRSr7vu-NOjQAAAABY"]
[Fri Nov 21 15:58:09.610075 2025] [:error] [pid 25430:tid 25465] [client 45.132.227.58:45563] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Fri Nov 21 15:58:10.068655 2025] [:error] [pid 25430:tid 25473] [client 45.132.227.58:45563] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Fri Nov 21 15:58:12.381120 2025] [:error] [pid 25430:tid 25471] [client 45.132.227.58:45563] [client 45.132.227.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSAblKpnWJcWt_4foXlAPgAAAEs"]
[Fri Nov 21 15:58:14.689228 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.84:43327] [client 172.98.32.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSAblj4rZbRSr7vu-NOjhQAAABg"]
[Fri Nov 21 15:58:15.554169 2025] [:error] [pid 25430:tid 25484] [client 172.98.32.87:21371] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSAbl6pnWJcWt_4foXlAWQAAAFg"]
[Fri Nov 21 15:58:18.335372 2025] [:error] [pid 25431:tid 25487] [client 172.98.32.83:41959] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSAbmsklhXxmoIExII0vtQAAAIA"]
[Fri Nov 21 15:58:21.344838 2025] [:error] [pid 25554:tid 25578] [client 136.144.42.79:55583] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Fri Nov 21 15:58:21.777243 2025] [:error] [pid 25554:tid 25572] [client 136.144.42.79:55583] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Fri Nov 21 15:58:22.204331 2025] [:error] [pid 25554:tid 25580] [client 136.144.42.79:55583] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Fri Nov 21 15:58:22.683537 2025] [:error] [pid 25554:tid 25576] [client 136.144.42.79:55583] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Fri Nov 21 15:58:24.913145 2025] [:error] [pid 25554:tid 25581] [client 136.144.42.79:55583] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSAboB-NtB-9AzFZrk5PkgAAARc"]
[Fri Nov 21 15:58:25.767254 2025] [:error] [pid 46939:tid 46954] [client 45.132.227.53:20089] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSAboe0OmVoxD4VZ_ZlqrgAAAUw"]
[Fri Nov 21 15:58:26.673669 2025] [:error] [pid 25430:tid 25479] [client 45.132.227.61:49641] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSAboqpnWJcWt_4foXlAigAAAFM"]
[Fri Nov 21 15:58:27.589980 2025] [:error] [pid 25431:tid 25488] [client 136.144.42.77:43145] [client 136.144.42.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSAbo8klhXxmoIExII0v-gAAAIE"]
[Fri Nov 21 15:58:28.448658 2025] [:error] [pid 25430:tid 25467] [client 172.98.32.87:36635] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSAbpKpnWJcWt_4foXlAkQAAAEc"]
[Fri Nov 21 15:58:29.356357 2025] [:error] [pid 25429:tid 25456] [client 45.132.227.67:48103] [client 45.132.227.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSAbpT4rZbRSr7vu-NOkJQAAABc"]
[Fri Nov 21 15:58:30.655641 2025] [:error] [pid 46939:tid 46943] [client 136.144.42.74:33657] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSAbpu0OmVoxD4VZ_Zlq-gAAAUE"]
[Fri Nov 21 15:58:31.518902 2025] [:error] [pid 25429:tid 25438] [client 45.132.227.59:52487] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSAbpz4rZbRSr7vu-NOkQQAAAAU"]
[Fri Nov 21 15:58:32.403021 2025] [:error] [pid 25521:tid 25525] [client 172.98.32.89:54283] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSAbqPhXnBMilDddn3XkXQAAAMI"]
[Fri Nov 21 15:58:33.318566 2025] [:error] [pid 46939:tid 46945] [client 136.144.42.77:47617] [client 136.144.42.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSAbqe0OmVoxD4VZ_ZlrEwAAAUM"]
[Fri Nov 21 15:58:35.095905 2025] [:error] [pid 25554:tid 25565] [client 136.144.42.74:49357] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSAbqx-NtB-9AzFZrk5P5gAAAQc"]
[Fri Nov 21 15:58:36.492111 2025] [:error] [pid 25554:tid 25566] [client 136.144.42.79:56109] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSAbrB-NtB-9AzFZrk5P8wAAAQg"]
[Fri Nov 21 15:58:37.418493 2025] [:error] [pid 25429:tid 25445] [client 172.98.32.100:22587] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Fri Nov 21 15:58:38.275910 2025] [:error] [pid 25429:tid 25448] [client 172.98.32.100:22587] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSAbrj4rZbRSr7vu-NOkngAAAA8"]
[Fri Nov 21 15:58:40.139837 2025] [:error] [pid 25429:tid 25451] [client 172.98.32.93:20929] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSAbsD4rZbRSr7vu-NOkvAAAABI"]
[Fri Nov 21 15:58:41.934372 2025] [:error] [pid 25554:tid 25571] [client 45.132.227.61:31313] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Fri Nov 21 15:58:42.369366 2025] [:error] [pid 25554:tid 25570] [client 45.132.227.61:31313] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSAbsh-NtB-9AzFZrk5QIQAAAQw"]
[Fri Nov 21 15:58:43.712060 2025] [:error] [pid 25521:tid 25533] [client 172.98.32.95:35229] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Fri Nov 21 15:58:44.143082 2025] [:error] [pid 25521:tid 25534] [client 172.98.32.95:35229] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Fri Nov 21 15:58:44.593638 2025] [:error] [pid 25521:tid 25546] [client 172.98.32.95:35229] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Fri Nov 21 15:58:45.041012 2025] [:error] [pid 25521:tid 25542] [client 172.98.32.95:35229] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSAbtfhXnBMilDddn3XksQAAANM"]
[Fri Nov 21 15:58:46.199682 2025] [:error] [pid 25429:tid 25441] [client 45.132.227.52:39327] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Fri Nov 21 15:58:46.626810 2025] [:error] [pid 25429:tid 25440] [client 45.132.227.52:39327] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSAbtj4rZbRSr7vu-NOlLgAAAAc"]
[Fri Nov 21 15:58:48.378087 2025] [:error] [pid 25431:tid 25499] [client 172.98.32.89:26217] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Nov 21 15:58:48.857212 2025] [:error] [pid 25431:tid 25498] [client 172.98.32.89:26217] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Nov 21 15:58:49.298604 2025] [:error] [pid 25431:tid 25510] [client 172.98.32.89:26217] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Fri Nov 21 15:58:51.568993 2025] [:error] [pid 25431:tid 25494] [client 172.98.32.89:26217] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Nov 21 15:58:52.007410 2025] [:error] [pid 25431:tid 25499] [client 172.98.32.89:26217] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Fri Nov 21 15:58:53.346673 2025] [:error] [pid 25431:tid 25510] [client 172.98.32.89:26217] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Fri Nov 21 15:58:54.655513 2025] [:error] [pid 25431:tid 25508] [client 172.98.32.89:26217] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Nov 21 15:58:55.164986 2025] [:error] [pid 25431:tid 25490] [client 172.98.32.89:26217] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSAbv8klhXxmoIExII0xKwAAAIM"]
[Fri Nov 21 15:58:56.044873 2025] [:error] [pid 25431:tid 25501] [client 172.98.32.99:58283] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSAbwMklhXxmoIExII0xLgAAAI4"]
[Fri Nov 21 15:58:56.953422 2025] [:error] [pid 25431:tid 25500] [client 172.98.32.96:36231] [client 172.98.32.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.96, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aSAbwMklhXxmoIExII0xMAAAAI0"]
[Fri Nov 21 15:58:56.957244 2025] [:error] [pid 25431:tid 25500] [client 172.98.32.96:36231] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Nov 21 15:58:57.405971 2025] [:error] [pid 25431:tid 25498] [client 172.98.32.96:36231] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Fri Nov 21 15:58:57.875677 2025] [:error] [pid 25431:tid 25494] [client 172.98.32.96:36231] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSAbwcklhXxmoIExII0xNAAAAIc"]
[Fri Nov 21 15:58:59.184716 2025] [:error] [pid 25554:tid 25565] [client 172.98.32.89:24019] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Nov 21 15:58:59.627419 2025] [:error] [pid 25554:tid 25562] [client 172.98.32.89:24019] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSAbwx-NtB-9AzFZrk5QqgAAAQQ"]
[Fri Nov 21 15:59:00.485403 2025] [:error] [pid 46939:tid 46946] [client 45.132.227.60:51905] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSAbxO0OmVoxD4VZ_Zlr0gAAAUQ"]
[Fri Nov 21 15:59:01.321595 2025] [:error] [pid 25429:tid 25438] [client 213.21.239.4:38118] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.svn/wc.db"] [unique_id "aSAbxT4rZbRSr7vu-NOloQAAAAU"]
[Fri Nov 21 15:59:03.140509 2025] [:error] [pid 46939:tid 46959] [client 136.144.42.75:30535] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSAbx-0OmVoxD4VZ_ZlsAwAAAVE"]
[Fri Nov 21 15:59:04.010636 2025] [:error] [pid 25554:tid 25564] [client 172.98.32.82:45163] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aSAbyB-NtB-9AzFZrk5QygAAAQY"]
[Fri Nov 21 15:59:06.327843 2025] [:error] [pid 25554:tid 25570] [client 172.98.32.98:33715] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Fri Nov 21 15:59:07.206654 2025] [:error] [pid 25554:tid 25578] [client 172.98.32.98:33715] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSAbyx-NtB-9AzFZrk5Q3QAAARQ"]
[Fri Nov 21 15:59:08.939267 2025] [:error] [pid 25521:tid 25524] [client 172.98.32.84:42563] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Fri Nov 21 15:59:09.829488 2025] [:error] [pid 25521:tid 25527] [client 172.98.32.84:42563] [client 172.98.32.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/function.php"] [unique_id "aSAbzfhXnBMilDddn3XlXwAAAMQ"]
[Fri Nov 21 15:59:10.749854 2025] [:error] [pid 46939:tid 46956] [client 172.98.32.82:29731] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSAbzu0OmVoxD4VZ_ZlsZAAAAU4"]
[Fri Nov 21 15:59:12.087770 2025] [:error] [pid 25431:tid 25494] [client 136.144.42.72:24625] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Fri Nov 21 15:59:12.522107 2025] [:error] [pid 25431:tid 25487] [client 136.144.42.72:24625] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSAb0MklhXxmoIExII0xhwAAAIA"]
[Fri Nov 21 15:59:13.377719 2025] [:error] [pid 25429:tid 25443] [client 45.132.227.56:24461] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSAb0T4rZbRSr7vu-NOl7wAAAAo"]
[Fri Nov 21 15:59:15.095322 2025] [:error] [pid 25429:tid 25456] [client 45.132.227.63:51899] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Fri Nov 21 15:59:15.535894 2025] [:error] [pid 25429:tid 25440] [client 45.132.227.63:51899] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Fri Nov 21 15:59:16.422625 2025] [:error] [pid 25429:tid 25446] [client 45.132.227.63:51899] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Fri Nov 21 15:59:17.275771 2025] [:error] [pid 25429:tid 25441] [client 45.132.227.63:51899] [client 45.132.227.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSAb1T4rZbRSr7vu-NOmEAAAAAg"]
[Fri Nov 21 15:59:18.135353 2025] [:error] [pid 46939:tid 46962] [client 172.98.32.82:56981] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSAb1u0OmVoxD4VZ_ZlsqQAAAVQ"]
[Fri Nov 21 15:59:20.983482 2025] [:error] [pid 25521:tid 25529] [client 172.98.32.77:27303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Nov 21 15:59:21.420921 2025] [:error] [pid 25521:tid 25542] [client 172.98.32.77:27303] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSAb2fhXnBMilDddn3XlnwAAANM"]
[Fri Nov 21 15:59:22.277873 2025] [:error] [pid 25430:tid 25469] [client 136.144.42.70:65503] [client 136.144.42.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSAb2qpnWJcWt_4foXlB4AAAAEk"]
[Fri Nov 21 15:59:23.293761 2025] [:error] [pid 25430:tid 25478] [client 172.98.32.77:26157] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSAb26pnWJcWt_4foXlB4wAAAFI"]
[Fri Nov 21 15:59:25.967064 2025] [:error] [pid 25429:tid 25438] [client 172.98.32.80:21925] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Fri Nov 21 15:59:26.435880 2025] [:error] [pid 25429:tid 25436] [client 172.98.32.80:21925] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSAb3j4rZbRSr7vu-NOmNgAAAAM"]
[Fri Nov 21 15:59:27.735901 2025] [:error] [pid 25554:tid 25575] [client 172.98.32.96:26631] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSAb3x-NtB-9AzFZrk5RcQAAARE"]
[Fri Nov 21 15:59:28.603436 2025] [:error] [pid 25554:tid 25564] [client 172.98.32.91:46163] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Nov 21 15:59:29.047185 2025] [:error] [pid 25554:tid 25567] [client 172.98.32.91:46163] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Fri Nov 21 15:59:29.905768 2025] [:error] [pid 25554:tid 25559] [client 172.98.32.91:46163] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Fri Nov 21 15:59:31.813795 2025] [:error] [pid 25554:tid 25559] [client 172.98.32.91:46163] [client 172.98.32.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.91, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/js/wp-login.php"] [unique_id "aSAb4x-NtB-9AzFZrk5RoQAAAQE"]
[Fri Nov 21 15:59:32.717464 2025] [:error] [pid 25554:tid 25580] [client 172.98.32.91:46163] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Fri Nov 21 15:59:33.147051 2025] [:error] [pid 25554:tid 25568] [client 172.98.32.91:46163] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Fri Nov 21 15:59:33.592626 2025] [:error] [pid 25554:tid 25565] [client 172.98.32.91:46163] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Fri Nov 21 15:59:34.536971 2025] [:error] [pid 25554:tid 25566] [client 172.98.32.91:46163] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSAb5h-NtB-9AzFZrk5RwwAAAQg"]
[Fri Nov 21 15:59:35.450903 2025] [:error] [pid 25521:tid 25533] [client 172.98.32.97:65437] [client 172.98.32.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.97, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSAb5_hXnBMilDddn3XmDAAAAMo"]
[Fri Nov 21 15:59:36.805147 2025] [:error] [pid 25521:tid 25532] [client 172.98.32.97:65437] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Nov 21 15:59:37.244921 2025] [:error] [pid 25521:tid 25528] [client 172.98.32.97:65437] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Fri Nov 21 15:59:38.147168 2025] [:error] [pid 25521:tid 25526] [client 172.98.32.97:65437] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Fri Nov 21 15:59:39.080502 2025] [:error] [pid 25521:tid 25540] [client 172.98.32.97:65437] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri Nov 21 15:59:40.493730 2025] [:error] [pid 25521:tid 25546] [client 172.98.32.97:65437] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Fri Nov 21 15:59:43.607285 2025] [:error] [pid 25521:tid 25527] [client 172.98.32.97:65437] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Nov 21 15:59:44.061199 2025] [:error] [pid 25521:tid 25538] [client 172.98.32.97:65437] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Fri Nov 21 15:59:46.274844 2025] [:error] [pid 25521:tid 25542] [client 172.98.32.97:65437] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Nov 21 15:59:47.166684 2025] [:error] [pid 25521:tid 25525] [client 172.98.32.97:65437] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSAb8_hXnBMilDddn3XmdAAAAMI"]
[Fri Nov 21 15:59:48.940430 2025] [:error] [pid 25429:tid 25434] [client 45.132.227.59:47627] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Fri Nov 21 15:59:49.412803 2025] [:error] [pid 25429:tid 25455] [client 45.132.227.59:47627] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSAb9T4rZbRSr7vu-NOmmwAAABY"]
[Fri Nov 21 15:59:50.856009 2025] [:error] [pid 25554:tid 25569] [client 45.132.227.60:53023] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Fri Nov 21 15:59:51.294618 2025] [:error] [pid 25554:tid 25574] [client 45.132.227.60:53023] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSAb9x-NtB-9AzFZrk5SLwAAARA"]
[Fri Nov 21 15:59:53.066494 2025] [:error] [pid 25431:tid 25487] [client 172.98.32.98:42919] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Fri Nov 21 15:59:53.947564 2025] [:error] [pid 25431:tid 25492] [client 172.98.32.98:42919] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Fri Nov 21 15:59:54.812194 2025] [:error] [pid 25431:tid 25509] [client 172.98.32.98:42919] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Fri Nov 21 15:59:55.239403 2025] [:error] [pid 25431:tid 25496] [client 172.98.32.98:42919] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Fri Nov 21 15:59:56.096859 2025] [:error] [pid 25431:tid 25488] [client 172.98.32.98:42919] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSAb_MklhXxmoIExII0ydwAAAIE"]
[Fri Nov 21 15:59:56.991219 2025] [:error] [pid 25521:tid 25540] [client 172.98.32.79:62165] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Fri Nov 21 15:59:57.471825 2025] [:error] [pid 25521:tid 25523] [client 172.98.32.79:62165] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Fri Nov 21 15:59:57.918117 2025] [:error] [pid 25521:tid 25538] [client 172.98.32.79:62165] [client 172.98.32.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSAb_fhXnBMilDddn3XmvAAAAM8"]
[Fri Nov 21 15:59:59.221873 2025] [:error] [pid 25430:tid 25466] [client 172.98.32.80:63083] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSAb_6pnWJcWt_4foXlCggAAAEY"]
[Fri Nov 21 16:00:00.600095 2025] [:error] [pid 25429:tid 25446] [client 172.98.32.81:61257] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Nov 21 16:00:02.112559 2025] [:error] [pid 25429:tid 25442] [client 172.98.32.81:61257] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Fri Nov 21 16:00:02.622144 2025] [:error] [pid 25429:tid 25452] [client 172.98.32.81:61257] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Fri Nov 21 16:00:03.084519 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.81:61257] [client 172.98.32.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSAcAz4rZbRSr7vu-NOm-wAAAAY"]
[Fri Nov 21 16:00:03.986829 2025] [:error] [pid 25521:tid 25534] [client 172.98.32.93:64917] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSAcA_hXnBMilDddn3Xm6QAAAMs"]
[Fri Nov 21 16:00:07.078871 2025] [:error] [pid 25429:tid 25437] [client 172.98.32.99:64467] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Fri Nov 21 16:00:07.993637 2025] [:error] [pid 25429:tid 25447] [client 172.98.32.99:64467] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSAcBz4rZbRSr7vu-NOnRgAAAA4"]
[Fri Nov 21 16:00:09.304846 2025] [:error] [pid 25554:tid 25566] [client 172.98.32.80:20751] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aSAcCR-NtB-9AzFZrk5SkQAAAQg"]
[Fri Nov 21 16:00:10.603473 2025] [:error] [pid 25430:tid 25465] [client 45.132.227.68:21051] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Nov 21 16:00:11.096189 2025] [:error] [pid 25430:tid 25478] [client 45.132.227.68:21051] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Fri Nov 21 16:00:11.552110 2025] [:error] [pid 25430:tid 25474] [client 45.132.227.68:21051] [client 45.132.227.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSAcC6pnWJcWt_4foXlC3gAAAE4"]
[Fri Nov 21 16:00:12.857828 2025] [:error] [pid 25521:tid 25527] [client 45.132.227.57:54863] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Fri Nov 21 16:00:13.297158 2025] [:error] [pid 25521:tid 25538] [client 45.132.227.57:54863] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Fri Nov 21 16:00:14.160452 2025] [:error] [pid 25521:tid 25545] [client 45.132.227.57:54863] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Nov 21 16:00:15.544346 2025] [:error] [pid 25521:tid 25539] [client 45.132.227.57:54863] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSAcD_hXnBMilDddn3XnPwAAANA"]
[Fri Nov 21 16:00:16.415646 2025] [:error] [pid 25430:tid 25460] [client 136.144.42.72:46969] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Fri Nov 21 16:00:17.822015 2025] [:error] [pid 25430:tid 25468] [client 136.144.42.72:46969] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSAcEapnWJcWt_4foXlDBwAAAEg"]
[Fri Nov 21 16:00:19.144864 2025] [:error] [pid 46939:tid 46955] [client 172.98.32.98:20599] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Fri Nov 21 16:00:21.094627 2025] [:error] [pid 46939:tid 46956] [client 172.98.32.98:20599] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Fri Nov 21 16:00:21.523401 2025] [:error] [pid 46939:tid 46958] [client 172.98.32.98:20599] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Nov 21 16:00:22.427879 2025] [:error] [pid 46939:tid 46958] [client 172.98.32.98:20599] [client 172.98.32.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.98, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSAcFu0OmVoxD4VZ_ZlvbAAAAVA"]
[Fri Nov 21 16:00:24.679357 2025] [:error] [pid 46939:tid 46948] [client 172.98.32.98:20599] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSAcGO0OmVoxD4VZ_ZlviQAAAUY"]
[Fri Nov 21 16:00:25.579305 2025] [:error] [pid 25429:tid 25451] [client 172.98.32.82:36125] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Fri Nov 21 16:00:26.062159 2025] [:error] [pid 25429:tid 25452] [client 172.98.32.82:36125] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSAcGj4rZbRSr7vu-NOnvQAAABM"]
[Fri Nov 21 16:00:26.936948 2025] [:error] [pid 25554:tid 25558] [client 172.98.32.93:47519] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Fri Nov 21 16:00:27.826156 2025] [:error] [pid 25554:tid 25582] [client 172.98.32.93:47519] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Fri Nov 21 16:00:28.740468 2025] [:error] [pid 25554:tid 25573] [client 172.98.32.93:47519] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSAcHB-NtB-9AzFZrk5S5gAAAQ8"]
[Fri Nov 21 16:00:30.024647 2025] [:error] [pid 25431:tid 25508] [client 172.98.32.86:56935] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Fri Nov 21 16:00:30.485055 2025] [:error] [pid 25431:tid 25496] [client 172.98.32.86:56935] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Fri Nov 21 16:00:31.356814 2025] [:error] [pid 25431:tid 25488] [client 172.98.32.86:56935] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSAcH8klhXxmoIExII0zZgAAAIE"]
[Fri Nov 21 16:00:32.673267 2025] [:error] [pid 25431:tid 25510] [client 172.98.32.88:32341] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSAcIMklhXxmoIExII0zbwAAAJc"]
[Fri Nov 21 16:00:33.539329 2025] [:error] [pid 25429:tid 25452] [client 172.98.32.89:46829] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Fri Nov 21 16:00:33.969311 2025] [:error] [pid 25429:tid 25447] [client 172.98.32.89:46829] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Fri Nov 21 16:00:34.851344 2025] [:error] [pid 25429:tid 25434] [client 172.98.32.89:46829] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSAcIj4rZbRSr7vu-NOn8gAAAAE"]
[Fri Nov 21 16:00:35.722310 2025] [:error] [pid 25554:tid 25567] [client 172.98.32.85:45497] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Fri Nov 21 16:00:36.584415 2025] [:error] [pid 25554:tid 25561] [client 172.98.32.85:45497] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Fri Nov 21 16:00:37.026894 2025] [:error] [pid 25554:tid 25578] [client 172.98.32.85:45497] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSAcJR-NtB-9AzFZrk5TEAAAARQ"]
[Fri Nov 21 16:00:38.334179 2025] [:error] [pid 25521:tid 25537] [client 45.132.227.52:55967] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/db.php"] [unique_id "aSAcJvhXnBMilDddn3XnoAAAAM4"]
[Fri Nov 21 16:00:39.274199 2025] [:error] [pid 25431:tid 25494] [client 172.98.32.83:37381] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSAcJ8klhXxmoIExII0ziQAAAIc"]
[Fri Nov 21 16:00:40.132344 2025] [:error] [pid 25429:tid 25450] [client 136.144.42.74:43425] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSAcKD4rZbRSr7vu-NOoFAAAABE"]
[Fri Nov 21 16:00:40.986744 2025] [:error] [pid 46939:tid 46955] [client 136.144.42.74:51421] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSAcKO0OmVoxD4VZ_ZlwfAAAAU0"]
[Fri Nov 21 16:00:41.858709 2025] [:error] [pid 46939:tid 46957] [client 136.144.42.78:29989] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSAcKe0OmVoxD4VZ_ZlwjAAAAU8"]
[Fri Nov 21 16:00:42.718668 2025] [:error] [pid 25429:tid 25448] [client 45.132.227.65:59413] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSAcKj4rZbRSr7vu-NOoHwAAAA8"]
[Fri Nov 21 16:00:44.558260 2025] [:error] [pid 25554:tid 25561] [client 172.98.32.83:34237] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSAcLB-NtB-9AzFZrk5TNwAAAQM"]
[Fri Nov 21 16:00:45.433067 2025] [:error] [pid 25554:tid 25580] [client 172.98.32.94:51387] [client 172.98.32.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSAcLR-NtB-9AzFZrk5TPQAAARY"]
[Fri Nov 21 16:00:46.359075 2025] [:error] [pid 25554:tid 25576] [client 45.132.227.52:33959] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSAcLh-NtB-9AzFZrk5TRgAAARI"]
[Fri Nov 21 16:00:47.716953 2025] [:error] [pid 46939:tid 46962] [client 45.132.227.66:55281] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSAcL-0OmVoxD4VZ_ZlwzwAAAVQ"]
[Fri Nov 21 16:00:49.541739 2025] [:error] [pid 25431:tid 25492] [client 45.132.227.59:23955] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSAcMcklhXxmoIExII0zvgAAAIU"]
[Fri Nov 21 16:00:50.396636 2025] [:error] [pid 46939:tid 46963] [client 172.98.32.88:57347] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Fri Nov 21 16:00:52.195896 2025] [:error] [pid 46939:tid 46966] [client 172.98.32.88:57347] [client 172.98.32.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.88, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSAcNO0OmVoxD4VZ_ZlxEAAAAVg"]
[Fri Nov 21 16:00:54.868061 2025] [:error] [pid 46939:tid 46956] [client 172.98.32.88:57347] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSAcNu0OmVoxD4VZ_ZlxLwAAAU4"]
[Fri Nov 21 16:00:55.771260 2025] [:error] [pid 25430:tid 25465] [client 172.98.32.90:46871] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSAcN6pnWJcWt_4foXlEIgAAAEU"]
[Fri Nov 21 16:00:58.049094 2025] [:error] [pid 46939:tid 46953] [client 172.98.32.92:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Fri Nov 21 16:00:58.519818 2025] [:error] [pid 46939:tid 46963] [client 172.98.32.92:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Fri Nov 21 16:01:00.316189 2025] [:error] [pid 46939:tid 46953] [client 172.98.32.92:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Fri Nov 21 16:01:00.858120 2025] [:error] [pid 46939:tid 46963] [client 172.98.32.92:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Fri Nov 21 16:01:02.772734 2025] [:error] [pid 46939:tid 46959] [client 172.98.32.92:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Fri Nov 21 16:01:03.226859 2025] [:error] [pid 46939:tid 46954] [client 172.98.32.92:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Fri Nov 21 16:01:03.659452 2025] [:error] [pid 46939:tid 46952] [client 172.98.32.92:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Fri Nov 21 16:01:04.093366 2025] [:error] [pid 46939:tid 46961] [client 172.98.32.92:53303] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Fri Nov 21 16:01:04.518405 2025] [:error] [pid 46939:tid 46949] [client 172.98.32.92:53303] [client 172.98.32.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSAcQO0OmVoxD4VZ_ZlxcAAAAUc"]
[Fri Nov 21 16:01:05.379201 2025] [:error] [pid 25431:tid 25504] [client 45.132.227.57:23959] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSAcQcklhXxmoIExII00RQAAAJE"]
[Fri Nov 21 16:01:06.241734 2025] [:error] [pid 46939:tid 46947] [client 172.98.32.91:63447] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSAcQu0OmVoxD4VZ_ZlxeQAAAUU"]
[Fri Nov 21 16:01:07.556675 2025] [:error] [pid 25430:tid 25464] [client 45.132.227.66:62169] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Fri Nov 21 16:01:07.985851 2025] [:error] [pid 25430:tid 25463] [client 45.132.227.66:62169] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Fri Nov 21 16:01:08.859277 2025] [:error] [pid 25430:tid 25480] [client 45.132.227.66:62169] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Fri Nov 21 16:01:09.726624 2025] [:error] [pid 25430:tid 25463] [client 45.132.227.66:62169] [client 45.132.227.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSAcRapnWJcWt_4foXlEqwAAAEM"]
[Fri Nov 21 16:01:10.580330 2025] [:error] [pid 46939:tid 46950] [client 172.98.32.79:31945] [client 172.98.32.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSAcRu0OmVoxD4VZ_ZlxigAAAUg"]
[Fri Nov 21 16:01:11.436800 2025] [:error] [pid 25431:tid 25505] [client 45.132.227.53:53641] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSAcR8klhXxmoIExII00ZAAAAJI"]
[Fri Nov 21 16:01:14.012878 2025] [:error] [pid 25554:tid 25571] [client 45.132.227.59:54813] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSAcSh-NtB-9AzFZrk5UaQAAAQ0"]
[Fri Nov 21 16:01:15.297924 2025] [:error] [pid 25431:tid 25505] [client 45.132.227.62:36337] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSAcS8klhXxmoIExII00mQAAAJI"]
[Fri Nov 21 16:01:17.051178 2025] [:error] [pid 25431:tid 25508] [client 45.132.227.68:50267] [client 45.132.227.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSAcTcklhXxmoIExII00rgAAAJU"]
[Fri Nov 21 16:01:22.682280 2025] [:error] [pid 25431:tid 25500] [client 45.132.227.61:33097] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSAcUsklhXxmoIExII007AAAAI0"]
[Fri Nov 21 16:01:23.568984 2025] [:error] [pid 25521:tid 25546] [client 136.144.42.69:40537] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Fri Nov 21 16:01:24.444294 2025] [:error] [pid 25521:tid 25543] [client 136.144.42.69:40537] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSAcVPhXnBMilDddn3XoVAAAANQ"]
[Fri Nov 21 16:01:26.178580 2025] [:error] [pid 25430:tid 25476] [client 136.144.42.78:21243] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Fri Nov 21 16:01:27.489874 2025] [:error] [pid 25430:tid 25467] [client 136.144.42.78:21243] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Nov 21 16:01:27.917562 2025] [:error] [pid 25430:tid 25469] [client 136.144.42.78:21243] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSAcV6pnWJcWt_4foXlFTQAAAEk"]
[Fri Nov 21 16:01:29.696583 2025] [:error] [pid 25521:tid 25543] [client 172.98.32.97:53195] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSAcWfhXnBMilDddn3XoZwAAANQ"]
[Fri Nov 21 16:01:32.474461 2025] [:error] [pid 25431:tid 25493] [client 172.98.32.97:27559] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSAcXMklhXxmoIExII01LQAAAIY"]
[Fri Nov 21 16:01:35.532832 2025] [:error] [pid 25554:tid 25577] [client 45.132.227.62:55117] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSAcXx-NtB-9AzFZrk5VKQAAARM"]
[Fri Nov 21 16:01:36.892600 2025] [:error] [pid 25554:tid 25573] [client 172.98.32.97:42257] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Fri Nov 21 16:01:37.344423 2025] [:error] [pid 25554:tid 25563] [client 172.98.32.97:42257] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSAcYR-NtB-9AzFZrk5VNQAAAQU"]
[Fri Nov 21 16:01:38.229052 2025] [:error] [pid 25429:tid 25453] [client 136.144.42.75:59879] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSAcYj4rZbRSr7vu-NOp7wAAABQ"]
[Fri Nov 21 16:01:42.811004 2025] [:error] [pid 25430:tid 25474] [client 45.132.227.67:63401] [client 45.132.227.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSAcZqpnWJcWt_4foXlFxgAAAE4"]
[Fri Nov 21 16:01:43.780367 2025] [:error] [pid 25429:tid 25435] [client 172.98.32.91:28975] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Fri Nov 21 16:01:45.690033 2025] [:error] [pid 25429:tid 25443] [client 172.98.32.91:28975] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Fri Nov 21 16:01:46.147266 2025] [:error] [pid 25429:tid 25456] [client 172.98.32.91:28975] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSAcaj4rZbRSr7vu-NOqHgAAABc"]
[Fri Nov 21 16:01:49.305336 2025] [:error] [pid 25430:tid 25466] [client 172.98.32.83:20247] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Fri Nov 21 16:01:50.163146 2025] [:error] [pid 25430:tid 25479] [client 172.98.32.83:20247] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSAcbqpnWJcWt_4foXlF6gAAAFM"]
[Fri Nov 21 16:01:52.082271 2025] [:error] [pid 25521:tid 25542] [client 172.98.32.77:46133] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSAccPhXnBMilDddn3XoygAAANM"]
[Fri Nov 21 16:01:53.877349 2025] [:error] [pid 46939:tid 46946] [client 45.132.227.54:47249] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSAcce0OmVoxD4VZ_ZlyiwAAAUQ"]
[Fri Nov 21 16:01:56.164674 2025] [:error] [pid 25429:tid 25444] [client 136.144.42.73:30105] [client 136.144.42.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSAcdD4rZbRSr7vu-NOqNQAAAAs"]
[Fri Nov 21 16:01:57.068924 2025] [:error] [pid 25430:tid 25463] [client 45.132.227.58:58355] [client 45.132.227.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSAcdapnWJcWt_4foXlGBAAAAEM"]
[Fri Nov 21 16:01:58.381655 2025] [:error] [pid 25521:tid 25537] [client 172.98.32.87:42107] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Fri Nov 21 16:02:00.657814 2025] [:error] [pid 25521:tid 25531] [client 172.98.32.87:42107] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSAcePhXnBMilDddn3XpEAAAAMg"]
[Fri Nov 21 16:02:02.413731 2025] [:error] [pid 25430:tid 25469] [client 172.98.32.76:44513] [client 172.98.32.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSAceqpnWJcWt_4foXlGEQAAAEk"]
[Fri Nov 21 16:02:03.342695 2025] [:error] [pid 25429:tid 25457] [client 45.132.227.57:22593] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSAcez4rZbRSr7vu-NOqQwAAABg"]
[Fri Nov 21 16:02:04.641666 2025] [:error] [pid 25430:tid 25462] [client 172.98.32.89:44897] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Fri Nov 21 16:02:05.067561 2025] [:error] [pid 25430:tid 25465] [client 172.98.32.89:44897] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSAcfapnWJcWt_4foXlGGAAAAEU"]
[Fri Nov 21 16:02:06.377480 2025] [:error] [pid 25521:tid 25542] [client 172.98.32.95:29739] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSAcfvhXnBMilDddn3XpNgAAANM"]
[Fri Nov 21 16:02:09.451736 2025] [:error] [pid 25430:tid 25473] [client 45.132.227.60:41977] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSAcgapnWJcWt_4foXlGJQAAAE0"]
[Fri Nov 21 16:02:10.757390 2025] [:error] [pid 25554:tid 25580] [client 172.98.32.95:40137] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Fri Nov 21 16:02:11.249174 2025] [:error] [pid 25554:tid 25560] [client 172.98.32.95:40137] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSAcgx-NtB-9AzFZrk5WEwAAAQI"]
[Fri Nov 21 16:02:13.344730 2025] [:error] [pid 25554:tid 25581] [client 172.98.32.81:45921] [client 172.98.32.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSAchR-NtB-9AzFZrk5WJgAAARc"]
[Fri Nov 21 16:02:14.722601 2025] [:error] [pid 46939:tid 46949] [client 136.144.42.70:58987] [client 136.144.42.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/as.php"] [unique_id "aSAchu0OmVoxD4VZ_ZlzDQAAAUc"]
[Fri Nov 21 16:02:16.044939 2025] [:error] [pid 25554:tid 25569] [client 136.144.42.78:50741] [client 136.144.42.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSAciB-NtB-9AzFZrk5WOgAAAQs"]
[Fri Nov 21 16:02:16.911945 2025] [:error] [pid 25430:tid 25474] [client 45.132.227.56:47685] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/install.php"] [unique_id "aSAciKpnWJcWt_4foXlGSwAAAE4"]
[Fri Nov 21 16:02:17.793448 2025] [:error] [pid 46939:tid 46958] [client 45.132.227.61:61303] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSAcie0OmVoxD4VZ_ZlzIAAAAVA"]
[Fri Nov 21 16:02:21.512527 2025] [:error] [pid 25430:tid 25465] [client 45.132.227.68:46733] [client 45.132.227.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSAcjapnWJcWt_4foXlGYgAAAEU"]
[Fri Nov 21 16:02:23.777483 2025] [:error] [pid 25521:tid 25531] [client 136.144.42.80:40521] [client 136.144.42.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSAcj_hXnBMilDddn3XpqgAAAMg"]
[Fri Nov 21 16:02:25.550358 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.96:46505] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Fri Nov 21 16:02:25.992860 2025] [:error] [pid 25429:tid 25447] [client 172.98.32.96:46505] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSAckT4rZbRSr7vu-NOquAAAAA4"]
[Fri Nov 21 16:02:28.211431 2025] [:error] [pid 46939:tid 46950] [client 45.132.227.58:53153] [client 45.132.227.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSAclO0OmVoxD4VZ_ZlzbQAAAUg"]
[Fri Nov 21 16:02:29.105436 2025] [:error] [pid 46939:tid 46942] [client 45.132.227.53:63113] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Fri Nov 21 16:02:32.971704 2025] [:error] [pid 46939:tid 46951] [client 45.132.227.53:63113] [client 45.132.227.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSAcmO0OmVoxD4VZ_ZlzoQAAAUk"]
[Fri Nov 21 16:02:34.392182 2025] [:error] [pid 25429:tid 25444] [client 172.98.32.91:41569] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSAcmj4rZbRSr7vu-NOq0AAAAAs"]
[Fri Nov 21 16:02:35.776898 2025] [:error] [pid 25430:tid 25478] [client 136.144.42.70:37859] [client 136.144.42.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSAcm6pnWJcWt_4foXlGjAAAAFI"]
[Fri Nov 21 16:02:37.650812 2025] [:error] [pid 46939:tid 46957] [client 136.144.42.72:29695] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSAcne0OmVoxD4VZ_Zlz1QAAAU8"]
[Fri Nov 21 16:02:42.261281 2025] [:error] [pid 25554:tid 25573] [client 172.98.32.100:43293] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSAcoh-NtB-9AzFZrk5W6gAAAQ8"]
[Fri Nov 21 16:02:43.203747 2025] [:error] [pid 25521:tid 25526] [client 172.98.32.94:25835] [client 172.98.32.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSAco_hXnBMilDddn3Xp4QAAAMM"]
[Fri Nov 21 16:02:46.050943 2025] [:error] [pid 25429:tid 25442] [client 136.144.42.70:30617] [client 136.144.42.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSAcpj4rZbRSr7vu-NOq6gAAAAk"]
[Fri Nov 21 16:02:46.928778 2025] [:error] [pid 25429:tid 25448] [client 45.132.227.63:65437] [client 45.132.227.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSAcpj4rZbRSr7vu-NOq7wAAAA8"]
[Fri Nov 21 16:02:48.733425 2025] [:error] [pid 25554:tid 25560] [client 136.144.42.75:54167] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSAcqB-NtB-9AzFZrk5XEwAAAQI"]
[Fri Nov 21 16:02:49.596382 2025] [:error] [pid 25521:tid 25544] [client 45.132.227.57:30359] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aSAcqfhXnBMilDddn3Xp_wAAANU"]
[Fri Nov 21 16:02:50.470815 2025] [:error] [pid 46939:tid 46957] [client 45.132.227.64:53627] [client 45.132.227.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.227.64, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSAcqu0OmVoxD4VZ_Zl0LgAAAU8"]
[Fri Nov 21 16:02:50.474738 2025] [:error] [pid 46939:tid 46957] [client 45.132.227.64:53627] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Fri Nov 21 16:02:50.923564 2025] [:error] [pid 46939:tid 46961] [client 45.132.227.64:53627] [client 45.132.227.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSAcqu0OmVoxD4VZ_Zl0MwAAAVM"]
[Fri Nov 21 16:02:52.737606 2025] [:error] [pid 25429:tid 25445] [client 45.132.227.57:27991] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Nov 21 16:02:53.234766 2025] [:error] [pid 25429:tid 25436] [client 45.132.227.57:27991] [client 45.132.227.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSAcrT4rZbRSr7vu-NOrCQAAAAM"]
[Fri Nov 21 16:02:54.131586 2025] [:error] [pid 25431:tid 25493] [client 136.144.42.79:20635] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/network.php"] [unique_id "aSAcrsklhXxmoIExII02iQAAAIY"]
[Fri Nov 21 16:02:55.085252 2025] [:error] [pid 25430:tid 25476] [client 172.98.32.85:53221] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Fri Nov 21 16:02:58.227766 2025] [:error] [pid 25430:tid 25481] [client 172.98.32.85:53221] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSAcsqpnWJcWt_4foXlG4wAAAFU"]
[Fri Nov 21 16:02:59.087842 2025] [:error] [pid 46939:tid 46942] [client 172.98.32.92:47069] [client 172.98.32.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSAcs-0OmVoxD4VZ_Zl0gwAAAUA"]
[Fri Nov 21 16:03:00.881421 2025] [:error] [pid 25430:tid 25484] [client 172.98.32.97:29389] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSActKpnWJcWt_4foXlG7wAAAFg"]
[Fri Nov 21 16:03:01.793385 2025] [:error] [pid 25429:tid 25455] [client 136.144.42.75:50305] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aSActT4rZbRSr7vu-NOrFwAAABY"]
[Fri Nov 21 16:03:02.734334 2025] [:error] [pid 25521:tid 25546] [client 172.98.32.87:44083] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Fri Nov 21 16:03:03.191053 2025] [:error] [pid 25521:tid 25526] [client 172.98.32.87:44083] [client 172.98.32.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.32.87, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSAct_hXnBMilDddn3XqRgAAAMM"]
[Fri Nov 21 16:03:04.156847 2025] [:error] [pid 25521:tid 25532] [client 172.98.32.87:44083] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSAcuPhXnBMilDddn3XqTwAAAMk"]
[Fri Nov 21 16:03:06.820802 2025] [:error] [pid 46939:tid 46963] [client 172.98.32.91:40967] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSAcuu0OmVoxD4VZ_Zl02QAAAVU"]
[Fri Nov 21 16:03:09.326794 2025] [:error] [pid 25521:tid 25536] [client 172.98.32.89:24829] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Fri Nov 21 16:03:09.780443 2025] [:error] [pid 25521:tid 25524] [client 172.98.32.89:24829] [client 172.98.32.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSAcvfhXnBMilDddn3XqdAAAAME"]
[Fri Nov 21 16:03:10.688814 2025] [:error] [pid 25430:tid 25477] [client 45.132.227.59:30619] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSAcvqpnWJcWt_4foXlHFQAAAFE"]
[Fri Nov 21 16:03:11.547311 2025] [:error] [pid 46939:tid 46943] [client 172.98.32.82:36561] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Fri Nov 21 16:03:12.980414 2025] [:error] [pid 46939:tid 46942] [client 172.98.32.82:36561] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSAcwO0OmVoxD4VZ_Zl0_wAAAUA"]
[Fri Nov 21 16:03:14.919729 2025] [:error] [pid 25431:tid 25509] [client 136.144.42.79:65331] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSAcwsklhXxmoIExII021gAAAJY"]
[Fri Nov 21 16:03:15.802950 2025] [:error] [pid 25554:tid 25570] [client 172.98.32.96:62509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Fri Nov 21 16:03:16.702693 2025] [:error] [pid 25554:tid 25569] [client 172.98.32.96:62509] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Fri Nov 21 16:03:17.565810 2025] [:error] [pid 25554:tid 25572] [client 172.98.32.96:62509] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSAcxR-NtB-9AzFZrk5XngAAAQ4"]
[Fri Nov 21 16:03:18.516498 2025] [:error] [pid 25430:tid 25471] [client 172.98.32.91:29851] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aSAcxqpnWJcWt_4foXlHJgAAAEs"]
[Fri Nov 21 16:03:19.921893 2025] [:error] [pid 46939:tid 46958] [client 45.132.227.61:35745] [client 45.132.227.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/count.php"] [unique_id "aSAcx-0OmVoxD4VZ_Zl1IAAAAVA"]
[Fri Nov 21 16:03:20.877849 2025] [:error] [pid 25430:tid 25460] [client 45.132.227.54:61009] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Fri Nov 21 16:03:23.537578 2025] [:error] [pid 25430:tid 25467] [client 45.132.227.54:61009] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSAcy6pnWJcWt_4foXlHOwAAAEc"]
[Fri Nov 21 16:03:25.976074 2025] [:error] [pid 25554:tid 25568] [client 45.132.227.65:37211] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||www.windfc.windfarmcoolants.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/images/stories/themes.php"] [unique_id "aSAczR-NtB-9AzFZrk5XvwAAAQo"]
[Fri Nov 21 16:03:26.412802 2025] [:error] [pid 25554:tid 25558] [client 45.132.227.65:37211] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSAczh-NtB-9AzFZrk5XxAAAAQA"]
[Fri Nov 21 16:03:28.214365 2025] [:error] [pid 25430:tid 25475] [client 45.132.227.52:28289] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSAc0KpnWJcWt_4foXlHSAAAAE8"]
[Fri Nov 21 16:03:29.109868 2025] [:error] [pid 25429:tid 25444] [client 172.98.32.87:33233] [client 172.98.32.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSAc0T4rZbRSr7vu-NOrbAAAAAs"]
[Fri Nov 21 16:03:31.915935 2025] [:error] [pid 25429:tid 25449] [client 136.144.42.72:27969] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Fri Nov 21 16:03:33.763425 2025] [:error] [pid 25429:tid 25444] [client 136.144.42.72:27969] [client 136.144.42.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSAc1T4rZbRSr7vu-NOrkAAAAAs"]
[Fri Nov 21 16:03:35.555520 2025] [:error] [pid 25430:tid 25465] [client 172.98.32.82:21651] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSAc16pnWJcWt_4foXlHdQAAAEU"]
[Fri Nov 21 16:03:37.568704 2025] [:error] [pid 25429:tid 25438] [client 45.132.227.55:46493] [client 45.132.227.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSAc2T4rZbRSr7vu-NOrnwAAAAU"]
[Fri Nov 21 16:03:38.495563 2025] [:error] [pid 25431:tid 25507] [client 136.144.42.74:49821] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Fri Nov 21 16:03:40.747137 2025] [:error] [pid 25431:tid 25500] [client 136.144.42.74:49821] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSAc3MklhXxmoIExII03KwAAAI0"]
[Fri Nov 21 16:03:42.041670 2025] [:error] [pid 25430:tid 25481] [client 45.132.227.65:24245] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aSAc3qpnWJcWt_4foXlHjAAAAFU"]
[Fri Nov 21 16:03:42.964234 2025] [:error] [pid 25429:tid 25438] [client 172.98.32.99:52231] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Nov 21 16:03:43.389926 2025] [:error] [pid 25429:tid 25445] [client 172.98.32.99:52231] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSAc3z4rZbRSr7vu-NOrrwAAAAw"]
[Fri Nov 21 16:03:44.264667 2025] [:error] [pid 25429:tid 25453] [client 172.98.32.88:50785] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSAc4D4rZbRSr7vu-NOrswAAABQ"]
[Fri Nov 21 16:03:46.071493 2025] [:error] [pid 46939:tid 46955] [client 136.144.42.79:21735] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSAc4u0OmVoxD4VZ_Zl1sAAAAU0"]
[Fri Nov 21 16:03:49.080900 2025] [:error] [pid 25430:tid 25477] [client 172.98.32.79:31561] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Fri Nov 21 16:03:49.525412 2025] [:error] [pid 25430:tid 25484] [client 172.98.32.79:31561] [client 172.98.32.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSAc5apnWJcWt_4foXlHnAAAAFg"]
[Fri Nov 21 16:03:50.381740 2025] [:error] [pid 25429:tid 25441] [client 45.132.227.60:37385] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSAc5j4rZbRSr7vu-NOrxAAAAAg"]
[Fri Nov 21 16:03:53.520219 2025] [:error] [pid 25554:tid 25578] [client 45.132.227.54:27777] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSAc6R-NtB-9AzFZrk5YGQAAARQ"]
[Fri Nov 21 16:03:55.363720 2025] [:error] [pid 46939:tid 46956] [client 172.98.32.83:25671] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSAc6-0OmVoxD4VZ_Zl15gAAAU4"]
[Fri Nov 21 16:03:56.230760 2025] [:error] [pid 25430:tid 25476] [client 45.132.227.68:35633] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Fri Nov 21 16:03:57.609644 2025] [:error] [pid 25430:tid 25481] [client 45.132.227.68:35633] [client 45.132.227.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSAc7apnWJcWt_4foXlHrAAAAFU"]
[Fri Nov 21 16:03:58.491181 2025] [:error] [pid 46939:tid 46946] [client 172.98.32.86:50581] [client 172.98.32.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSAc7u0OmVoxD4VZ_Zl18wAAAUQ"]
[Fri Nov 21 16:03:59.895568 2025] [:error] [pid 25430:tid 25460] [client 172.98.32.81:31111] [client 172.98.32.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSAc76pnWJcWt_4foXlHrwAAAEA"]
[Fri Nov 21 16:04:00.806316 2025] [:error] [pid 25521:tid 25537] [client 45.132.227.55:38229] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Fri Nov 21 16:04:01.752477 2025] [:error] [pid 25521:tid 25527] [client 45.132.227.55:38229] [client 45.132.227.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSAc8fhXnBMilDddn3XrNAAAAMQ"]
[Fri Nov 21 16:04:02.673315 2025] [:error] [pid 25430:tid 25467] [client 172.98.32.95:29219] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Fri Nov 21 16:04:03.551110 2025] [:error] [pid 25430:tid 25466] [client 172.98.32.95:29219] [client 172.98.32.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSAc86pnWJcWt_4foXlHtQAAAEY"]
[Fri Nov 21 16:04:04.437746 2025] [:error] [pid 46939:tid 46955] [client 45.132.227.56:48749] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSAc9O0OmVoxD4VZ_Zl2GgAAAU0"]
[Fri Nov 21 16:04:05.792085 2025] [:error] [pid 25554:tid 25564] [client 172.98.32.92:46999] [client 172.98.32.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSAc9R-NtB-9AzFZrk5YLwAAAQY"]
[Fri Nov 21 16:04:06.700426 2025] [:error] [pid 25521:tid 25543] [client 136.144.42.69:62085] [client 136.144.42.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aSAc9vhXnBMilDddn3XrQAAAANQ"]
[Fri Nov 21 16:04:08.478198 2025] [:error] [pid 25554:tid 25562] [client 172.98.32.91:59405] [client 172.98.32.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSAc-B-NtB-9AzFZrk5YPQAAAQQ"]
[Fri Nov 21 16:04:09.779184 2025] [:error] [pid 25431:tid 25507] [client 172.98.32.84:39597] [client 172.98.32.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSAc-cklhXxmoIExII03fwAAAJQ"]
[Fri Nov 21 16:04:10.643762 2025] [:error] [pid 25521:tid 25527] [client 172.98.32.98:29067] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSAc-vhXnBMilDddn3XrUgAAAMQ"]
[Fri Nov 21 16:04:11.549387 2025] [:error] [pid 25430:tid 25474] [client 172.98.32.77:36743] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSAc-6pnWJcWt_4foXlHywAAAE4"]
[Fri Nov 21 16:04:13.748455 2025] [:error] [pid 25430:tid 25462] [client 172.98.32.79:26513] [client 172.98.32.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSAc_apnWJcWt_4foXlH1AAAAEI"]
[Fri Nov 21 16:04:15.646565 2025] [:error] [pid 25431:tid 25493] [client 136.144.42.74:58589] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSAc_8klhXxmoIExII03ogAAAIY"]
[Fri Nov 21 16:04:17.032801 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.83:20445] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSAdAT4rZbRSr7vu-NOsJgAAAAY"]
[Fri Nov 21 16:04:18.331500 2025] [:error] [pid 25554:tid 25572] [client 172.98.32.82:57865] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSAdAh-NtB-9AzFZrk5YeQAAAQ4"]
[Fri Nov 21 16:04:20.172625 2025] [:error] [pid 25431:tid 25487] [client 45.132.227.59:43445] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Fri Nov 21 16:04:21.902880 2025] [:error] [pid 25431:tid 25510] [client 45.132.227.59:43445] [client 45.132.227.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSAdBcklhXxmoIExII03xQAAAJc"]
[Fri Nov 21 16:04:22.843011 2025] [:error] [pid 25429:tid 25452] [client 172.98.32.77:29403] [client 172.98.32.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSAdBj4rZbRSr7vu-NOsQgAAABM"]
[Fri Nov 21 16:04:24.165023 2025] [:error] [pid 46939:tid 46952] [client 172.98.32.90:62429] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Fri Nov 21 16:04:24.590188 2025] [:error] [pid 46939:tid 46943] [client 172.98.32.90:62429] [client 172.98.32.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSAdCO0OmVoxD4VZ_Zl2aQAAAUE"]
[Fri Nov 21 16:04:27.333825 2025] [:error] [pid 25431:tid 25503] [client 172.98.32.99:35589] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSAdC8klhXxmoIExII031gAAAJA"]
[Fri Nov 21 16:04:28.641997 2025] [:error] [pid 46939:tid 46956] [client 172.98.32.83:22027] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Fri Nov 21 16:04:29.069134 2025] [:error] [pid 46939:tid 46949] [client 172.98.32.83:22027] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSAdDe0OmVoxD4VZ_Zl2fQAAAUc"]
[Fri Nov 21 16:04:30.909392 2025] [:error] [pid 25429:tid 25445] [client 45.132.227.60:50707] [client 45.132.227.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSAdDj4rZbRSr7vu-NOsZAAAAAw"]
[Fri Nov 21 16:04:31.766640 2025] [:error] [pid 25554:tid 25572] [client 172.98.32.78:61273] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Fri Nov 21 16:04:32.203125 2025] [:error] [pid 25554:tid 25580] [client 172.98.32.78:61273] [client 172.98.32.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSAdEB-NtB-9AzFZrk5YpAAAARY"]
[Fri Nov 21 16:04:33.874981 2025] [:error] [pid 25521:tid 25532] [client 45.132.227.62:29417] [client 45.132.227.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSAdEfhXnBMilDddn3XrwgAAAMk"]
[Fri Nov 21 16:04:36.130405 2025] [:error] [pid 25521:tid 25537] [client 172.98.32.98:44659] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Fri Nov 21 16:04:36.563809 2025] [:error] [pid 25521:tid 25528] [client 172.98.32.98:44659] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSAdFPhXnBMilDddn3Xr0wAAAMU"]
[Fri Nov 21 16:04:38.738032 2025] [:error] [pid 46939:tid 46960] [client 45.132.227.65:30795] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSAdFu0OmVoxD4VZ_Zl20wAAAVI"]
[Fri Nov 21 16:04:39.606863 2025] [:error] [pid 25431:tid 25492] [client 172.98.32.88:35773] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Fri Nov 21 16:04:40.139147 2025] [:error] [pid 25431:tid 25498] [client 172.98.32.88:35773] [client 172.98.32.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSAdGMklhXxmoIExII03_QAAAIs"]
[Fri Nov 21 16:04:41.002396 2025] [:error] [pid 25431:tid 25511] [client 172.98.32.96:57241] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSAdGcklhXxmoIExII03_wAAAJg"]
[Fri Nov 21 16:04:41.857069 2025] [:error] [pid 25554:tid 25571] [client 45.132.227.56:48415] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Fri Nov 21 16:04:42.730884 2025] [:error] [pid 25554:tid 25581] [client 45.132.227.56:48415] [client 45.132.227.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSAdGh-NtB-9AzFZrk5Y2AAAARc"]
[Fri Nov 21 16:04:43.617877 2025] [:error] [pid 25429:tid 25456] [client 172.98.32.100:54691] [client 172.98.32.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSAdGz4rZbRSr7vu-NOsiQAAABc"]
[Fri Nov 21 16:04:47.302922 2025] [:error] [pid 25430:tid 25474] [client 172.98.32.93:45953] [client 172.98.32.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSAdH6pnWJcWt_4foXlINQAAAE4"]
[Fri Nov 21 16:04:48.205033 2025] [:error] [pid 25430:tid 25480] [client 172.98.32.98:51079] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSAdIKpnWJcWt_4foXlINwAAAFQ"]
[Fri Nov 21 16:04:49.603826 2025] [:error] [pid 25431:tid 25506] [client 45.132.227.58:41221] [client 45.132.227.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/log.php"] [unique_id "aSAdIcklhXxmoIExII04JwAAAJM"]
[Fri Nov 21 16:04:50.466911 2025] [:error] [pid 25554:tid 25570] [client 136.144.42.74:52879] [client 136.144.42.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSAdIh-NtB-9AzFZrk5ZGwAAAQw"]
[Fri Nov 21 16:04:51.410702 2025] [:error] [pid 25554:tid 25564] [client 172.98.32.97:59543] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aSAdIx-NtB-9AzFZrk5ZIQAAAQY"]
[Fri Nov 21 16:04:52.400927 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.85:51159] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aSAdJD4rZbRSr7vu-NOsrAAAAAY"]
[Fri Nov 21 16:04:55.055394 2025] [:error] [pid 46939:tid 46944] [client 136.144.42.75:55601] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aSAdJ-0OmVoxD4VZ_Zl3LwAAAUI"]
[Fri Nov 21 16:04:55.995735 2025] [:error] [pid 25521:tid 25540] [client 172.98.32.83:57757] [client 172.98.32.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aSAdJ_hXnBMilDddn3XsGQAAANE"]
[Fri Nov 21 16:04:57.316931 2025] [:error] [pid 25429:tid 25457] [client 172.98.32.98:31685] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Fri Nov 21 16:04:57.758994 2025] [:error] [pid 25429:tid 25439] [client 172.98.32.98:31685] [client 172.98.32.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aSAdKT4rZbRSr7vu-NOsuwAAAAY"]
[Fri Nov 21 16:04:58.649411 2025] [:error] [pid 25430:tid 25477] [client 45.132.227.52:41657] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aSAdKqpnWJcWt_4foXlIUwAAAFE"]
[Fri Nov 21 16:05:00.493245 2025] [:error] [pid 25554:tid 25572] [client 172.98.32.85:59309] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aSAdLB-NtB-9AzFZrk5ZUgAAAQ4"]
[Fri Nov 21 16:05:01.357837 2025] [:error] [pid 25431:tid 25502] [client 136.144.42.73:59325] [client 136.144.42.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aSAdLcklhXxmoIExII04VQAAAI8"]
[Fri Nov 21 16:05:05.456013 2025] [:error] [pid 46939:tid 46950] [client 172.98.32.85:65123] [client 172.98.32.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aSAdMe0OmVoxD4VZ_Zl3cgAAAUg"]
[Fri Nov 21 16:05:06.315757 2025] [:error] [pid 25429:tid 25453] [client 45.132.227.52:46653] [client 45.132.227.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSAdMj4rZbRSr7vu-NOs0gAAABQ"]
[Fri Nov 21 16:05:08.193046 2025] [:error] [pid 25554:tid 25569] [client 172.98.32.80:35517] [client 172.98.32.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/file.php"] [unique_id "aSAdNB-NtB-9AzFZrk5ZgQAAAQs"]
[Fri Nov 21 16:05:09.495660 2025] [:error] [pid 25554:tid 25560] [client 45.132.227.67:44767] [client 45.132.227.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSAdNR-NtB-9AzFZrk5ZhAAAAQI"]
[Fri Nov 21 16:05:10.789405 2025] [:error] [pid 25521:tid 25536] [client 136.144.42.75:52815] [client 136.144.42.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/load.php"] [unique_id "aSAdNvhXnBMilDddn3XsPQAAAM0"]
[Fri Nov 21 16:05:11.836319 2025] [:error] [pid 25554:tid 25559] [client 45.132.227.67:27179] [client 45.132.227.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSAdNx-NtB-9AzFZrk5ZigAAAQE"]
[Fri Nov 21 16:05:12.759806 2025] [:error] [pid 25431:tid 25498] [client 136.144.42.73:38161] [client 136.144.42.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aSAdOMklhXxmoIExII04eAAAAIs"]
[Fri Nov 21 16:05:15.714062 2025] [:error] [pid 25554:tid 25577] [client 172.98.32.96:50813] [client 172.98.32.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aSAdOx-NtB-9AzFZrk5ZnAAAARM"]
[Fri Nov 21 16:05:16.597675 2025] [:error] [pid 25521:tid 25530] [client 172.98.32.99:39729] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Fri Nov 21 16:05:17.031214 2025] [:error] [pid 25521:tid 25538] [client 172.98.32.99:39729] [client 172.98.32.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSAdPfhXnBMilDddn3XsSwAAAM8"]
[Fri Nov 21 16:05:18.823393 2025] [:error] [pid 25521:tid 25544] [client 172.98.32.78:49319] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Fri Nov 21 16:05:19.261164 2025] [:error] [pid 25521:tid 25535] [client 172.98.32.78:49319] [client 172.98.32.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aSAdP_hXnBMilDddn3XsUQAAAMw"]
[Fri Nov 21 16:05:20.160704 2025] [:error] [pid 46939:tid 46956] [client 45.132.227.65:24995] [client 45.132.227.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aSAdQO0OmVoxD4VZ_Zl3vwAAAU4"]
[Fri Nov 21 16:05:21.445407 2025] [:error] [pid 25554:tid 25562] [client 136.144.42.80:39441] [client 136.144.42.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aSAdQR-NtB-9AzFZrk5ZqgAAAQQ"]
[Fri Nov 21 16:05:24.567682 2025] [:error] [pid 25429:tid 25434] [client 172.98.32.82:39011] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Fri Nov 21 16:05:26.944842 2025] [:error] [pid 25429:tid 25448] [client 172.98.32.82:39011] [client 172.98.32.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aSAdRj4rZbRSr7vu-NOtDAAAAA8"]
[Fri Nov 21 16:05:28.332017 2025] [:error] [pid 25429:tid 25440] [client 172.98.32.97:28251] [client 172.98.32.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aSAdSD4rZbRSr7vu-NOtEgAAAAc"]
[Fri Nov 21 16:05:30.094933 2025] [:error] [pid 25431:tid 25493] [client 136.144.42.79:27141] [client 136.144.42.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aSAdSsklhXxmoIExII04sQAAAIY"]
[Fri Nov 21 16:05:31.013847 2025] [:error] [pid 25430:tid 25475] [client 172.98.32.84:27845] [client 172.98.32.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aSAdS6pnWJcWt_4foXlInwAAAE8"]
[Fri Nov 21 16:05:31.877684 2025] [:error] [pid 25429:tid 25434] [client 45.132.227.54:30059] [client 45.132.227.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aSAdSz4rZbRSr7vu-NOtGQAAAAE"]
[Fri Nov 21 16:14:50.866423 2025] [:error] [pid 25431:tid 25511] [client 213.21.239.4:44112] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.svn/wc.db"] [unique_id "aSAfesklhXxmoIExII0-sQAAAJg"]
[Sat Nov 22 06:56:49.726980 2025] [:error] [pid 25856:tid 25859] [client 212.116.231.26:45646] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSDuMRsTP0wy94zKUvHnyAAAAQE"]
[Sat Nov 22 06:56:50.561060 2025] [:error] [pid 53566:tid 53569] [client 212.116.231.26:46150] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSDuMsbSHDBkRbwMbd5nywAAAME"]
[Sat Nov 22 06:56:51.373885 2025] [:error] [pid 25856:tid 25879] [client 212.116.231.26:46658] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSDuMxsTP0wy94zKUvHoAgAAARU"]
[Sat Nov 22 06:56:52.206792 2025] [:error] [pid 53478:tid 53515] [client 212.116.231.26:47146] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSDuNAhUYdXBbQswAdRAegAAAEY"]
[Sat Nov 22 06:56:53.046170 2025] [:error] [pid 53478:tid 53530] [client 212.116.231.26:47566] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSDuNQhUYdXBbQswAdRAggAAAFU"]
[Sat Nov 22 06:56:53.868661 2025] [:error] [pid 25856:tid 25880] [client 212.116.231.26:48030] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuNRsTP0wy94zKUvHoHQAAARY"]
[Sat Nov 22 06:56:54.682645 2025] [:error] [pid 53566:tid 53577] [client 212.116.231.26:48416] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuNsbSHDBkRbwMbd5oEQAAAMk"]
[Sat Nov 22 06:56:55.516277 2025] [:error] [pid 53477:tid 53499] [client 212.116.231.26:48732] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuN37Lu30Ku9O40aIHYwAAABI"]
[Sat Nov 22 06:56:56.350534 2025] [:error] [pid 25856:tid 25864] [client 212.116.231.26:48968] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuOBsTP0wy94zKUvHoMAAAAQY"]
[Sat Nov 22 06:56:57.184112 2025] [:error] [pid 53478:tid 53510] [client 212.116.231.26:49206] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuOQhUYdXBbQswAdRAjgAAAEE"]
[Sat Nov 22 08:21:14.869739 2025] [:error] [pid 9547:tid 9575] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php, referer: https://www.google.de/
[Sat Nov 22 08:21:15.081328 2025] [:error] [pid 9547:tid 9563] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://www.google.com/
[Sat Nov 22 08:21:15.806919 2025] [:error] [pid 9547:tid 9553] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:16.035246 2025] [:error] [pid 9547:tid 9558] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/.__info.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:21:16.264496 2025] [:error] [pid 9547:tid 9573] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.google.de/
[Sat Nov 22 08:21:16.510054 2025] [:error] [pid 9547:tid 9565] [client 13.77.69.8:3469] [client 13.77.69.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.77.69.8, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aSEB_NClOR5qk7DoMeHOIAAAAUw"], referer: https://www.yahoo.com/
[Sat Nov 22 08:21:16.513319 2025] [:error] [pid 9547:tid 9565] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:16.977451 2025] [:error] [pid 9547:tid 9566] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:17.198818 2025] [:error] [pid 9547:tid 9564] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php, referer: https://www.google.com/
[Sat Nov 22 08:21:17.660495 2025] [:error] [pid 9547:tid 9558] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:17.891020 2025] [:error] [pid 9547:tid 9556] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php, referer: https://www.google.de/
[Sat Nov 22 08:21:18.136372 2025] [:error] [pid 9547:tid 9573] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:18.349160 2025] [:error] [pid 9547:tid 9570] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:18.613006 2025] [:error] [pid 9547:tid 9571] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:18.826788 2025] [:error] [pid 9547:tid 9565] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php, referer: https://www.google.de/
[Sat Nov 22 08:21:19.042299 2025] [:error] [pid 9547:tid 9561] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:19.258068 2025] [:error] [pid 9547:tid 9575] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php, referer: https://www.google.de/
[Sat Nov 22 08:21:19.470279 2025] [:error] [pid 9547:tid 9559] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.google.de/
[Sat Nov 22 08:21:20.420045 2025] [:error] [pid 9547:tid 9556] [client 13.77.69.8:3469] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php, referer: https://www.google.de/
[Sat Nov 22 08:21:20.628672 2025] [:error] [pid 9547:tid 9565] [client 13.77.69.8:3469] [client 13.77.69.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aSECANClOR5qk7DoMeHOSQAAAUw"], referer: https://www.google.co.uk/
[Sat Nov 22 08:21:22.477367 2025] [:error] [pid 9547:tid 9556] [client 13.77.69.8:5886] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:24.079147 2025] [:error] [pid 9547:tid 9570] [client 13.77.69.8:5886] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:24.403160 2025] [:error] [pid 9547:tid 9562] [client 13.77.69.8:5886] File does not exist: /usr/local/apache/htdocs/suspended-page/mari.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:24.622862 2025] [:error] [pid 9547:tid 9560] [client 13.77.69.8:5886] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.google.com/
[Sat Nov 22 08:21:24.860825 2025] [:error] [pid 9547:tid 9561] [client 13.77.69.8:5886] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php, referer: https://www.google.com/
[Sat Nov 22 08:21:25.852177 2025] [:error] [pid 9547:tid 9555] [client 13.77.69.8:5886] [client 13.77.69.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSECBdClOR5qk7DoMeHOcAAAAUI"], referer: https://www.google.fr/
[Sat Nov 22 08:21:27.957269 2025] [:error] [pid 53477:tid 53488] [client 13.77.69.8:1119] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:28.634826 2025] [:error] [pid 53477:tid 53484] [client 13.77.69.8:1119] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.google.de/
[Sat Nov 22 08:21:29.921959 2025] [:error] [pid 53477:tid 53487] [client 13.77.69.8:1119] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:30.142526 2025] [:error] [pid 53477:tid 53485] [client 13.77.69.8:1119] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php, referer: https://www.google.com/
[Sat Nov 22 08:21:30.611244 2025] [:error] [pid 53477:tid 53489] [client 13.77.69.8:1119] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php, referer: https://www.google.com/
[Sat Nov 22 08:21:30.828015 2025] [:error] [pid 53477:tid 53499] [client 13.77.69.8:1119] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:31.043985 2025] [:error] [pid 53477:tid 53481] [client 13.77.69.8:1119] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php, referer: https://www.google.com/
[Sat Nov 22 08:21:33.393357 2025] [:error] [pid 53477:tid 53497] [client 13.77.69.8:1119] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:34.249788 2025] [:error] [pid 53477:tid 53494] [client 13.77.69.8:1119] [client 13.77.69.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSECDn7Lu30Ku9O40aIdxAAAAA0"], referer: https://www.google.com/
[Sat Nov 22 08:21:38.927259 2025] [:error] [pid 25856:tid 25868] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://www.google.de/
[Sat Nov 22 08:21:39.168033 2025] [:error] [pid 25856:tid 25881] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php, referer: https://www.google.de/
[Sat Nov 22 08:21:39.388443 2025] [:error] [pid 25856:tid 25879] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/god4m.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:39.607157 2025] [:error] [pid 25856:tid 25865] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:41.142144 2025] [:error] [pid 25856:tid 25867] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:41.415462 2025] [:error] [pid 25856:tid 25862] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/07.php, referer: https://www.google.de/
[Sat Nov 22 08:21:41.630314 2025] [:error] [pid 25856:tid 25858] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:21:41.867982 2025] [:error] [pid 25856:tid 25871] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:42.077491 2025] [:error] [pid 25856:tid 25878] [client 13.77.69.8:7004] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:48.046005 2025] [:error] [pid 9547:tid 9562] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:48.261585 2025] [:error] [pid 9547:tid 9565] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:21:48.466712 2025] [:error] [pid 9547:tid 9575] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php, referer: https://www.google.de/
[Sat Nov 22 08:21:48.672090 2025] [:error] [pid 9547:tid 9574] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:48.872981 2025] [:error] [pid 9547:tid 9572] [client 13.77.69.8:4347] [client 13.77.69.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.77.69.8, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aSECHNClOR5qk7DoMeHOlAAAAVM"], referer: https://www.google.co.uk/
[Sat Nov 22 08:21:48.876780 2025] [:error] [pid 9547:tid 9572] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:49.624617 2025] [:error] [pid 9547:tid 9559] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:49.828493 2025] [:error] [pid 9547:tid 9558] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:21:50.108424 2025] [:error] [pid 9547:tid 9568] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/classsmtps.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:50.316676 2025] [:error] [pid 9547:tid 9567] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php, referer: https://www.google.de/
[Sat Nov 22 08:21:50.538685 2025] [:error] [pid 9547:tid 9560] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:51.075657 2025] [:error] [pid 9547:tid 9555] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:51.280227 2025] [:error] [pid 9547:tid 9562] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-comments-post.php, referer: https://www.google.de/
[Sat Nov 22 08:21:51.491651 2025] [:error] [pid 9547:tid 9563] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:51.695735 2025] [:error] [pid 9547:tid 9556] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:51.904301 2025] [:error] [pid 9547:tid 9565] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:52.109619 2025] [:error] [pid 9547:tid 9573] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:52.369732 2025] [:error] [pid 9547:tid 9554] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:52.573395 2025] [:error] [pid 9547:tid 9576] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:21:52.803036 2025] [:error] [pid 9547:tid 9558] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:53.011235 2025] [:error] [pid 9547:tid 9564] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:54.469962 2025] [:error] [pid 9547:tid 9564] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/hoot.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:54.702793 2025] [:error] [pid 9547:tid 9568] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:54.907352 2025] [:error] [pid 9547:tid 9560] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:21:55.113984 2025] [:error] [pid 9547:tid 9577] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:55.319967 2025] [:error] [pid 9547:tid 9574] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:55.523621 2025] [:error] [pid 9547:tid 9555] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php, referer: https://www.google.com/
[Sat Nov 22 08:21:55.727320 2025] [:error] [pid 9547:tid 9562] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php, referer: https://www.bing.com/
[Sat Nov 22 08:21:55.986949 2025] [:error] [pid 9547:tid 9563] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:56.684998 2025] [:error] [pid 9547:tid 9557] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php, referer: https://www.google.com/
[Sat Nov 22 08:21:56.889255 2025] [:error] [pid 9547:tid 9565] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:57.092708 2025] [:error] [pid 9547:tid 9573] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:57.300563 2025] [:error] [pid 9547:tid 9554] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php, referer: https://www.google.de/
[Sat Nov 22 08:21:57.507707 2025] [:error] [pid 9547:tid 9572] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:57.712930 2025] [:error] [pid 9547:tid 9564] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:21:57.968260 2025] [:error] [pid 9547:tid 9558] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php, referer: https://www.google.de/
[Sat Nov 22 08:21:58.811371 2025] [:error] [pid 9547:tid 9568] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:21:59.015250 2025] [:error] [pid 9547:tid 9569] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php, referer: https://www.google.fr/
[Sat Nov 22 08:21:59.850719 2025] [:error] [pid 9547:tid 9560] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:22:01.010173 2025] [:error] [pid 9547:tid 9556] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php, referer: https://www.google.com/
[Sat Nov 22 08:22:01.268927 2025] [:error] [pid 9547:tid 9559] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php, referer: https://www.google.fr/
[Sat Nov 22 08:22:01.778722 2025] [:error] [pid 9547:tid 9573] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/123.php, referer: https://www.google.fr/
[Sat Nov 22 08:22:02.501300 2025] [:error] [pid 9547:tid 9558] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php, referer: https://www.google.com/
[Sat Nov 22 08:22:02.725492 2025] [:error] [pid 9547:tid 9568] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:22:02.930748 2025] [:error] [pid 9547:tid 9567] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:22:03.162280 2025] [:error] [pid 9547:tid 9560] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php, referer: https://www.bing.com/
[Sat Nov 22 08:22:03.485773 2025] [:error] [pid 9547:tid 9560] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php, referer: https://www.google.de/
[Sat Nov 22 08:22:03.959288 2025] [:error] [pid 9547:tid 9571] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php, referer: https://www.google.fr/
[Sat Nov 22 08:22:04.172380 2025] [:error] [pid 9547:tid 9561] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/berax.php, referer: https://www.google.de/
[Sat Nov 22 08:22:04.580210 2025] [:error] [pid 9547:tid 9555] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php, referer: https://www.google.co.uk/
[Sat Nov 22 08:22:04.791796 2025] [:error] [pid 9547:tid 9559] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php, referer: https://www.google.com/
[Sat Nov 22 08:22:04.995392 2025] [:error] [pid 9547:tid 9563] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:22:05.204234 2025] [:error] [pid 9547:tid 9557] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/form.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:22:05.408187 2025] [:error] [pid 9547:tid 9565] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php, referer: https://duckduckgo.com/
[Sat Nov 22 08:22:05.640720 2025] [:error] [pid 9547:tid 9553] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php, referer: https://www.google.com/
[Sat Nov 22 08:22:05.875050 2025] [:error] [pid 9547:tid 9554] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/kyami.php, referer: https://www.google.fr/
[Sat Nov 22 08:22:06.090286 2025] [:error] [pid 9547:tid 9575] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php, referer: https://www.yahoo.com/
[Sat Nov 22 08:22:06.294338 2025] [:error] [pid 9547:tid 9560] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.fr/
[Sat Nov 22 08:22:06.498448 2025] [:error] [pid 9547:tid 9566] [client 13.77.69.8:4347] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php, referer: https://duckduckgo.com/
[Sun Nov 23 06:19:58.462807 2025] [:error] [pid 44652:tid 44729] [client 167.71.203.246:53600] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Nov 23 08:17:07.090227 2025] [:error] [pid 38739:tid 38777] [client 167.71.203.246:52013] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Nov 23 16:09:28.920538 2025] [:error] [pid 38738:tid 38752] [client 176.65.132.18:56914] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aSLBOAytc6TL9XavPmO88gAAAAo"]
[Sun Nov 23 16:34:10.010228 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Nov 23 16:34:10.114180 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Nov 23 16:34:10.218294 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Nov 23 16:34:10.348413 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Nov 23 16:34:10.564521 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Nov 23 16:34:10.720093 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Nov 23 16:34:10.928516 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Nov 23 16:34:11.105338 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Nov 23 16:34:11.302873 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Nov 23 16:34:11.543062 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Nov 23 16:34:11.640692 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Nov 23 16:34:11.786329 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Nov 23 16:34:11.915693 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Nov 23 16:34:12.044969 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Nov 23 16:34:12.221877 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Nov 23 16:34:12.347801 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Nov 23 16:34:12.513583 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Nov 23 16:34:12.640295 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.52:59489] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Nov 23 16:34:14.422283 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.52:59489] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSLHBgytc6TL9XavPmPJBwAAABM"]
[Sun Nov 23 16:34:15.124609 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.20:22471] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSLHB08WZjXLvbHTHPeImgAAANM"]
[Sun Nov 23 16:34:15.713936 2025] [:error] [pid 38738:tid 38752] [client 140.99.1.62:52995] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Nov 23 16:34:16.065333 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.62:52995] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSLHCAytc6TL9XavPmPJNAAAABA"]
[Sun Nov 23 16:34:16.577905 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.65:29605] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Nov 23 16:34:16.754829 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.65:29605] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSLHCE8WZjXLvbHTHPeI0gAAAMs"]
[Sun Nov 23 16:34:17.103452 2025] [:error] [pid 38739:tid 38782] [client 140.99.1.39:26111] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Nov 23 16:34:17.968793 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.39:26111] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSLHCQdvEgJm2n2cDmr7vgAAAFU"]
[Sun Nov 23 16:34:18.311007 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.76:58657] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSLHCtiQFwsyXQDhwyCCuAAAARc"]
[Sun Nov 23 16:34:18.594696 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.24:23083] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSLHCg13QPZSi6O8umVlLgAAAIE"]
[Sun Nov 23 16:34:18.815954 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.68:24069] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSLHCtiQFwsyXQDhwyCCygAAAQw"]
[Sun Nov 23 16:34:19.054397 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.72:62945] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSLHCw13QPZSi6O8umVlOQAAAIw"]
[Sun Nov 23 16:34:20.378890 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.8:52333] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSLHDAytc6TL9XavPmPJkAAAAAM"]
[Sun Nov 23 16:34:20.693830 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.7:21095] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSLHDA13QPZSi6O8umVlUAAAAI8"]
[Sun Nov 23 16:34:21.397612 2025] [:error] [pid 38738:tid 38755] [client 140.99.1.15:58061] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Nov 23 16:34:21.613400 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.15:58061] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aSLHDQytc6TL9XavPmPJrAAAAA8"]
[Sun Nov 23 16:34:22.047397 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.70:44991] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSLHDgytc6TL9XavPmPJvQAAAA8"]
[Sun Nov 23 16:34:22.740532 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.63:46205] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSLHDk8WZjXLvbHTHPeJXwAAAMs"]
[Sun Nov 23 16:34:22.965986 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.71:45889] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Nov 23 16:34:23.066807 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.71:45889] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSLHD9iQFwsyXQDhwyCDLwAAARU"]
[Sun Nov 23 16:34:23.252822 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.7:52573] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Nov 23 16:34:23.691473 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.7:52573] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Nov 23 16:34:24.011450 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.7:52573] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSLHEE8WZjXLvbHTHPeJhgAAAMI"]
[Sun Nov 23 16:34:24.214517 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.43:26467] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Nov 23 16:34:24.306981 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.43:26467] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSLHEAdvEgJm2n2cDmr8AQAAAFY"]
[Sun Nov 23 16:34:24.596764 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.75:55465] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Nov 23 16:34:24.881328 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.75:55465] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSLHEAdvEgJm2n2cDmr8EAAAAEo"]
[Sun Nov 23 16:34:25.226607 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.14:30155] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSLHEQ13QPZSi6O8umVlmgAAAIE"]
[Sun Nov 23 16:34:25.533516 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.38:37057] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Nov 23 16:34:25.671436 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.38:37057] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Nov 23 16:34:25.899473 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.38:37057] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSLHEQ13QPZSi6O8umVlqgAAAIE"]
[Sun Nov 23 16:34:26.218441 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.71:65067] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSLHEg13QPZSi6O8umVlrwAAAIw"]
[Sun Nov 23 16:34:26.562778 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.75:48881] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSLHEtiQFwsyXQDhwyCDkAAAAQU"]
[Sun Nov 23 16:34:26.843808 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.52:64229] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSLHEgytc6TL9XavPmPKJAAAABQ"]
[Sun Nov 23 16:34:27.035746 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.65:58853] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSLHEwdvEgJm2n2cDmr8KwAAAEo"]
[Sun Nov 23 16:34:27.524476 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.10:51533] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Nov 23 16:34:27.739788 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.10:51533] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSLHEw13QPZSi6O8umVlyAAAAI0"]
[Sun Nov 23 16:34:28.020426 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.32:34883] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSLHFA13QPZSi6O8umVlzAAAAJg"]
[Sun Nov 23 16:34:28.213524 2025] [:error] [pid 44652:tid 44708] [client 140.99.1.52:52657] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSLHFNiQFwsyXQDhwyCDrAAAAQI"]
[Sun Nov 23 16:34:28.746341 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.17:63063] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Nov 23 16:34:28.969024 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.17:63063] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Nov 23 16:34:29.443492 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.17:63063] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSLHFQ13QPZSi6O8umVl6QAAAJA"]
[Sun Nov 23 16:34:29.986000 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.43:56037] [client 140.99.1.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.43, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSLHFU8WZjXLvbHTHPeKKgAAAM4"]
[Sun Nov 23 16:34:30.097354 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.43:56037] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Nov 23 16:34:30.731344 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.43:56037] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Nov 23 16:34:30.909058 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.43:56037] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Nov 23 16:34:31.471319 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.43:56037] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSLHF08WZjXLvbHTHPeKcwAAAM4"]
[Sun Nov 23 16:34:31.940805 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.20:32511] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Nov 23 16:34:32.058196 2025] [:error] [pid 38824:tid 38844] [client 140.99.1.20:32511] [client 140.99.1.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.20, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSLHGE8WZjXLvbHTHPeKggAAANE"]
[Sun Nov 23 16:34:32.267801 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.20:32511] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSLHGE8WZjXLvbHTHPeKiQAAANc"]
[Sun Nov 23 16:34:33.109216 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.42:20791] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Nov 23 16:34:33.339391 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.42:20791] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Nov 23 16:34:33.563436 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.42:20791] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSLHGU8WZjXLvbHTHPeKvAAAAMo"]
[Sun Nov 23 16:34:33.863098 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.15:22743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Nov 23 16:34:34.341386 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.15:22743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Nov 23 16:34:34.569120 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.15:22743] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Nov 23 16:34:34.825603 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.15:22743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Nov 23 16:34:34.939159 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.15:22743] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSLHGg13QPZSi6O8umVmbQAAAJM"]
[Sun Nov 23 16:34:35.221548 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.13:65119] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Nov 23 16:34:35.321823 2025] [:error] [pid 38824:tid 38834] [client 140.99.1.13:65119] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Nov 23 16:34:35.459347 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.13:65119] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSLHG08WZjXLvbHTHPeK4gAAANU"]
[Sun Nov 23 16:34:35.824473 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.26:28749] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Nov 23 16:34:36.018894 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.26:28749] [client 140.99.1.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.26, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSLHHAytc6TL9XavPmPK4QAAAA4"]
[Sun Nov 23 16:34:36.132785 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.26:28749] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSLHHAytc6TL9XavPmPK5QAAABQ"]
[Sun Nov 23 16:34:37.660328 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.8:33233] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Nov 23 16:34:38.395669 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.8:33233] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Nov 23 16:34:38.485447 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.8:33233] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSLHHtiQFwsyXQDhwyCEtAAAAQc"]
[Sun Nov 23 16:34:39.801142 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.68:62997] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Nov 23 16:34:40.234867 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.68:62997] [client 140.99.1.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.68, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSLHINiQFwsyXQDhwyCFAAAAARA"]
[Sun Nov 23 16:34:40.397513 2025] [:error] [pid 44652:tid 44710] [client 140.99.1.68:62997] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Nov 23 16:34:40.512600 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.68:62997] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Nov 23 16:34:40.659967 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.68:62997] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Nov 23 16:34:40.861889 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.68:62997] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSLHINiQFwsyXQDhwyCFGgAAAQc"]
[Sun Nov 23 16:34:41.052452 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.43:31987] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Nov 23 16:34:41.152087 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.43:31987] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSLHIQytc6TL9XavPmPLSgAAAAQ"]
[Sun Nov 23 16:34:42.118379 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.27:29587] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Nov 23 16:34:42.230087 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.27:29587] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSLHIgdvEgJm2n2cDmr9NQAAAEE"]
[Sun Nov 23 16:34:42.715935 2025] [:error] [pid 38738:tid 38752] [client 140.99.1.9:58509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Nov 23 16:34:42.831216 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.9:58509] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSLHIgytc6TL9XavPmPLagAAABA"]
[Sun Nov 23 16:34:43.048957 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.68:63305] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSLHI9iQFwsyXQDhwyCFVQAAARU"]
[Sun Nov 23 16:34:43.353875 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.53:35667] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Nov 23 16:34:43.468137 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.53:35667] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Nov 23 16:34:43.998081 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.53:35667] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSLHIwytc6TL9XavPmPLfgAAAA4"]
[Sun Nov 23 16:34:44.299725 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.76:46697] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSLHJA13QPZSi6O8umVm5wAAAIM"]
[Sun Nov 23 16:34:44.882745 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.77:38739] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSLHJAdvEgJm2n2cDmr9kgAAAFg"]
[Sun Nov 23 16:34:45.088710 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.50:27389] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Nov 23 16:34:45.394503 2025] [:error] [pid 38740:tid 38810] [client 140.99.1.50:27389] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Nov 23 16:34:45.488491 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.50:27389] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSLHJQ13QPZSi6O8umVm_QAAAIs"]
[Sun Nov 23 16:34:45.710072 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.71:21273] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Nov 23 16:34:45.991240 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.71:21273] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSLHJU8WZjXLvbHTHPeLlAAAAME"]
[Sun Nov 23 16:34:46.497036 2025] [:error] [pid 44652:tid 44723] [client 140.99.1.28:44691] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSLHJtiQFwsyXQDhwyCFwwAAARE"]
[Sun Nov 23 16:34:47.005563 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.72:25953] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Nov 23 16:34:47.348748 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.72:25953] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Nov 23 16:34:47.552272 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.72:25953] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Nov 23 16:34:47.706515 2025] [:error] [pid 44652:tid 44726] [client 140.99.1.72:25953] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSLHJ9iQFwsyXQDhwyCF3wAAARQ"]
[Sun Nov 23 16:34:47.935085 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.8:40665] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSLHJ08WZjXLvbHTHPeLvAAAAMM"]
[Sun Nov 23 16:34:48.120229 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.68:65335] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSLHKNiQFwsyXQDhwyCF7QAAAQU"]
[Sun Nov 23 16:34:48.319720 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.77:28901] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSLHKNiQFwsyXQDhwyCF9QAAARU"]
[Sun Nov 23 16:34:48.700159 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.27:51789] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Nov 23 16:34:48.793042 2025] [:error] [pid 38824:tid 38836] [client 140.99.1.27:51789] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSLHKE8WZjXLvbHTHPeLyAAAAMk"]
[Sun Nov 23 16:34:49.015726 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.20:37689] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSLHKQytc6TL9XavPmPMJQAAABA"]
[Sun Nov 23 16:34:49.282871 2025] [:error] [pid 38739:tid 38769] [client 140.99.1.24:64011] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Nov 23 16:34:49.472912 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.24:64011] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSLHKQdvEgJm2n2cDmr9_wAAAEc"]
[Sun Nov 23 16:34:49.669978 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.48:21295] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSLHKQ13QPZSi6O8umVnUAAAAJA"]
[Sun Nov 23 16:34:49.877445 2025] [:error] [pid 44652:tid 44728] [client 140.99.1.2:26875] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSLHKdiQFwsyXQDhwyCGGwAAARY"]
[Sun Nov 23 16:34:50.095415 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.71:47183] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSLHKgdvEgJm2n2cDmr-HAAAAFY"]
[Sun Nov 23 16:34:50.437747 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.2:55885] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSLHKtiQFwsyXQDhwyCGLgAAARg"]
[Sun Nov 23 16:34:50.963639 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.9:36579] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSLHKk8WZjXLvbHTHPeL9QAAAMU"]
[Sun Nov 23 16:34:51.263965 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.9:26199] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Nov 23 16:34:51.565664 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.9:26199] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Nov 23 16:34:51.707625 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.9:26199] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSLHKwdvEgJm2n2cDmr-UwAAAEI"]
[Sun Nov 23 16:34:52.107018 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.42:40505] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sun Nov 23 16:34:52.208760 2025] [:error] [pid 38740:tid 38804] [client 140.99.1.42:40505] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Nov 23 16:34:52.704465 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.42:40505] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSLHLA13QPZSi6O8umVnsAAAAIM"]
[Sun Nov 23 16:34:53.347924 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.70:27261] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSLHLQdvEgJm2n2cDmr-hQAAAEc"]
[Sun Nov 23 16:34:53.533672 2025] [:error] [pid 38740:tid 38804] [client 140.99.1.44:36005] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSLHLQ13QPZSi6O8umVnwAAAAIg"]
[Sun Nov 23 16:34:56.156513 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.17:44307] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSLHMAytc6TL9XavPmPM_wAAAAA"]
[Sun Nov 23 16:34:56.749252 2025] [:error] [pid 38739:tid 38773] [client 140.99.1.48:38389] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Nov 23 16:34:56.853768 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.48:38389] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Nov 23 16:34:57.029901 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.48:38389] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Nov 23 16:34:57.211082 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.48:38389] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Nov 23 16:34:57.874867 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.48:38389] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSLHMQdvEgJm2n2cDmr-6wAAAFY"]
[Sun Nov 23 16:34:58.222072 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.39:43399] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSLHMgdvEgJm2n2cDmr-8QAAAEI"]
[Sun Nov 23 16:34:58.405022 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.14:35327] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSLHMk8WZjXLvbHTHPeMnAAAANc"]
[Sun Nov 23 16:34:58.756800 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.77:20637] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSLHMtiQFwsyXQDhwyCG0QAAAQs"]
[Sun Nov 23 16:34:58.954982 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.15:24245] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSLHMgytc6TL9XavPmPNXwAAABQ"]
[Sun Nov 23 16:34:59.192321 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.48:21937] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSLHMw13QPZSi6O8umVoRwAAAJg"]
[Sun Nov 23 16:34:59.690902 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.8:39761] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSLHMwytc6TL9XavPmPNcgAAAAM"]
[Sun Nov 23 16:34:59.881620 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.39:60619] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSLHM9iQFwsyXQDhwyCG2QAAAQg"]
[Sun Nov 23 16:35:00.169857 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.77:59029] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSLHNAytc6TL9XavPmPNdwAAABQ"]
[Sun Nov 23 16:35:00.354281 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.28:37967] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSLHNA13QPZSi6O8umVoeQAAAJU"]
[Sun Nov 23 16:35:01.004734 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.18:47203] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSLHNU8WZjXLvbHTHPeM1gAAANA"]
[Sun Nov 23 16:35:01.391840 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.15:53959] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSLHNQdvEgJm2n2cDmr_NgAAAEE"]
[Sun Nov 23 16:35:01.694069 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.5:31291] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Nov 23 16:35:01.988711 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.5:31291] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSLHNU8WZjXLvbHTHPeM6AAAANA"]
[Sun Nov 23 16:35:02.481598 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.15:37891] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSLHNgytc6TL9XavPmPNkwAAAAc"]
[Sun Nov 23 16:35:02.937311 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.52:57237] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Nov 23 16:35:03.108321 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.52:57237] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSLHN08WZjXLvbHTHPeNBAAAANM"]
[Sun Nov 23 16:35:03.508128 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.42:55633] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Nov 23 16:35:03.620967 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.42:55633] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Nov 23 16:35:03.738423 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.42:55633] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Nov 23 16:35:03.836791 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.42:55633] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSLHNwdvEgJm2n2cDmr_ZgAAAEg"]
[Sun Nov 23 16:35:04.072654 2025] [:error] [pid 44652:tid 44707] [client 140.99.1.49:56313] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Nov 23 16:35:04.171929 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.49:56313] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSLHONiQFwsyXQDhwyCHJwAAAQk"]
[Sun Nov 23 16:35:04.722725 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.16:61765] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Nov 23 16:35:04.900131 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.16:61765] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Nov 23 16:35:05.006094 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.16:61765] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Nov 23 16:35:05.656497 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.16:61765] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Nov 23 16:35:05.764024 2025] [:error] [pid 38738:tid 38764] [client 140.99.1.16:61765] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Nov 23 16:35:05.978908 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.16:61765] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sun Nov 23 16:35:06.319614 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.16:61765] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Nov 23 16:35:06.415970 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.16:61765] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSLHOgytc6TL9XavPmPN7gAAAAA"]
[Sun Nov 23 16:35:06.604354 2025] [:error] [pid 44652:tid 44707] [client 140.99.1.74:20537] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSLHOtiQFwsyXQDhwyCHVAAAAQE"]
[Sun Nov 23 16:35:06.839307 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.69:21351] [client 140.99.1.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.69, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aSLHOg13QPZSi6O8umVpSQAAAI0"]
[Sun Nov 23 16:35:06.843172 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.69:21351] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Nov 23 16:35:07.029022 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.69:21351] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Nov 23 16:35:07.187988 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.69:21351] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSLHOw13QPZSi6O8umVpVAAAAIQ"]
[Sun Nov 23 16:35:07.513112 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.18:36859] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Nov 23 16:35:07.639822 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.18:36859] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSLHOwdvEgJm2n2cDmr_yQAAAEk"]
[Sun Nov 23 16:35:07.901356 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.53:63371] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSLHO9iQFwsyXQDhwyCHcwAAARU"]
[Sun Nov 23 16:35:08.671408 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.62:44267] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSLHPAdvEgJm2n2cDmr_6AAAAE8"]
[Sun Nov 23 16:35:08.915310 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.72:36867] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aSLHPAdvEgJm2n2cDmr_8QAAAEw"]
[Sun Nov 23 16:35:09.488694 2025] [:error] [pid 38739:tid 38769] [client 140.99.1.3:57277] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Nov 23 16:35:09.685787 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.3:57277] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSLHPQdvEgJm2n2cDmoACAAAAFY"]
[Sun Nov 23 16:35:10.178044 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.43:40125] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sun Nov 23 16:35:10.373440 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.43:40125] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/function.php"] [unique_id "aSLHPgdvEgJm2n2cDmoAHgAAAFg"]
[Sun Nov 23 16:35:10.623422 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.75:21527] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSLHPg13QPZSi6O8umVprwAAAJE"]
[Sun Nov 23 16:35:13.457042 2025] [:error] [pid 38738:tid 38755] [client 140.99.1.16:36891] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sun Nov 23 16:35:13.564995 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.16:36891] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSLHQQytc6TL9XavPmPOmgAAAAI"]
[Sun Nov 23 16:35:13.798056 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.2:61945] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSLHQdiQFwsyXQDhwyCIGAAAAQw"]
[Sun Nov 23 16:35:14.245255 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.53:64925] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sun Nov 23 16:35:14.390886 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.53:64925] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Nov 23 16:35:14.615247 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.53:64925] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Nov 23 16:35:14.855854 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.53:64925] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSLHQk8WZjXLvbHTHPeOLAAAANU"]
[Sun Nov 23 16:35:15.046337 2025] [:error] [pid 38824:tid 38836] [client 140.99.1.78:43307] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSLHQ08WZjXLvbHTHPeONQAAAMk"]
[Sun Nov 23 16:35:15.958118 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.73:55195] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Nov 23 16:35:16.053970 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.73:55195] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSLHRA13QPZSi6O8umVqcQAAAII"]
[Sun Nov 23 16:35:16.382904 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.6:41161] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSLHRAytc6TL9XavPmPPBgAAABA"]
[Sun Nov 23 16:35:16.567713 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.53:32901] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSLHRNiQFwsyXQDhwyCIXQAAARA"]
[Sun Nov 23 16:35:17.265822 2025] [:error] [pid 38739:tid 38787] [client 140.99.1.53:44633] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Sun Nov 23 16:35:17.409341 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.53:44633] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSLHRQdvEgJm2n2cDmoAmgAAAEE"]
[Sun Nov 23 16:35:17.926438 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.77:55823] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSLHRU8WZjXLvbHTHPeOdAAAAMU"]
[Sun Nov 23 16:35:18.118783 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.13:56073] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Nov 23 16:35:18.222697 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.13:56073] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sun Nov 23 16:35:18.431738 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.13:56073] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Nov 23 16:35:18.885077 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.13:56073] [client 140.99.1.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.13, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/wp-login.php"] [unique_id "aSLHRgdvEgJm2n2cDmoAwQAAAFU"]
[Sun Nov 23 16:35:19.157162 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.13:56073] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sun Nov 23 16:35:19.262114 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.13:56073] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sun Nov 23 16:35:19.357335 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.13:56073] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sun Nov 23 16:35:19.557882 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.13:56073] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSLHRwdvEgJm2n2cDmoA2AAAAEI"]
[Sun Nov 23 16:35:20.290866 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.31:31763] [client 140.99.1.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.31, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSLHSA13QPZSi6O8umVrJwAAAJQ"]
[Sun Nov 23 16:35:20.663907 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.31:31763] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Nov 23 16:35:20.764484 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.31:31763] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Nov 23 16:35:20.960524 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.31:31763] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sun Nov 23 16:35:21.181796 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.31:31763] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Nov 23 16:35:21.483261 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.31:31763] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sun Nov 23 16:35:22.214038 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.31:31763] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Nov 23 16:35:22.324930 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.31:31763] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Sun Nov 23 16:35:22.871972 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.31:31763] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sun Nov 23 16:35:23.074143 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.31:31763] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSLHSw13QPZSi6O8umVrtQAAAJA"]
[Sun Nov 23 16:35:23.502301 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.53:52743] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sun Nov 23 16:35:23.591738 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.53:52743] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSLHSwytc6TL9XavPmPP-wAAABI"]
[Sun Nov 23 16:35:23.893667 2025] [:error] [pid 38739:tid 38787] [client 140.99.1.33:21597] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Nov 23 16:35:23.991765 2025] [:error] [pid 38739:tid 38792] [client 140.99.1.33:21597] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSLHSwdvEgJm2n2cDmoBTAAAAFc"]
[Sun Nov 23 16:35:24.398473 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.33:54471] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sun Nov 23 16:35:24.655006 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.33:54471] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sun Nov 23 16:35:24.856695 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.33:54471] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sun Nov 23 16:35:24.949254 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.33:54471] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sun Nov 23 16:35:25.158613 2025] [:error] [pid 38824:tid 38836] [client 140.99.1.33:54471] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSLHTU8WZjXLvbHTHPePYQAAAMk"]
[Sun Nov 23 16:35:25.351663 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.74:45067] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Sun Nov 23 16:35:25.449766 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.74:45067] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sun Nov 23 16:35:25.547782 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.74:45067] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSLHTQdvEgJm2n2cDmoBdwAAAEM"]
[Sun Nov 23 16:35:25.858186 2025] [:error] [pid 38739:tid 38769] [client 140.99.1.20:63385] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSLHTQdvEgJm2n2cDmoBggAAAEA"]
[Sun Nov 23 16:35:26.159295 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.46:50337] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Nov 23 16:35:26.595015 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.46:50337] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sun Nov 23 16:35:26.824772 2025] [:error] [pid 44652:tid 44706] [client 140.99.1.46:50337] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sun Nov 23 16:35:26.955021 2025] [:error] [pid 44652:tid 44709] [client 140.99.1.46:50337] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSLHTtiQFwsyXQDhwyCJKwAAAQM"]
[Sun Nov 23 16:35:27.152759 2025] [:error] [pid 38740:tid 38804] [client 140.99.1.3:25229] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSLHTw13QPZSi6O8umVsLAAAAIg"]
[Sun Nov 23 16:35:27.936146 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.24:21739] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sun Nov 23 16:35:28.161353 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.24:21739] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSLHUA13QPZSi6O8umVsVAAAAIc"]
[Sun Nov 23 16:35:28.583361 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.15:49447] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aSLHUA13QPZSi6O8umVsXgAAAJA"]
[Sun Nov 23 16:35:28.906802 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.6:27021] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Nov 23 16:35:29.003061 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.6:27021] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sun Nov 23 16:35:29.143248 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.6:27021] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSLHUQdvEgJm2n2cDmoB3wAAAEg"]
[Sun Nov 23 16:35:29.639239 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.27:29405] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sun Nov 23 16:35:29.838483 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.27:29405] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Sun Nov 23 16:35:30.035223 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.27:29405] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Nov 23 16:35:30.383787 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.27:29405] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSLHUg13QPZSi6O8umVslwAAAJc"]
[Sun Nov 23 16:35:30.784992 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.53:27711] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sun Nov 23 16:35:31.084675 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.53:27711] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSLHUw13QPZSi6O8umVsqQAAAIM"]
[Sun Nov 23 16:35:31.995222 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.72:45767] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Sun Nov 23 16:35:32.355471 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.72:45767] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sun Nov 23 16:35:32.452652 2025] [:error] [pid 38739:tid 38789] [client 140.99.1.72:45767] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Nov 23 16:35:32.683085 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.72:45767] [client 140.99.1.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.72, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSLHVAdvEgJm2n2cDmoCIAAAAFM"]
[Sun Nov 23 16:35:33.214167 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.72:45767] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSLHVQdvEgJm2n2cDmoCMAAAAFY"]
[Sun Nov 23 16:35:33.483631 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.13:23035] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Sun Nov 23 16:35:33.574777 2025] [:error] [pid 38739:tid 38792] [client 140.99.1.13:23035] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSLHVQdvEgJm2n2cDmoCPQAAAFc"]
[Sun Nov 23 16:35:33.769440 2025] [:error] [pid 38740:tid 38804] [client 140.99.1.62:48013] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Nov 23 16:35:34.035400 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.62:48013] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Nov 23 16:35:34.249962 2025] [:error] [pid 38740:tid 38806] [client 140.99.1.62:48013] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSLHVg13QPZSi6O8umVs4AAAAIo"]
[Sun Nov 23 16:35:34.645090 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.10:53857] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sun Nov 23 16:35:34.816563 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.10:53857] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sun Nov 23 16:35:35.019922 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.10:53857] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSLHVwytc6TL9XavPmPRmwAAAAQ"]
[Sun Nov 23 16:35:35.344862 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.68:50153] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSLHV08WZjXLvbHTHPeQhwAAANQ"]
[Sun Nov 23 16:35:35.564455 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.10:20467] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Sun Nov 23 16:35:35.743564 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.10:20467] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sun Nov 23 16:35:36.027970 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.10:20467] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSLHWAdvEgJm2n2cDmoCawAAAFE"]
[Sun Nov 23 16:35:36.320411 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.38:42875] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sun Nov 23 16:35:36.552851 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.38:42875] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Sun Nov 23 16:35:36.721941 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.38:42875] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSLHWA13QPZSi6O8umVtOwAAAIA"]
[Sun Nov 23 16:35:37.034267 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.43:37639] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/db.php"] [unique_id "aSLHWQdvEgJm2n2cDmoChgAAAFg"]
[Sun Nov 23 16:35:37.229239 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.71:32613] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSLHWQytc6TL9XavPmPR6gAAAAM"]
[Sun Nov 23 16:35:37.514700 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.68:48945] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSLHWQ13QPZSi6O8umVtWAAAAJU"]
[Sun Nov 23 16:35:37.699174 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.27:26927] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSLHWU8WZjXLvbHTHPeQwgAAANM"]
[Sun Nov 23 16:35:37.883424 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.39:48015] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSLHWQ13QPZSi6O8umVtaAAAAIU"]
[Sun Nov 23 16:35:38.154953 2025] [:error] [pid 38739:tid 38789] [client 140.99.1.10:55675] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSLHWgdvEgJm2n2cDmoCnAAAAFQ"]
[Sun Nov 23 16:35:38.596356 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.39:41929] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSLHWgytc6TL9XavPmPSKQAAAA8"]
[Sun Nov 23 16:35:38.780925 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.65:42745] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSLHWtiQFwsyXQDhwyCKkgAAAQw"]
[Sun Nov 23 16:35:39.126195 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.44:34293] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSLHWw13QPZSi6O8umVtmAAAAI8"]
[Sun Nov 23 16:35:39.444221 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.5:61073] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSLHW9iQFwsyXQDhwyCKowAAAQk"]
[Sun Nov 23 16:35:39.893948 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.53:50229] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSLHWw13QPZSi6O8umVtxwAAAIc"]
[Sun Nov 23 16:35:40.084580 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.24:46263] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sun Nov 23 16:35:40.645261 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.24:46263] [client 140.99.1.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.24, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSLHXAytc6TL9XavPmPSfQAAAAA"]
[Sun Nov 23 16:35:41.362507 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.24:46263] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSLHXQytc6TL9XavPmPSnQAAAAY"]
[Sun Nov 23 16:35:41.604774 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.65:24689] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSLHXQ13QPZSi6O8umVuFwAAAIU"]
[Sun Nov 23 16:35:42.317109 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.48:24303] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Nov 23 16:35:42.420895 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.48:24303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Sun Nov 23 16:35:42.925791 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.48:24303] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sun Nov 23 16:35:43.125167 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.48:24303] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sun Nov 23 16:35:43.597968 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.48:24303] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sun Nov 23 16:35:43.703315 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.48:24303] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sun Nov 23 16:35:43.811815 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.48:24303] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sun Nov 23 16:35:43.979944 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.48:24303] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Sun Nov 23 16:35:44.093150 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.48:24303] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSLHYE8WZjXLvbHTHPeRYwAAAMM"]
[Sun Nov 23 16:35:44.276541 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.78:64345] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSLHYE8WZjXLvbHTHPeRZQAAAMw"]
[Sun Nov 23 16:35:44.496793 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.48:57973] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSLHYE8WZjXLvbHTHPeRaQAAAM4"]
[Sun Nov 23 16:35:44.892753 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.74:62057] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Sun Nov 23 16:35:44.995840 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.74:62057] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sun Nov 23 16:35:45.287346 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.74:62057] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sun Nov 23 16:35:45.880755 2025] [:error] [pid 38739:tid 38773] [client 140.99.1.74:62057] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSLHYQdvEgJm2n2cDmoDZQAAAEQ"]
[Sun Nov 23 16:35:46.068640 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.2:35147] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSLHYtiQFwsyXQDhwyCLOAAAARA"]
[Sun Nov 23 16:35:46.291293 2025] [:error] [pid 38739:tid 38773] [client 140.99.1.78:27563] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSLHYgdvEgJm2n2cDmoDdgAAAEQ"]
[Sun Nov 23 16:35:47.032895 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.8:45169] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSLHYw13QPZSi6O8umVuwAAAAJc"]
[Sun Nov 23 16:35:47.402410 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.10:61143] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSLHYwytc6TL9XavPmPTaQAAAAw"]
[Sun Nov 23 16:35:47.840186 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.8:59805] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSLHY9iQFwsyXQDhwyCLWgAAARU"]
[Sun Nov 23 16:35:49.717615 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.17:60105] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSLHZQ13QPZSi6O8umVvMQAAAJQ"]
[Sun Nov 23 16:35:49.905680 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.67:45073] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sun Nov 23 16:35:50.188855 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.67:45073] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSLHZg13QPZSi6O8umVvPAAAAIU"]
[Sun Nov 23 16:35:50.607216 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.42:56865] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sun Nov 23 16:35:51.042148 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.42:56865] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun Nov 23 16:35:51.136019 2025] [:error] [pid 38738:tid 38759] [client 140.99.1.42:56865] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSLHZwytc6TL9XavPmPTswAAABE"]
[Sun Nov 23 16:35:51.671778 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.72:53253] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSLHZw13QPZSi6O8umVvbgAAAJA"]
[Sun Nov 23 16:35:52.475518 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.65:42847] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSLHaAdvEgJm2n2cDmoENQAAAEc"]
[Sun Nov 23 16:35:53.519989 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.3:53505] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSLHaQdvEgJm2n2cDmoEUgAAAE4"]
[Sun Nov 23 16:35:53.840723 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.75:33277] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Nov 23 16:35:53.950983 2025] [:error] [pid 38739:tid 38789] [client 140.99.1.75:33277] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSLHaQdvEgJm2n2cDmoEYgAAAFQ"]
[Sun Nov 23 16:35:54.281934 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.43:65075] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSLHagytc6TL9XavPmPUAAAAAAQ"]
[Sun Nov 23 16:35:55.162179 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.74:52989] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSLHa9iQFwsyXQDhwyCMRwAAARM"]
[Sun Nov 23 16:35:55.425198 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.69:60977] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sun Nov 23 16:35:55.942686 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.69:60977] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sun Nov 23 16:35:56.077815 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.69:60977] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSLHbAdvEgJm2n2cDmoElAAAAEw"]
[Sun Nov 23 16:35:56.539965 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.43:63999] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sun Nov 23 16:35:56.777344 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.43:63999] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSLHbAytc6TL9XavPmPURAAAABA"]
[Sun Nov 23 16:35:56.999287 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.74:44603] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSLHbE8WZjXLvbHTHPeS-AAAAMQ"]
[Sun Nov 23 16:35:57.444827 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.74:63385] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSLHbU8WZjXLvbHTHPeTDgAAAMA"]
[Sun Nov 23 16:35:58.081400 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.5:50341] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSLHbtiQFwsyXQDhwyCMmwAAARU"]
[Sun Nov 23 16:35:58.447005 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.70:25771] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSLHbgytc6TL9XavPmPUbgAAABM"]
[Sun Nov 23 16:35:58.751977 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.18:39993] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Sun Nov 23 16:35:59.391800 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.18:39993] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSLHbw13QPZSi6O8umVwDAAAAJA"]
[Sun Nov 23 16:35:59.796799 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.76:37807] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSLHbwytc6TL9XavPmPUmgAAAAM"]
[Sun Nov 23 16:36:00.109032 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.7:48919] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSLHcA13QPZSi6O8umVwGgAAAIA"]
[Sun Nov 23 16:36:00.404999 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.11:29173] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Nov 23 16:36:00.502328 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.11:29173] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSLHcAytc6TL9XavPmPUwwAAABM"]
[Sun Nov 23 16:36:00.938310 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.53:48319] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSLHcAdvEgJm2n2cDmoE6wAAAFE"]
[Sun Nov 23 16:36:01.697461 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.75:38759] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSLHcQdvEgJm2n2cDmoFAgAAAFM"]
[Sun Nov 23 16:36:02.020727 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.62:59791] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sun Nov 23 16:36:02.132891 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.62:59791] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSLHctiQFwsyXQDhwyCNEgAAARg"]
[Sun Nov 23 16:36:02.584794 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.32:51687] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSLHctiQFwsyXQDhwyCNGgAAAQU"]
[Sun Nov 23 16:36:02.941702 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.72:58893] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/as.php"] [unique_id "aSLHcgytc6TL9XavPmPVJwAAABQ"]
[Sun Nov 23 16:36:03.383938 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.30:29151] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSLHcwdvEgJm2n2cDmoFLgAAAEc"]
[Sun Nov 23 16:36:03.589468 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.26:34489] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/install.php"] [unique_id "aSLHc9iQFwsyXQDhwyCNMQAAAQs"]
[Sun Nov 23 16:36:03.785466 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.74:38007] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSLHc9iQFwsyXQDhwyCNNQAAARU"]
[Sun Nov 23 16:36:04.874643 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.17:36897] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSLHdNiQFwsyXQDhwyCNUAAAAQk"]
[Sun Nov 23 16:36:05.578859 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.18:60795] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSLHddiQFwsyXQDhwyCNYQAAARc"]
[Sun Nov 23 16:36:06.120120 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.27:52315] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sun Nov 23 16:36:06.258432 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.27:52315] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSLHdg13QPZSi6O8umVw2QAAAII"]
[Sun Nov 23 16:36:06.985457 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.9:20435] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSLHdk8WZjXLvbHTHPeUZQAAANU"]
[Sun Nov 23 16:36:07.248090 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.20:38925] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Sun Nov 23 16:36:07.958658 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.20:38925] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSLHdwdvEgJm2n2cDmoF1AAAAEs"]
[Sun Nov 23 16:36:08.272035 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.77:55983] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSLHeE8WZjXLvbHTHPeUmwAAAMU"]
[Sun Nov 23 16:36:08.744832 2025] [:error] [pid 38738:tid 38751] [client 140.99.1.70:48623] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSLHeAytc6TL9XavPmPV1QAAAAk"]
[Sun Nov 23 16:36:09.257806 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.15:57241] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSLHediQFwsyXQDhwyCNtgAAARg"]
[Sun Nov 23 16:36:14.155617 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.16:20621] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSLHfg13QPZSi6O8umVxuwAAAIw"]
[Sun Nov 23 16:36:14.390999 2025] [:error] [pid 38738:tid 38752] [client 140.99.1.30:57583] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSLHfgytc6TL9XavPmPWngAAAAo"]
[Sun Nov 23 16:36:15.005195 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.50:22563] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSLHf08WZjXLvbHTHPeVkQAAANI"]
[Sun Nov 23 16:36:15.276714 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.15:39477] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSLHf08WZjXLvbHTHPeVlgAAAMY"]
[Sun Nov 23 16:36:15.790038 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.6:54695] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSLHf08WZjXLvbHTHPeVowAAANU"]
[Sun Nov 23 16:36:16.153907 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.27:48411] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aSLHgE8WZjXLvbHTHPeVqQAAAM4"]
[Sun Nov 23 16:36:16.388934 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.77:35935] [client 140.99.1.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.77, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSLHgNiQFwsyXQDhwyCOfAAAAQw"]
[Sun Nov 23 16:36:16.392735 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.77:35935] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sun Nov 23 16:36:16.482870 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.77:35935] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSLHgNiQFwsyXQDhwyCOgAAAAQ0"]
[Sun Nov 23 16:36:16.898580 2025] [:error] [pid 38740:tid 38804] [client 140.99.1.26:46845] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Nov 23 16:36:16.995325 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.26:46845] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSLHgA13QPZSi6O8umVyGAAAAJE"]
[Sun Nov 23 16:36:17.181158 2025] [:error] [pid 38824:tid 38851] [client 140.99.1.37:40637] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/network.php"] [unique_id "aSLHgU8WZjXLvbHTHPeVxwAAANg"]
[Sun Nov 23 16:36:17.375095 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.15:56305] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Sun Nov 23 16:36:18.265752 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.15:56305] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSLHgk8WZjXLvbHTHPeV9QAAAMQ"]
[Sun Nov 23 16:36:18.532427 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.73:24145] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSLHgg13QPZSi6O8umVyTgAAAJQ"]
[Sun Nov 23 16:36:18.981417 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.62:55997] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSLHggdvEgJm2n2cDmoHhAAAAFM"]
[Sun Nov 23 16:36:19.183787 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.38:42373] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aSLHgwdvEgJm2n2cDmoHiQAAAEY"]
[Sun Nov 23 16:36:19.391401 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.18:63635] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sun Nov 23 16:36:19.533018 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.18:63635] [client 140.99.1.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.18, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSLHgwytc6TL9XavPmPXMAAAABM"]
[Sun Nov 23 16:36:19.915216 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.18:63635] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSLHgwytc6TL9XavPmPXPQAAAA4"]
[Sun Nov 23 16:36:20.616029 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.69:48981] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSLHhAdvEgJm2n2cDmoHvgAAAFU"]
[Sun Nov 23 16:36:20.925231 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.43:63665] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sun Nov 23 16:36:21.075621 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.43:63665] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSLHhQytc6TL9XavPmPXWQAAABA"]
[Sun Nov 23 16:36:21.285751 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.11:25065] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSLHhQytc6TL9XavPmPXZgAAAAw"]
[Sun Nov 23 16:36:21.506605 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.77:29987] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sun Nov 23 16:36:21.893880 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.77:29987] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSLHhQdvEgJm2n2cDmoH3gAAAE4"]
[Sun Nov 23 16:36:22.364793 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.38:63295] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSLHhgdvEgJm2n2cDmoH8QAAAE4"]
[Sun Nov 23 16:36:22.577460 2025] [:error] [pid 38739:tid 38789] [client 140.99.1.68:61787] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sun Nov 23 16:36:22.821273 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.68:61787] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Nov 23 16:36:23.040623 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.68:61787] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSLHhwdvEgJm2n2cDmoICgAAAEI"]
[Sun Nov 23 16:36:23.233288 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.3:22165] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aSLHh08WZjXLvbHTHPeWaAAAAMI"]
[Sun Nov 23 16:36:23.661666 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.68:39895] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/count.php"] [unique_id "aSLHh9iQFwsyXQDhwyCPHQAAAQY"]
[Sun Nov 23 16:36:23.906770 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.17:43855] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Sun Nov 23 16:36:24.761446 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.17:43855] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSLHiAytc6TL9XavPmPX4wAAABc"]
[Sun Nov 23 16:36:25.157976 2025] [:error] [pid 38739:tid 38782] [client 140.99.1.30:41741] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||windfc.windfarmcoolants.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/stories/themes.php"] [unique_id "aSLHiQdvEgJm2n2cDmoIRwAAAE0"]
[Sun Nov 23 16:36:25.306618 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.30:41741] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSLHiQdvEgJm2n2cDmoITgAAAEU"]
[Sun Nov 23 16:36:25.745103 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.24:52153] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSLHiQdvEgJm2n2cDmoIaQAAAEU"]
[Sun Nov 23 16:36:26.094086 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.74:60821] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSLHig13QPZSi6O8umVzLgAAAIk"]
[Sun Nov 23 16:36:29.009194 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.50:27029] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sun Nov 23 16:36:29.485303 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.50:27029] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSLHjU8WZjXLvbHTHPeW-gAAANM"]
[Sun Nov 23 16:36:31.064229 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.2:57047] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSLHjwdvEgJm2n2cDmoJYgAAAFU"]
[Sun Nov 23 16:36:31.409930 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.63:56143] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSLHj9iQFwsyXQDhwyCPyQAAAQ0"]
[Sun Nov 23 16:36:31.635916 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.10:45527] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sun Nov 23 16:36:32.455202 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.10:45527] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSLHkAytc6TL9XavPmPZAgAAAA4"]
[Sun Nov 23 16:36:32.793224 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.7:64877] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aSLHkNiQFwsyXQDhwyCP3gAAAQY"]
[Sun Nov 23 16:36:32.983468 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.20:50701] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Nov 23 16:36:33.116461 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.20:50701] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSLHkdiQFwsyXQDhwyCP6wAAAQc"]
[Sun Nov 23 16:36:33.324266 2025] [:error] [pid 38824:tid 38835] [client 140.99.1.10:35665] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSLHkU8WZjXLvbHTHPeXbwAAAMg"]
[Sun Nov 23 16:36:33.822154 2025] [:error] [pid 38740:tid 38806] [client 140.99.1.62:33913] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSLHkQ13QPZSi6O8umV0FQAAAIo"]
[Sun Nov 23 16:36:34.437767 2025] [:error] [pid 38739:tid 38782] [client 140.99.1.43:35901] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Sun Nov 23 16:36:34.557802 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.43:35901] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSLHkgdvEgJm2n2cDmoJ_wAAAEk"]
[Sun Nov 23 16:36:34.743889 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.20:35135] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSLHkg13QPZSi6O8umV0KAAAAIA"]
[Sun Nov 23 16:36:39.761351 2025] [:error] [pid 38738:tid 38750] [client 140.99.1.2:45961] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSLHlwytc6TL9XavPmPZyAAAAAg"]
[Sun Nov 23 16:36:40.272052 2025] [:error] [pid 38824:tid 38851] [client 140.99.1.48:35103] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSLHmE8WZjXLvbHTHPeYTwAAANg"]
[Sun Nov 23 16:36:40.469946 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.44:28319] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Sun Nov 23 16:36:41.168811 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.44:28319] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSLHmQ13QPZSi6O8umV07wAAAJc"]
[Sun Nov 23 16:36:41.354929 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.37:21893] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSLHmQ13QPZSi6O8umV0-gAAAJc"]
[Sun Nov 23 16:36:41.690965 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.7:46043] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSLHmQdvEgJm2n2cDmoKlwAAAEE"]
[Sun Nov 23 16:36:41.937417 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.52:29077] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sun Nov 23 16:36:42.197515 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.52:29077] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSLHmk8WZjXLvbHTHPeYbwAAAM4"]
[Sun Nov 23 16:36:42.463184 2025] [:error] [pid 38739:tid 38769] [client 140.99.1.42:50993] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Sun Nov 23 16:36:42.740844 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.42:50993] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSLHmgdvEgJm2n2cDmoKrQAAAEE"]
[Sun Nov 23 16:36:42.993775 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.78:20511] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSLHmgytc6TL9XavPmPaMwAAAA4"]
[Sun Nov 23 16:36:43.321853 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.73:33855] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSLHmw13QPZSi6O8umV1KwAAAI8"]
[Sun Nov 23 16:36:43.552153 2025] [:error] [pid 38740:tid 38806] [client 140.99.1.50:61293] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aSLHmw13QPZSi6O8umV1NgAAAIo"]
[Sun Nov 23 16:36:44.046786 2025] [:error] [pid 38740:tid 38806] [client 140.99.1.43:51473] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSLHnA13QPZSi6O8umV1UgAAAIo"]
[Sun Nov 23 16:36:44.446524 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.62:62567] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSLHnE8WZjXLvbHTHPeYjAAAAMs"]
[Sun Nov 23 16:36:44.728396 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.39:40213] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSLHnE8WZjXLvbHTHPeYkAAAAM8"]
[Sun Nov 23 16:36:44.924789 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.14:51061] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSLHnAdvEgJm2n2cDmoKxwAAAFU"]
[Sun Nov 23 16:36:45.503044 2025] [:error] [pid 44652:tid 44728] [client 140.99.1.71:33211] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSLHndiQFwsyXQDhwyCRXgAAARY"]
[Sun Nov 23 16:36:46.009282 2025] [:error] [pid 38740:tid 38802] [client 140.99.1.8:51713] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSLHng13QPZSi6O8umV1dAAAAIY"]
[Sun Nov 23 16:36:46.322690 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.43:45105] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSLHngdvEgJm2n2cDmoK7QAAAFM"]
[Sun Nov 23 16:36:47.770506 2025] [:error] [pid 38739:tid 38787] [client 140.99.1.28:20011] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSLHnwdvEgJm2n2cDmoLDQAAAFI"]
[Sun Nov 23 16:36:48.248494 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.5:58435] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Sun Nov 23 16:36:48.689501 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.5:58435] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSLHoAytc6TL9XavPmPbFQAAABU"]
[Sun Nov 23 16:36:48.971495 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.52:38171] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSLHoAytc6TL9XavPmPbHwAAABc"]
[Sun Nov 23 16:36:49.332188 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.68:29275] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sun Nov 23 16:36:49.429123 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.68:29275] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSLHodiQFwsyXQDhwyCR3wAAARc"]
[Sun Nov 23 16:36:50.258949 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.46:34933] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSLHotiQFwsyXQDhwyCR-gAAARg"]
[Sun Nov 23 16:36:50.556215 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.73:21785] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Sun Nov 23 16:36:50.652976 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.73:21785] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSLHok8WZjXLvbHTHPeZGQAAANY"]
[Sun Nov 23 16:36:51.141713 2025] [:error] [pid 38740:tid 38810] [client 140.99.1.68:59043] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSLHow13QPZSi6O8umV13gAAAI4"]
[Sun Nov 23 16:36:51.426108 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.67:64949] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Nov 23 16:36:51.550304 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.67:64949] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSLHo9iQFwsyXQDhwyCSJgAAAQk"]
[Sun Nov 23 16:36:51.954717 2025] [:error] [pid 38739:tid 38792] [client 140.99.1.50:55475] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSLHowdvEgJm2n2cDmoLdQAAAFc"]
[Sun Nov 23 16:36:52.541459 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.74:50393] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sun Nov 23 16:36:52.665840 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.74:50393] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSLHpNiQFwsyXQDhwyCSPwAAARg"]
[Sun Nov 23 16:36:53.323597 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.2:31009] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSLHpQytc6TL9XavPmPbmwAAABQ"]
[Sun Nov 23 16:36:53.678032 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.70:58425] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sun Nov 23 16:36:53.780931 2025] [:error] [pid 38739:tid 38785] [client 140.99.1.70:58425] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSLHpQdvEgJm2n2cDmoLpgAAAFA"]
[Sun Nov 23 16:36:53.981992 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.7:41929] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSLHpdiQFwsyXQDhwyCSYAAAARU"]
[Sun Nov 23 16:36:54.193904 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.33:23593] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Sun Nov 23 16:36:54.486903 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.33:23593] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSLHptiQFwsyXQDhwyCSgAAAAQU"]
[Sun Nov 23 16:36:54.682276 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.32:28909] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSLHpgytc6TL9XavPmPbsAAAABc"]
[Sun Nov 23 16:36:55.690123 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.6:60589] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSLHpwytc6TL9XavPmPb0wAAAAQ"]
[Sun Nov 23 16:36:56.664820 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.76:41343] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSLHqAdvEgJm2n2cDmoL9AAAAFY"]
[Sun Nov 23 16:36:57.157111 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.6:56383] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/log.php"] [unique_id "aSLHqQytc6TL9XavPmPb7QAAAAA"]
[Sun Nov 23 16:36:57.388775 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.65:30557] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSLHqdiQFwsyXQDhwyCS1QAAAQs"]
[Sun Nov 23 16:37:27.400028 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.5:52433] [client 140.99.1.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/linkpreview/"] [unique_id "aSLHxwdvEgJm2n2cDmoPewAAAEU"]
[Sun Nov 23 16:44:09.047498 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Nov 23 16:44:09.224187 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Nov 23 16:44:09.345938 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Nov 23 16:44:09.460830 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Nov 23 16:44:09.559732 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Nov 23 16:44:09.657177 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Nov 23 16:44:09.787469 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Nov 23 16:44:09.919900 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Nov 23 16:44:10.204683 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Nov 23 16:44:10.480853 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Nov 23 16:44:10.658196 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Nov 23 16:44:10.840225 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Nov 23 16:44:10.982318 2025] [:error] [pid 38738:tid 38750] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Nov 23 16:44:11.185398 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Nov 23 16:44:11.400856 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Nov 23 16:44:11.511399 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Nov 23 16:44:11.643354 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Nov 23 16:44:11.766903 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.74:38527] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Nov 23 16:44:14.256914 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.74:38527] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSLJXgytc6TL9XavPmMCCQAAAAU"]
[Sun Nov 23 16:44:14.588241 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.65:34625] [client 140.99.1.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/admin.php"] [unique_id "aSLJXgytc6TL9XavPmMCEgAAAAI"]
[Sun Nov 23 16:44:15.090972 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.73:58899] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSLJXwdvEgJm2n2cDmov3QAAAEU"]
[Sun Nov 23 16:44:15.680614 2025] [:error] [pid 38739:tid 38782] [client 140.99.1.26:60449] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Nov 23 16:44:16.073912 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.26:60449] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSLJYAdvEgJm2n2cDmov9QAAAFY"]
[Sun Nov 23 16:44:16.719233 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.67:60345] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Nov 23 16:44:16.836663 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.67:60345] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSLJYNiQFwsyXQDhwyCzaQAAAQo"]
[Sun Nov 23 16:44:18.020527 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.42:35565] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Nov 23 16:44:18.767118 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.42:35565] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSLJYgdvEgJm2n2cDmowIgAAAEI"]
[Sun Nov 23 16:44:19.224206 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.46:62251] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSLJY08WZjXLvbHTHPe67QAAANQ"]
[Sun Nov 23 16:44:19.431615 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.9:48585] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSLJY08WZjXLvbHTHPe68AAAANY"]
[Sun Nov 23 16:44:19.762774 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.53:39481] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSLJY9iQFwsyXQDhwyCziQAAARU"]
[Sun Nov 23 16:44:20.049046 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.5:25163] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSLJZE8WZjXLvbHTHPe6_AAAAMs"]
[Sun Nov 23 16:44:20.239835 2025] [:error] [pid 38824:tid 38851] [client 140.99.1.31:24487] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSLJZE8WZjXLvbHTHPe7BAAAANg"]
[Sun Nov 23 16:44:20.996256 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.11:41529] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSLJZA13QPZSi6O8umWedAAAAIA"]
[Sun Nov 23 16:44:21.364667 2025] [:error] [pid 14602:tid 14645] [client 140.99.1.68:61077] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Nov 23 16:44:21.904947 2025] [:error] [pid 14602:tid 14625] [client 140.99.1.68:61077] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aSLJZR-I77jdD81pU-mfugAAAUQ"]
[Sun Nov 23 16:44:22.492590 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.33:28485] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSLJZtiQFwsyXQDhwyCzzwAAAQ8"]
[Sun Nov 23 16:44:22.880839 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.38:48247] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSLJZg13QPZSi6O8umWeowAAAIM"]
[Sun Nov 23 16:44:23.132408 2025] [:error] [pid 38824:tid 38835] [client 140.99.1.24:52341] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Nov 23 16:44:23.285145 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.24:52341] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSLJZ08WZjXLvbHTHPe7OgAAAME"]
[Sun Nov 23 16:44:23.637039 2025] [:error] [pid 16066:tid 16078] [client 140.99.1.17:47931] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Nov 23 16:44:29.974073 2025] [:error] [pid 16066:tid 16088] [client 140.99.1.17:47931] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Nov 23 16:44:30.334567 2025] [:error] [pid 16066:tid 16078] [client 140.99.1.17:47931] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSLJbvq-c47Q5mW5E9FxAgAAAYk"]
[Sun Nov 23 16:44:30.775925 2025] [:error] [pid 14602:tid 14644] [client 140.99.1.74:38503] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Nov 23 16:44:30.949539 2025] [:error] [pid 14602:tid 14630] [client 140.99.1.74:38503] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSLJbh-I77jdD81pU-mgZQAAAUk"]
[Sun Nov 23 16:44:31.164342 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.71:26675] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Nov 23 16:44:31.484604 2025] [:error] [pid 44652:tid 44709] [client 140.99.1.71:26675] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSLJb9iQFwsyXQDhwyC0ZgAAAQM"]
[Sun Nov 23 16:44:31.806819 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.44:42877] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSLJbwytc6TL9XavPmMDRQAAAAs"]
[Sun Nov 23 16:44:32.253535 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.63:28345] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Nov 23 16:44:32.386829 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.63:28345] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Nov 23 16:44:33.001359 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.63:28345] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSLJcE8WZjXLvbHTHPe79wAAANM"]
[Sun Nov 23 16:44:33.399346 2025] [:error] [pid 14602:tid 14642] [client 140.99.1.47:53247] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSLJcR-I77jdD81pU-mghAAAAVU"]
[Sun Nov 23 16:44:33.815084 2025] [:error] [pid 14602:tid 14633] [client 140.99.1.31:32643] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSLJcR-I77jdD81pU-mgiAAAAUw"]
[Sun Nov 23 16:44:34.086012 2025] [:error] [pid 16066:tid 16070] [client 140.99.1.44:42779] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSLJcvq-c47Q5mW5E9FxRwAAAYE"]
[Sun Nov 23 16:44:34.296843 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.30:64879] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSLJcgdvEgJm2n2cDmoxtAAAAE8"]
[Sun Nov 23 16:44:34.892398 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.75:35467] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Nov 23 16:44:35.021040 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.75:35467] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSLJcw13QPZSi6O8umWftQAAAIc"]
[Sun Nov 23 16:44:35.242392 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.33:61951] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSLJc9iQFwsyXQDhwyC0twAAAQo"]
[Sun Nov 23 16:44:35.446803 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.7:59383] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSLJc9iQFwsyXQDhwyC0vgAAAQo"]
[Sun Nov 23 16:44:36.978865 2025] [:error] [pid 14602:tid 14629] [client 140.99.1.72:24889] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Nov 23 16:44:37.217861 2025] [:error] [pid 14602:tid 14633] [client 140.99.1.72:24889] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Nov 23 16:44:37.783286 2025] [:error] [pid 14602:tid 14645] [client 140.99.1.72:24889] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSLJdR-I77jdD81pU-mgtAAAAVg"]
[Sun Nov 23 16:44:38.849735 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.76:40139] [client 140.99.1.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.76, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSLJdtiQFwsyXQDhwyC1GgAAAQ0"]
[Sun Nov 23 16:44:39.036444 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.76:40139] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Nov 23 16:44:39.624136 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.76:40139] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Nov 23 16:44:39.745529 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.76:40139] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Nov 23 16:44:40.442761 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.76:40139] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSLJeNiQFwsyXQDhwyC1WQAAAQ0"]
[Sun Nov 23 16:44:40.931890 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.46:39203] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Nov 23 16:44:41.137787 2025] [:error] [pid 38738:tid 38751] [client 140.99.1.46:39203] [client 140.99.1.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.46, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSLJeQytc6TL9XavPmMD8wAAAAk"]
[Sun Nov 23 16:44:41.465980 2025] [:error] [pid 38738:tid 38747] [client 140.99.1.46:39203] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSLJeQytc6TL9XavPmMD-wAAAAU"]
[Sun Nov 23 16:44:42.313633 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.75:38553] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Nov 23 16:44:42.619167 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.75:38553] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Nov 23 16:44:42.911228 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.75:38553] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSLJetiQFwsyXQDhwyC1lQAAAQU"]
[Sun Nov 23 16:44:44.213993 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.8:49325] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Nov 23 16:44:44.980132 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.8:49325] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Nov 23 16:44:45.258104 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.8:49325] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Nov 23 16:44:45.483809 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.8:49325] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Nov 23 16:44:45.652984 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.8:49325] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSLJfdiQFwsyXQDhwyC18AAAAQk"]
[Sun Nov 23 16:44:45.943563 2025] [:error] [pid 14602:tid 14635] [client 140.99.1.32:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Nov 23 16:44:46.066842 2025] [:error] [pid 14602:tid 14626] [client 140.99.1.32:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Nov 23 16:44:46.244998 2025] [:error] [pid 14602:tid 14639] [client 140.99.1.32:63555] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSLJfh-I77jdD81pU-mhQgAAAVI"]
[Sun Nov 23 16:44:46.563695 2025] [:error] [pid 16066:tid 16070] [client 140.99.1.73:29149] [client 140.99.1.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/content.php"] [unique_id "aSLJfvq-c47Q5mW5E9FyCQAAAYE"]
[Sun Nov 23 16:44:46.910038 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.16:59283] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Nov 23 16:44:47.234872 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.16:59283] [client 140.99.1.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.16, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSLJfw13QPZSi6O8umWg8QAAAJU"]
[Sun Nov 23 16:44:47.407016 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.16:59283] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSLJfw13QPZSi6O8umWg-QAAAIM"]
[Sun Nov 23 16:44:49.263905 2025] [:error] [pid 14602:tid 14624] [client 140.99.1.49:49303] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Nov 23 16:44:59.311534 2025] [:error] [pid 14602:tid 14627] [client 140.99.1.49:49303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Nov 23 16:44:59.443417 2025] [:error] [pid 14602:tid 14641] [client 140.99.1.49:49303] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSLJix-I77jdD81pU-miJAAAAVQ"]
[Sun Nov 23 16:44:59.679254 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.42:39965] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Nov 23 16:45:00.098313 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.42:39965] [client 140.99.1.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.42, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSLJjAdvEgJm2n2cDmozWwAAAFE"]
[Sun Nov 23 16:45:00.595849 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.42:39965] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Nov 23 16:45:00.792679 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.42:39965] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Nov 23 16:45:00.977306 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.42:39965] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Nov 23 16:45:01.130657 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.42:39965] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSLJjQdvEgJm2n2cDmozZAAAAEs"]
[Sun Nov 23 16:45:01.349054 2025] [:error] [pid 38740:tid 38814] [client 140.99.1.49:29681] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Nov 23 16:45:01.487642 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.49:29681] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSLJjQ13QPZSi6O8umWi4QAAAIs"]
[Sun Nov 23 16:45:02.033051 2025] [:error] [pid 16066:tid 16089] [client 140.99.1.77:49153] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Nov 23 16:45:02.174358 2025] [:error] [pid 16066:tid 16089] [client 140.99.1.77:49153] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSLJjvq-c47Q5mW5E9F0HQAAAZQ"]
[Sun Nov 23 16:45:02.873361 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.67:59979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Nov 23 16:45:03.044269 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.67:59979] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSLJjg13QPZSi6O8umWjCwAAAIM"]
[Sun Nov 23 16:45:03.250131 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.17:48591] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSLJj08WZjXLvbHTHPe9xgAAANU"]
[Sun Nov 23 16:45:03.550036 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.78:25105] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Nov 23 16:45:03.745908 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.78:25105] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Nov 23 16:45:04.958288 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.78:25105] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSLJkE8WZjXLvbHTHPe92gAAAMs"]
[Sun Nov 23 16:45:05.585908 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.20:58035] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSLJkQdvEgJm2n2cDmozkAAAAEw"]
[Sun Nov 23 16:45:06.527243 2025] [:error] [pid 16066:tid 16070] [client 140.99.1.38:54003] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSLJkvq-c47Q5mW5E9F00wAAAYE"]
[Sun Nov 23 16:45:06.755216 2025] [:error] [pid 14602:tid 14638] [client 140.99.1.10:33163] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Nov 23 16:45:07.141057 2025] [:error] [pid 14602:tid 14641] [client 140.99.1.10:33163] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Nov 23 16:45:07.342896 2025] [:error] [pid 14602:tid 14644] [client 140.99.1.10:33163] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSLJkx-I77jdD81pU-mifwAAAVc"]
[Sun Nov 23 16:45:07.565988 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.27:42689] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Nov 23 16:45:07.826013 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.27:42689] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSLJk08WZjXLvbHTHPe9_QAAAMY"]
[Sun Nov 23 16:45:08.494188 2025] [:error] [pid 38739:tid 38773] [client 140.99.1.74:52465] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSLJlAdvEgJm2n2cDmozwwAAAEQ"]
[Sun Nov 23 16:45:08.883322 2025] [:error] [pid 16066:tid 16069] [client 140.99.1.33:64511] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Nov 23 16:45:09.295469 2025] [:error] [pid 16066:tid 16088] [client 140.99.1.33:64511] [client 140.99.1.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aSLJlfq-c47Q5mW5E9F1MgAAAZM"]
[Sun Nov 23 16:45:09.587339 2025] [:error] [pid 16066:tid 16073] [client 140.99.1.33:36493] [client 140.99.1.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aSLJlfq-c47Q5mW5E9F1QQAAAYQ"]
[Sun Nov 23 16:45:09.855774 2025] [:error] [pid 14602:tid 14642] [client 140.99.1.20:46643] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Nov 23 16:45:10.121797 2025] [:error] [pid 14602:tid 14638] [client 140.99.1.20:46643] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Nov 23 16:45:10.361005 2025] [:error] [pid 14602:tid 14628] [client 140.99.1.20:46643] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSLJlh-I77jdD81pU-miswAAAUc"]
[Sun Nov 23 16:45:10.554715 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.24:61247] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSLJlg13QPZSi6O8umWjuwAAAIA"]
[Sun Nov 23 16:45:10.780094 2025] [:error] [pid 44652:tid 44726] [client 140.99.1.28:38235] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSLJltiQFwsyXQDhwyC35QAAARQ"]
[Sun Nov 23 16:45:11.043054 2025] [:error] [pid 14602:tid 14636] [client 140.99.1.9:36519] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSLJlx-I77jdD81pU-mivwAAAU8"]
[Sun Nov 23 16:45:11.291850 2025] [:error] [pid 16066:tid 16069] [client 140.99.1.62:52817] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Nov 23 16:45:11.410696 2025] [:error] [pid 16066:tid 16080] [client 140.99.1.62:52817] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSLJl_q-c47Q5mW5E9F1hwAAAYs"]
[Sun Nov 23 16:45:11.674435 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.75:33243] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSLJlwdvEgJm2n2cDmo0FAAAAEg"]
[Sun Nov 23 16:45:11.910560 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.53:61069] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Nov 23 16:45:12.227058 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.53:61069] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSLJmE8WZjXLvbHTHPe-OwAAAMI"]
[Sun Nov 23 16:45:12.448017 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.15:59891] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSLJmE8WZjXLvbHTHPe-RQAAAM4"]
[Sun Nov 23 16:45:12.658559 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.69:28329] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSLJmA13QPZSi6O8umWj3wAAAIs"]
[Sun Nov 23 16:45:13.008261 2025] [:error] [pid 16066:tid 16069] [client 140.99.1.78:40653] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSLJmPq-c47Q5mW5E9F1pQAAAYA"]
[Sun Nov 23 16:45:13.363682 2025] [:error] [pid 38740:tid 38814] [client 140.99.1.38:44549] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSLJmQ13QPZSi6O8umWj7QAAAJI"]
[Sun Nov 23 16:45:14.179827 2025] [:error] [pid 44652:tid 44723] [client 140.99.1.26:27145] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSLJmtiQFwsyXQDhwyC4PgAAARE"]
[Sun Nov 23 16:45:14.434424 2025] [:error] [pid 16066:tid 16078] [client 140.99.1.24:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Nov 23 16:45:14.896872 2025] [:error] [pid 16066:tid 16071] [client 140.99.1.24:60163] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Nov 23 16:45:15.027005 2025] [:error] [pid 16066:tid 16069] [client 140.99.1.24:60163] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSLJm_q-c47Q5mW5E9F1twAAAYA"]
[Sun Nov 23 16:45:15.413373 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.65:63625] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sun Nov 23 16:45:15.560598 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.65:63625] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Nov 23 16:45:16.435525 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.65:63625] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSLJnE8WZjXLvbHTHPe-kwAAAMs"]
[Sun Nov 23 16:45:17.084330 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.18:61851] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSLJndiQFwsyXQDhwyC4iwAAARI"]
[Sun Nov 23 16:45:17.299734 2025] [:error] [pid 38824:tid 38838] [client 140.99.1.28:53925] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSLJnU8WZjXLvbHTHPe-pwAAAMs"]
[Sun Nov 23 16:45:18.426464 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.49:41001] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSLJnk8WZjXLvbHTHPe-uQAAAM0"]
[Sun Nov 23 16:45:19.940263 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.78:41007] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Nov 23 16:45:20.078463 2025] [:error] [pid 38738:tid 38752] [client 140.99.1.78:41007] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Nov 23 16:45:20.260124 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.78:41007] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Nov 23 16:45:20.395607 2025] [:error] [pid 38738:tid 38764] [client 140.99.1.78:41007] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Nov 23 16:45:21.221047 2025] [:error] [pid 38738:tid 38751] [client 140.99.1.78:41007] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSLJoQytc6TL9XavPmMH4gAAAAk"]
[Sun Nov 23 16:45:21.516415 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.7:55219] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSLJoU8WZjXLvbHTHPe-2QAAAMw"]
[Sun Nov 23 16:45:21.899135 2025] [:error] [pid 16066:tid 16080] [client 140.99.1.13:65175] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSLJofq-c47Q5mW5E9F2XgAAAYs"]
[Sun Nov 23 16:45:22.253741 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.68:56677] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSLJok8WZjXLvbHTHPe-4QAAAM4"]
[Sun Nov 23 16:45:22.501800 2025] [:error] [pid 16066:tid 16069] [client 140.99.1.3:29163] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSLJovq-c47Q5mW5E9F2aAAAAYA"]
[Sun Nov 23 16:45:22.724151 2025] [:error] [pid 16066:tid 16069] [client 140.99.1.50:65367] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSLJovq-c47Q5mW5E9F2bQAAAYA"]
[Sun Nov 23 16:45:23.193885 2025] [:error] [pid 38740:tid 38802] [client 140.99.1.8:25265] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSLJow13QPZSi6O8umWk7wAAAIY"]
[Sun Nov 23 16:45:23.500040 2025] [:error] [pid 16066:tid 16074] [client 140.99.1.50:46561] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSLJo_q-c47Q5mW5E9F2eAAAAYU"]
[Sun Nov 23 16:45:23.703849 2025] [:error] [pid 16066:tid 16077] [client 140.99.1.26:31623] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSLJo_q-c47Q5mW5E9F2fQAAAYg"]
[Sun Nov 23 16:45:23.969072 2025] [:error] [pid 16066:tid 16089] [client 140.99.1.69:39953] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSLJo_q-c47Q5mW5E9F2gQAAAZQ"]
[Sun Nov 23 16:45:24.544945 2025] [:error] [pid 14602:tid 14623] [client 140.99.1.31:33999] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSLJpB-I77jdD81pU-mjoAAAAUI"]
[Sun Nov 23 16:45:25.162252 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.77:37253] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSLJpQytc6TL9XavPmMIZAAAAAI"]
[Sun Nov 23 16:45:25.446417 2025] [:error] [pid 38740:tid 38804] [client 140.99.1.47:27931] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Nov 23 16:45:25.802829 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.47:27931] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSLJpQ13QPZSi6O8umWlQQAAAIA"]
[Sun Nov 23 16:45:26.372102 2025] [:error] [pid 14602:tid 14627] [client 140.99.1.63:57111] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSLJph-I77jdD81pU-mjwAAAAUY"]
[Sun Nov 23 16:45:27.149209 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.8:22155] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Nov 23 16:45:27.294533 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.8:22155] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSLJpw13QPZSi6O8umWlbQAAAIw"]
[Sun Nov 23 16:45:27.854729 2025] [:error] [pid 44652:tid 44708] [client 140.99.1.75:39551] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Nov 23 16:45:28.085262 2025] [:error] [pid 44652:tid 44707] [client 140.99.1.75:39551] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Nov 23 16:45:28.201876 2025] [:error] [pid 44652:tid 44708] [client 140.99.1.75:39551] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Nov 23 16:45:28.299174 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.75:39551] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSLJqNiQFwsyXQDhwyC5pQAAAQc"]
[Sun Nov 23 16:45:28.549860 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.11:20749] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Nov 23 16:45:28.648859 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.11:20749] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSLJqAdvEgJm2n2cDmo1yAAAAEU"]
[Sun Nov 23 16:45:29.258183 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.6:61809] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Nov 23 16:45:29.447282 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.6:61809] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Nov 23 16:45:29.668221 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.6:61809] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Nov 23 16:45:30.456148 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.6:61809] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Nov 23 16:45:30.708208 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.6:61809] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Nov 23 16:45:30.990931 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.6:61809] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sun Nov 23 16:45:31.524770 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.6:61809] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Nov 23 16:45:31.641218 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.6:61809] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSLJqw13QPZSi6O8umWl0AAAAI8"]
[Sun Nov 23 16:45:31.932891 2025] [:error] [pid 14602:tid 14644] [client 140.99.1.52:24875] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSLJqx-I77jdD81pU-mkPgAAAVc"]
[Sun Nov 23 16:45:32.261411 2025] [:error] [pid 14602:tid 14629] [client 140.99.1.26:29567] [client 140.99.1.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.26, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aSLJrB-I77jdD81pU-mkSQAAAUg"]
[Sun Nov 23 16:45:32.264183 2025] [:error] [pid 14602:tid 14629] [client 140.99.1.26:29567] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Nov 23 16:45:32.448092 2025] [:error] [pid 14602:tid 14626] [client 140.99.1.26:29567] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Nov 23 16:45:32.644023 2025] [:error] [pid 14602:tid 14630] [client 140.99.1.26:29567] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSLJrB-I77jdD81pU-mkUwAAAUk"]
[Sun Nov 23 16:45:33.072333 2025] [:error] [pid 38738:tid 38759] [client 140.99.1.52:28075] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Nov 23 16:45:33.284989 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.52:28075] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSLJrQytc6TL9XavPmMJJAAAABM"]
[Sun Nov 23 16:45:33.513385 2025] [:error] [pid 16066:tid 16074] [client 140.99.1.20:40569] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSLJrfq-c47Q5mW5E9F3cAAAAYU"]
[Sun Nov 23 16:45:34.473745 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.69:46409] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSLJrk8WZjXLvbHTHPfAMQAAANQ"]
[Sun Nov 23 16:45:34.758002 2025] [:error] [pid 38824:tid 38832] [client 140.99.1.67:53027] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aSLJrk8WZjXLvbHTHPfAOQAAAMU"]
[Sun Nov 23 16:45:35.515346 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.49:42977] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Nov 23 16:45:35.901891 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.49:42977] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSLJrwdvEgJm2n2cDmo2eQAAAEg"]
[Sun Nov 23 16:45:36.625298 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.77:51381] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sun Nov 23 16:45:37.153973 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.77:51381] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/function.php"] [unique_id "aSLJsQytc6TL9XavPmMJcwAAAAM"]
[Sun Nov 23 16:45:37.440769 2025] [:error] [pid 14602:tid 14625] [client 140.99.1.63:24515] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSLJsR-I77jdD81pU-mkmwAAAUQ"]
[Sun Nov 23 16:45:37.950210 2025] [:error] [pid 16066:tid 16082] [client 140.99.1.47:26085] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sun Nov 23 16:45:38.233327 2025] [:error] [pid 16066:tid 16074] [client 140.99.1.47:26085] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSLJsvq-c47Q5mW5E9F3_AAAAYU"]
[Sun Nov 23 16:45:38.455317 2025] [:error] [pid 16066:tid 16092] [client 140.99.1.65:52977] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSLJsvq-c47Q5mW5E9F4AgAAAZc"]
[Sun Nov 23 16:45:38.942148 2025] [:error] [pid 16066:tid 16071] [client 140.99.1.18:27759] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sun Nov 23 16:45:39.175170 2025] [:error] [pid 16066:tid 16084] [client 140.99.1.18:27759] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Nov 23 16:45:39.518626 2025] [:error] [pid 16066:tid 16086] [client 140.99.1.18:27759] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Nov 23 16:45:39.716486 2025] [:error] [pid 16066:tid 16074] [client 140.99.1.18:27759] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSLJs_q-c47Q5mW5E9F4LAAAAYU"]
[Sun Nov 23 16:45:40.098751 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.17:30201] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSLJswdvEgJm2n2cDmo2wwAAAEE"]
[Sun Nov 23 16:45:40.984078 2025] [:error] [pid 16066:tid 16090] [client 140.99.1.33:54073] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Nov 23 16:45:41.128875 2025] [:error] [pid 16066:tid 16072] [client 140.99.1.33:54073] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSLJtfq-c47Q5mW5E9F4VgAAAYM"]
[Sun Nov 23 16:45:41.405181 2025] [:error] [pid 14602:tid 14643] [client 140.99.1.30:38959] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSLJtR-I77jdD81pU-mk9gAAAVY"]
[Sun Nov 23 16:45:41.609186 2025] [:error] [pid 16066:tid 16091] [client 140.99.1.65:34181] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSLJtfq-c47Q5mW5E9F4YQAAAZY"]
[Sun Nov 23 16:45:42.320916 2025] [:error] [pid 38739:tid 38789] [client 140.99.1.38:62481] [client 140.99.1.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fonts/database.php"] [unique_id "aSLJtgdvEgJm2n2cDmo2-QAAAFQ"]
[Sun Nov 23 16:45:42.676676 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.39:21031] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Sun Nov 23 16:45:42.885463 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.39:21031] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSLJttiQFwsyXQDhwyC6lwAAARA"]
[Sun Nov 23 16:45:43.375080 2025] [:error] [pid 14602:tid 14640] [client 140.99.1.74:58609] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSLJtx-I77jdD81pU-mlJAAAAVM"]
[Sun Nov 23 16:45:43.591459 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.37:38767] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Nov 23 16:45:43.713959 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.37:38767] [client 140.99.1.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-atom.php"] [unique_id "aSLJtwdvEgJm2n2cDmo3EAAAAEg"]
[Sun Nov 23 16:45:43.956273 2025] [:error] [pid 17534:tid 17560] [client 140.99.1.20:44559] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sun Nov 23 16:45:44.374318 2025] [:error] [pid 17534:tid 17550] [client 140.99.1.20:44559] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Nov 23 16:45:44.945901 2025] [:error] [pid 17534:tid 17540] [client 140.99.1.20:44559] [client 140.99.1.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.20, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/js/wp-login.php"] [unique_id "aSLJuHPX9nXBrhgM8swqDwAAAcQ"]
[Sun Nov 23 16:45:45.312111 2025] [:error] [pid 17534:tid 17552] [client 140.99.1.20:44559] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sun Nov 23 16:45:45.505531 2025] [:error] [pid 17534:tid 17541] [client 140.99.1.20:44559] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sun Nov 23 16:45:45.623225 2025] [:error] [pid 17534:tid 17551] [client 140.99.1.20:44559] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sun Nov 23 16:45:46.020285 2025] [:error] [pid 17534:tid 17539] [client 140.99.1.20:44559] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSLJuXPX9nXBrhgM8swqJgAAAcM"]
[Sun Nov 23 16:45:46.267013 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.77:59591] [client 140.99.1.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.77, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSLJutiQFwsyXQDhwyC62AAAARg"]
[Sun Nov 23 16:45:46.668316 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.77:59591] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Nov 23 16:45:46.876869 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.77:59591] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Nov 23 16:45:47.169570 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.77:59591] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sun Nov 23 16:45:47.462816 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.77:59591] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Nov 23 16:45:47.803444 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.77:59591] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sun Nov 23 16:45:48.233629 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.77:59591] [client 140.99.1.77] ModSecurity: collection_store: Failed to access DBM file "/tmp/ip": Resource deadlock avoided [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index.html"] [unique_id "aSLJvNiQFwsyXQDhwyC6-gAAAQ8"]
[Sun Nov 23 16:45:48.970006 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.77:59591] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Nov 23 16:45:49.900376 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.77:59591] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Sun Nov 23 16:45:51.044975 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.77:59591] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sun Nov 23 16:45:51.299050 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.77:59591] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSLJv9iQFwsyXQDhwyC7JQAAARI"]
[Sun Nov 23 16:45:52.378263 2025] [:error] [pid 17534:tid 17550] [client 140.99.1.5:60859] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sun Nov 23 16:45:52.528016 2025] [:error] [pid 17534:tid 17545] [client 140.99.1.5:60859] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSLJwHPX9nXBrhgM8swqfgAAAck"]
[Sun Nov 23 16:45:52.878503 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.47:40239] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Nov 23 16:45:53.019996 2025] [:error] [pid 38738:tid 38751] [client 140.99.1.47:40239] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSLJwAytc6TL9XavPmMKwAAAAAk"]
[Sun Nov 23 16:45:53.612085 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.33:34615] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sun Nov 23 16:45:54.033341 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.33:34615] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sun Nov 23 16:45:54.292368 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.33:34615] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sun Nov 23 16:45:54.442505 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.33:34615] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sun Nov 23 16:45:54.750977 2025] [:error] [pid 38738:tid 38753] [client 140.99.1.33:34615] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSLJwgytc6TL9XavPmMK3wAAAAs"]
[Sun Nov 23 16:45:54.952558 2025] [:error] [pid 14602:tid 14645] [client 140.99.1.7:53063] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Sun Nov 23 16:45:55.092067 2025] [:error] [pid 14602:tid 14637] [client 140.99.1.7:53063] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sun Nov 23 16:45:55.231734 2025] [:error] [pid 14602:tid 14636] [client 140.99.1.7:53063] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSLJwx-I77jdD81pU-mlxQAAAU8"]
[Sun Nov 23 16:45:55.607749 2025] [:error] [pid 17534:tid 17542] [client 140.99.1.75:36713] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSLJw3PX9nXBrhgM8swqwAAAAcY"]
[Sun Nov 23 16:45:56.077567 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.50:41453] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Nov 23 16:45:56.515617 2025] [:error] [pid 38739:tid 38790] [client 140.99.1.50:41453] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sun Nov 23 16:45:56.630663 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.50:41453] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sun Nov 23 16:45:56.728784 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.50:41453] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSLJxAdvEgJm2n2cDmo3hgAAAEY"]
[Sun Nov 23 16:45:56.989840 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.76:44651] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSLJxNiQFwsyXQDhwyC7qAAAAQs"]
[Sun Nov 23 16:45:59.038651 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.48:22331] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sun Nov 23 16:45:59.260967 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.48:22331] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSLJxwdvEgJm2n2cDmo3sgAAAFM"]
[Sun Nov 23 16:45:59.768630 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.18:53599] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aSLJxw13QPZSi6O8umWoBgAAAJQ"]
[Sun Nov 23 16:46:00.222985 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.28:29165] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Nov 23 16:46:00.462682 2025] [:error] [pid 44652:tid 44726] [client 140.99.1.28:29165] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sun Nov 23 16:46:00.620724 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.28:29165] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSLJyNiQFwsyXQDhwyC8GAAAARc"]
[Sun Nov 23 16:46:01.027927 2025] [:error] [pid 44652:tid 44706] [client 140.99.1.17:48211] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sun Nov 23 16:46:01.167234 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.17:48211] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Sun Nov 23 16:46:01.434796 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.17:48211] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Nov 23 16:46:01.802328 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.17:48211] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSLJydiQFwsyXQDhwyC8VAAAARM"]
[Sun Nov 23 16:46:02.068270 2025] [:error] [pid 14602:tid 14645] [client 140.99.1.8:45389] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sun Nov 23 16:46:02.486315 2025] [:error] [pid 14602:tid 14628] [client 140.99.1.8:45389] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSLJyh-I77jdD81pU-mmEwAAAUc"]
[Sun Nov 23 16:46:02.817614 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.10:50741] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Sun Nov 23 16:46:03.295409 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.10:50741] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sun Nov 23 16:46:03.461120 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.10:50741] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Nov 23 16:46:03.694598 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.10:50741] [client 140.99.1.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.10, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSLJywytc6TL9XavPmMLgwAAABQ"]
[Sun Nov 23 16:46:04.364372 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.10:50741] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSLJzAytc6TL9XavPmMLlwAAAA8"]
[Sun Nov 23 16:46:04.727688 2025] [:error] [pid 16066:tid 16075] [client 140.99.1.7:44683] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Sun Nov 23 16:46:04.829903 2025] [:error] [pid 16066:tid 16083] [client 140.99.1.7:44683] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSLJzPq-c47Q5mW5E9F5zwAAAY4"]
[Sun Nov 23 16:46:05.069571 2025] [:error] [pid 14602:tid 14621] [client 140.99.1.5:63083] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Nov 23 16:46:05.293058 2025] [:error] [pid 14602:tid 14645] [client 140.99.1.5:63083] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Nov 23 16:46:05.538285 2025] [:error] [pid 14602:tid 14645] [client 140.99.1.5:63083] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSLJzR-I77jdD81pU-mmKwAAAVg"]
[Sun Nov 23 16:46:05.852016 2025] [:error] [pid 17534:tid 17552] [client 140.99.1.24:56119] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sun Nov 23 16:46:14.640018 2025] [:error] [pid 17534:tid 17552] [client 140.99.1.24:56119] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sun Nov 23 16:46:14.923825 2025] [:error] [pid 17534:tid 17552] [client 140.99.1.24:56119] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSLJ1nPX9nXBrhgM8swsYQAAAdA"]
[Sun Nov 23 16:46:15.364887 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.39:56793] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSLJ1w13QPZSi6O8umWpFQAAAIE"]
[Sun Nov 23 16:46:15.555471 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.49:42435] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Sun Nov 23 16:46:15.674204 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.49:42435] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sun Nov 23 16:46:15.972955 2025] [:error] [pid 38739:tid 38774] [client 140.99.1.49:42435] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSLJ1wdvEgJm2n2cDmo4iAAAAEU"]
[Sun Nov 23 16:46:16.231248 2025] [:error] [pid 16066:tid 16082] [client 140.99.1.44:49785] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sun Nov 23 16:46:16.473351 2025] [:error] [pid 16066:tid 16073] [client 140.99.1.44:49785] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Sun Nov 23 16:46:16.592934 2025] [:error] [pid 16066:tid 16071] [client 140.99.1.44:49785] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSLJ2Pq-c47Q5mW5E9F6pgAAAYI"]
[Sun Nov 23 16:46:16.928925 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.77:61129] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/db.php"] [unique_id "aSLJ2NiQFwsyXQDhwyC9YAAAAQc"]
[Sun Nov 23 16:46:17.171649 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.8:47943] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSLJ2QdvEgJm2n2cDmo4mwAAAFY"]
[Sun Nov 23 16:46:17.427823 2025] [:error] [pid 17534:tid 17550] [client 140.99.1.38:41537] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSLJ2XPX9nXBrhgM8swslwAAAc4"]
[Sun Nov 23 16:46:17.661919 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.76:57161] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSLJ2U8WZjXLvbHTHPfCnAAAAMY"]
[Sun Nov 23 16:46:17.853943 2025] [:error] [pid 17534:tid 17540] [client 140.99.1.28:65445] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSLJ2XPX9nXBrhgM8swsngAAAcQ"]
[Sun Nov 23 16:46:18.239299 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.46:31563] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSLJ2k8WZjXLvbHTHPfCqQAAANI"]
[Sun Nov 23 16:46:19.044689 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.53:53285] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSLJ208WZjXLvbHTHPfCwAAAANI"]
[Sun Nov 23 16:46:19.376060 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.28:48765] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSLJ208WZjXLvbHTHPfCxAAAAMA"]
[Sun Nov 23 16:46:19.570471 2025] [:error] [pid 17534:tid 17556] [client 140.99.1.18:39241] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSLJ23PX9nXBrhgM8swsrgAAAdQ"]
[Sun Nov 23 16:46:20.433471 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.49:41299] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSLJ3E8WZjXLvbHTHPfC0AAAANU"]
[Sun Nov 23 16:46:22.958086 2025] [:error] [pid 38739:tid 38781] [client 140.99.1.38:32063] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSLJ3gdvEgJm2n2cDmo4_gAAAEw"]
[Sun Nov 23 16:46:23.207616 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.8:54181] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sun Nov 23 16:46:23.806876 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.8:54181] [client 140.99.1.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.8, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSLJ308WZjXLvbHTHPfC-gAAAM4"]
[Sun Nov 23 16:46:24.507030 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.8:54181] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSLJ4E8WZjXLvbHTHPfDEAAAANM"]
[Sun Nov 23 16:46:24.717485 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.72:47561] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSLJ4A13QPZSi6O8umWpmgAAAJc"]
[Sun Nov 23 16:46:25.389881 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.77:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Nov 23 16:46:25.492643 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.77:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Sun Nov 23 16:46:25.946567 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.77:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sun Nov 23 16:46:26.044832 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.77:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sun Nov 23 16:46:26.557245 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.77:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sun Nov 23 16:46:26.671191 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.77:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sun Nov 23 16:46:26.770206 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.77:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sun Nov 23 16:46:26.916490 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.77:62675] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Sun Nov 23 16:46:27.079768 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.77:62675] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSLJ4w13QPZSi6O8umWpvgAAAJM"]
[Sun Nov 23 16:46:27.317443 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.69:25905] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSLJ4w13QPZSi6O8umWpwwAAAJA"]
[Sun Nov 23 16:46:27.513824 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.24:29687] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSLJ4w13QPZSi6O8umWpxwAAAIU"]
[Sun Nov 23 16:46:27.916270 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.9:54199] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Sun Nov 23 16:46:28.023631 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.9:54199] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sun Nov 23 16:46:28.267922 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.9:54199] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sun Nov 23 16:46:28.517950 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.9:54199] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSLJ5Aytc6TL9XavPmMNEAAAABI"]
[Sun Nov 23 16:46:28.757354 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.43:25279] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSLJ5E8WZjXLvbHTHPfDYgAAAMw"]
[Sun Nov 23 16:46:28.987294 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.33:21071] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSLJ5NiQFwsyXQDhwyC94AAAARc"]
[Sun Nov 23 16:46:29.805874 2025] [:error] [pid 16066:tid 16070] [client 140.99.1.3:49191] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSLJ5fq-c47Q5mW5E9F7ogAAAYE"]
[Sun Nov 23 16:46:30.128310 2025] [:error] [pid 16066:tid 16077] [client 140.99.1.26:63503] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSLJ5vq-c47Q5mW5E9F7qAAAAYg"]
[Sun Nov 23 16:46:30.555971 2025] [:error] [pid 14602:tid 14628] [client 140.99.1.50:61283] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSLJ5h-I77jdD81pU-mnpgAAAUc"]
[Sun Nov 23 16:46:32.943607 2025] [:error] [pid 17534:tid 17553] [client 140.99.1.78:54721] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSLJ6HPX9nXBrhgM8swuJQAAAdE"]
[Sun Nov 23 16:46:33.155134 2025] [:error] [pid 17534:tid 17558] [client 140.99.1.5:48653] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sun Nov 23 16:46:33.535041 2025] [:error] [pid 17534:tid 17555] [client 140.99.1.5:48653] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSLJ6XPX9nXBrhgM8swuPgAAAdM"]
[Sun Nov 23 16:46:34.013096 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.2:39789] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sun Nov 23 16:46:34.936106 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.2:39789] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun Nov 23 16:46:35.125815 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.2:39789] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSLJ6w13QPZSi6O8umWqCwAAAJg"]
[Sun Nov 23 16:46:35.559651 2025] [:error] [pid 16066:tid 16071] [client 140.99.1.13:65349] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSLJ6_q-c47Q5mW5E9F8KgAAAYI"]
[Sun Nov 23 16:46:36.490236 2025] [:error] [pid 16066:tid 16089] [client 140.99.1.68:26541] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSLJ7Pq-c47Q5mW5E9F8PwAAAZQ"]
[Sun Nov 23 16:46:37.497367 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.10:57113] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSLJ7Q13QPZSi6O8umWqIQAAAJM"]
[Sun Nov 23 16:46:37.867451 2025] [:error] [pid 38824:tid 38839] [client 140.99.1.30:28711] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Nov 23 16:46:37.982982 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.30:28711] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSLJ7U8WZjXLvbHTHPfEFgAAAMo"]
[Sun Nov 23 16:46:38.206960 2025] [:error] [pid 14602:tid 14643] [client 140.99.1.6:43521] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSLJ7h-I77jdD81pU-mn-QAAAVY"]
[Sun Nov 23 16:46:39.556158 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.20:61807] [client 140.99.1.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aSLJ7wytc6TL9XavPmMNlgAAAAQ"]
[Sun Nov 23 16:46:40.201236 2025] [:error] [pid 17534:tid 17549] [client 140.99.1.73:63683] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSLJ8HPX9nXBrhgM8swu5QAAAc0"]
[Sun Nov 23 16:46:40.490372 2025] [:error] [pid 16066:tid 16073] [client 140.99.1.50:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sun Nov 23 16:46:40.973978 2025] [:error] [pid 16066:tid 16079] [client 140.99.1.50:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sun Nov 23 16:46:41.129899 2025] [:error] [pid 16066:tid 16087] [client 140.99.1.50:52807] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSLJ8fq-c47Q5mW5E9F8pwAAAZI"]
[Sun Nov 23 16:46:41.674064 2025] [:error] [pid 38738:tid 38754] [client 140.99.1.70:58099] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sun Nov 23 16:46:41.908619 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.70:58099] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSLJ8Qytc6TL9XavPmMNwQAAABI"]
[Sun Nov 23 16:46:42.192723 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.70:26499] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSLJ8g13QPZSi6O8umWqcAAAAI0"]
[Sun Nov 23 16:46:43.129620 2025] [:error] [pid 17534:tid 17550] [client 140.99.1.26:20177] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSLJ83PX9nXBrhgM8swvPwAAAc4"]
[Sun Nov 23 16:46:43.981121 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.2:55215] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSLJ89iQFwsyXQDhwyC-jQAAAQg"]
[Sun Nov 23 16:46:44.257458 2025] [:error] [pid 44652:tid 44730] [client 140.99.1.73:50157] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSLJ9NiQFwsyXQDhwyC-lQAAARg"]
[Sun Nov 23 16:46:44.645070 2025] [:error] [pid 16066:tid 16079] [client 140.99.1.24:51753] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Sun Nov 23 16:46:45.334829 2025] [:error] [pid 16066:tid 16084] [client 140.99.1.24:51753] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSLJ9fq-c47Q5mW5E9F8_QAAAY8"]
[Sun Nov 23 16:46:45.959482 2025] [:error] [pid 17534:tid 17536] [client 140.99.1.18:45761] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSLJ9XPX9nXBrhgM8swvhwAAAcA"]
[Sun Nov 23 16:46:46.161859 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.65:27267] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSLJ9tiQFwsyXQDhwyC-zQAAAQk"]
[Sun Nov 23 16:46:46.583594 2025] [:error] [pid 38824:tid 38844] [client 140.99.1.77:33049] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Nov 23 16:46:46.719886 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.77:33049] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSLJ9k8WZjXLvbHTHPfEvAAAAMQ"]
[Sun Nov 23 16:46:47.090995 2025] [:error] [pid 14602:tid 14632] [client 140.99.1.67:28707] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSLJ9x-I77jdD81pU-mobwAAAUs"]
[Sun Nov 23 16:46:48.391710 2025] [:error] [pid 16066:tid 16086] [client 140.99.1.26:64487] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSLJ-Pq-c47Q5mW5E9F9NwAAAZE"]
[Sun Nov 23 16:46:48.867807 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.69:39159] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sun Nov 23 16:46:49.039993 2025] [:error] [pid 44652:tid 44707] [client 140.99.1.69:39159] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSLJ-diQFwsyXQDhwyC_BQAAAQE"]
[Sun Nov 23 16:46:49.486021 2025] [:error] [pid 16066:tid 16079] [client 140.99.1.30:32773] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSLJ-fq-c47Q5mW5E9F9TwAAAYo"]
[Sun Nov 23 16:46:50.269914 2025] [:error] [pid 44652:tid 44718] [client 140.99.1.15:26347] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/as.php"] [unique_id "aSLJ-tiQFwsyXQDhwyC_QgAAAQw"]
[Sun Nov 23 16:46:50.602798 2025] [:error] [pid 17534:tid 17548] [client 140.99.1.9:36267] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSLJ-nPX9nXBrhgM8swwAwAAAcw"]
[Sun Nov 23 16:46:50.834348 2025] [:error] [pid 14602:tid 14623] [client 140.99.1.32:44523] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/install.php"] [unique_id "aSLJ-h-I77jdD81pU-moqQAAAUI"]
[Sun Nov 23 16:46:51.103038 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.48:51687] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSLJ-wytc6TL9XavPmMOUgAAAA4"]
[Sun Nov 23 16:47:02.160360 2025] [:error] [pid 17534:tid 17558] [client 140.99.1.49:21961] [client 140.99.1.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aSLKBnPX9nXBrhgM8swynwAAAdY"]
[Mon Nov 24 00:24:50.316638 2025] [:error] [pid 1454:tid 1527] [client 176.65.132.18:35302] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aSM1Ureh4NH3skJ5n4RfhgAAAM8"]
[Mon Nov 24 10:29:13.503063 2025] [:error] [pid 49900:tid 49925] [client 45.3.39.134:45783] [client 45.3.39.134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "aSPC-TCyPLrvg06aormz9wAAABc"]
[Mon Nov 24 10:29:15.397328 2025] [:error] [pid 48601:tid 48673] [client 104.207.54.25:9477] [client 104.207.54.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aSPC-4MM4MaVTk74-AZj4gAAAhA"]
[Mon Nov 24 10:29:16.296300 2025] [:error] [pid 49900:tid 49926] [client 216.26.248.215:28915] [client 216.26.248.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.svn/wc.db"] [unique_id "aSPC_DCyPLrvg06aormz_gAAABg"]
[Tue Nov 25 01:32:44.495273 2025] [:error] [pid 48599:tid 48606] [client 85.203.15.34:29157] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Nov 25 01:32:45.799389 2025] [:error] [pid 48599:tid 48627] [client 85.203.15.34:29157] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Nov 25 01:32:46.384815 2025] [:error] [pid 48599:tid 48613] [client 85.203.15.34:29157] [client 85.203.15.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSSWvpzvu6PDJiRKE3J2fwAAAYo"]
[Tue Nov 25 01:32:47.719947 2025] [:error] [pid 16549:tid 16555] [client 85.203.15.186:35687] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Nov 25 01:32:48.308630 2025] [:error] [pid 16549:tid 16572] [client 85.203.15.186:35687] [client 85.203.15.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSSWwKeWW19A99PUw_eIEgAAAVM"]
[Tue Nov 25 01:32:49.549032 2025] [:error] [pid 48601:tid 48662] [client 85.203.15.43:47795] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Nov 25 01:32:52.380006 2025] [:error] [pid 48601:tid 48659] [client 85.203.15.43:47795] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Nov 25 01:32:54.482969 2025] [:error] [pid 48601:tid 48658] [client 85.203.15.43:47795] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Nov 25 01:32:55.019062 2025] [:error] [pid 48601:tid 48671] [client 85.203.15.43:47795] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Nov 25 01:32:56.018994 2025] [:error] [pid 48601:tid 48664] [client 85.203.15.43:47795] [client 85.203.15.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSSWyIMM4MaVTk74-AYTHwAAAgc"]
[Tue Nov 25 01:32:59.324303 2025] [:error] [pid 16593:tid 16612] [client 85.203.15.27:52949] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Nov 25 01:33:00.038893 2025] [:error] [pid 16593:tid 16619] [client 85.203.15.27:52949] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue Nov 25 01:33:00.591065 2025] [:error] [pid 16593:tid 16608] [client 85.203.15.27:52949] [client 85.203.15.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSSWzBVGznHBJI2LKpSNHwAAAo0"]
[Tue Nov 25 01:33:01.519220 2025] [:error] [pid 16441:tid 16449] [client 81.199.26.5:48007] [client 81.199.26.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSSWzYq_bc5MOa9Hflng9gAAAIU"]
[Tue Nov 25 01:33:04.130475 2025] [:error] [pid 48688:tid 48709] [client 85.203.15.27:64313] [client 85.203.15.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSSW0Bm2q1FkzLam7A329AAAAlE"]
[Tue Nov 25 01:33:07.172086 2025] [:error] [pid 49900:tid 49905] [client 85.203.15.40:47081] [client 85.203.15.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSSW0zCyPLrvg06aorl6bgAAAAM"]
[Tue Nov 25 01:33:09.769285 2025] [:error] [pid 49900:tid 49908] [client 85.203.15.23:41781] [client 85.203.15.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSSW1TCyPLrvg06aorl6cgAAAAY"]
[Tue Nov 25 01:33:14.015350 2025] [:error] [pid 48599:tid 48605] [client 85.203.15.183:30843] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Nov 25 01:33:15.840191 2025] [:error] [pid 48599:tid 48613] [client 85.203.15.183:30843] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Nov 25 01:33:16.591959 2025] [:error] [pid 48599:tid 48619] [client 85.203.15.183:30843] [client 85.203.15.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSSW3Jzvu6PDJiRKE3J2jgAAAZA"]
[Tue Nov 25 01:33:22.212569 2025] [:error] [pid 48600:tid 48635] [client 85.203.15.189:35773] [client 85.203.15.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSSW4vtOzSUAQvWVjBfANQAAAcU"]
[Tue Nov 25 01:33:25.315413 2025] [:error] [pid 49900:tid 49905] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Tue Nov 25 01:33:25.850887 2025] [:error] [pid 49900:tid 49919] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Tue Nov 25 01:33:26.358418 2025] [:error] [pid 49900:tid 49911] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Nov 25 01:33:27.090992 2025] [:error] [pid 49900:tid 49908] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Nov 25 01:33:27.606465 2025] [:error] [pid 49900:tid 49909] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Tue Nov 25 01:33:28.199728 2025] [:error] [pid 49900:tid 49910] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Tue Nov 25 01:33:28.833138 2025] [:error] [pid 49900:tid 49906] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Tue Nov 25 01:33:29.584053 2025] [:error] [pid 49900:tid 49918] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Nov 25 01:33:32.122762 2025] [:error] [pid 49900:tid 49904] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Tue Nov 25 01:33:32.942880 2025] [:error] [pid 49900:tid 49913] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Nov 25 01:33:33.566034 2025] [:error] [pid 49900:tid 49915] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Tue Nov 25 01:33:34.498730 2025] [:error] [pid 49900:tid 49902] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Nov 25 01:33:35.167085 2025] [:error] [pid 49900:tid 49907] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Nov 25 01:33:35.836829 2025] [:error] [pid 49900:tid 49923] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Tue Nov 25 01:33:36.317153 2025] [:error] [pid 49900:tid 49914] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Tue Nov 25 01:33:36.877360 2025] [:error] [pid 49900:tid 49920] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Nov 25 01:33:37.520629 2025] [:error] [pid 49900:tid 49912] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Tue Nov 25 01:33:39.008162 2025] [:error] [pid 49900:tid 49926] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Tue Nov 25 01:33:39.691243 2025] [:error] [pid 49900:tid 49921] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Tue Nov 25 01:33:40.139111 2025] [:error] [pid 49900:tid 49905] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Tue Nov 25 01:33:40.655173 2025] [:error] [pid 49900:tid 49919] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Tue Nov 25 01:33:41.173032 2025] [:error] [pid 49900:tid 49911] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Nov 25 01:33:41.951424 2025] [:error] [pid 49900:tid 49908] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Nov 25 01:33:43.590940 2025] [:error] [pid 49900:tid 49909] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Nov 25 01:33:44.079635 2025] [:error] [pid 49900:tid 49910] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Tue Nov 25 01:33:44.754836 2025] [:error] [pid 49900:tid 49906] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Nov 25 01:33:46.790352 2025] [:error] [pid 49900:tid 49917] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Nov 25 01:33:47.472027 2025] [:error] [pid 49900:tid 49904] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Tue Nov 25 01:33:48.005413 2025] [:error] [pid 49900:tid 49913] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Tue Nov 25 01:33:48.697023 2025] [:error] [pid 49900:tid 49907] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Nov 25 01:33:49.119642 2025] [:error] [pid 49900:tid 49923] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Tue Nov 25 01:33:49.707004 2025] [:error] [pid 49900:tid 49914] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Tue Nov 25 01:33:51.580594 2025] [:error] [pid 49900:tid 49916] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Nov 25 01:33:52.000835 2025] [:error] [pid 49900:tid 49926] [client 85.203.15.103:35841] [client 85.203.15.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.103, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aSSW_zCyPLrvg06aorl6pgAAABg"]
[Tue Nov 25 01:33:52.004806 2025] [:error] [pid 49900:tid 49926] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Nov 25 01:33:52.990346 2025] [:error] [pid 49900:tid 49908] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Tue Nov 25 01:33:53.482788 2025] [:error] [pid 49900:tid 49909] [client 85.203.15.103:35841] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Tue Nov 25 01:33:53.931712 2025] [:error] [pid 49900:tid 49910] [client 85.203.15.103:35841] [client 85.203.15.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aSSXATCyPLrvg06aorl6rAAAAAg"]
[Tue Nov 25 01:33:55.138842 2025] [:error] [pid 16593:tid 16602] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Tue Nov 25 01:33:56.569946 2025] [:error] [pid 16593:tid 16615] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Nov 25 01:33:57.590496 2025] [:error] [pid 16593:tid 16601] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Tue Nov 25 01:33:58.279659 2025] [:error] [pid 16593:tid 16610] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Tue Nov 25 01:33:58.937908 2025] [:error] [pid 16593:tid 16597] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Tue Nov 25 01:33:59.744196 2025] [:error] [pid 16593:tid 16597] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Tue Nov 25 01:34:00.608517 2025] [:error] [pid 16593:tid 16596] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Tue Nov 25 01:34:01.078113 2025] [:error] [pid 16593:tid 16616] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Tue Nov 25 01:34:01.960693 2025] [:error] [pid 16593:tid 16607] [client 85.203.15.55:51713] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Tue Nov 25 01:34:05.049060 2025] [:error] [pid 16593:tid 16619] [client 85.203.15.55:51713] [client 85.203.15.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aSSXDRVGznHBJI2LKpSNOgAAApg"]
[Tue Nov 25 01:34:15.618307 2025] [:error] [pid 16516:tid 16519] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Tue Nov 25 01:34:16.093338 2025] [:error] [pid 16516:tid 16526] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Tue Nov 25 01:34:21.208485 2025] [:error] [pid 16516:tid 16527] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Nov 25 01:34:22.058171 2025] [:error] [pid 16516:tid 16521] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Tue Nov 25 01:34:22.593335 2025] [:error] [pid 16516:tid 16528] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/w0.php
[Tue Nov 25 01:34:23.086039 2025] [:error] [pid 16516:tid 16537] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/old-index.php
[Tue Nov 25 01:34:23.551823 2025] [:error] [pid 16516:tid 16530] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Tue Nov 25 01:34:29.375813 2025] [:error] [pid 16516:tid 16541] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Tue Nov 25 01:34:29.919349 2025] [:error] [pid 16516:tid 16540] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Tue Nov 25 01:34:30.500929 2025] [:error] [pid 16516:tid 16536] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Tue Nov 25 01:34:31.175509 2025] [:error] [pid 16516:tid 16520] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Tue Nov 25 01:34:31.720263 2025] [:error] [pid 16516:tid 16527] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Tue Nov 25 01:34:32.357919 2025] [:error] [pid 16516:tid 16535] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Tue Nov 25 01:34:32.901868 2025] [:error] [pid 16516:tid 16521] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Tue Nov 25 01:34:36.633914 2025] [:error] [pid 16516:tid 16542] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Tue Nov 25 01:34:37.124909 2025] [:error] [pid 16516:tid 16530] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Tue Nov 25 01:34:38.083747 2025] [:error] [pid 16516:tid 16533] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Tue Nov 25 01:34:38.750961 2025] [:error] [pid 16516:tid 16532] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Tue Nov 25 01:34:39.272262 2025] [:error] [pid 16516:tid 16519] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Tue Nov 25 01:34:39.832840 2025] [:error] [pid 16516:tid 16524] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue Nov 25 01:34:40.352922 2025] [:error] [pid 16516:tid 16526] [client 85.203.15.37:39283] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Tue Nov 25 01:34:40.804828 2025] [:error] [pid 16516:tid 16522] [client 85.203.15.37:39283] [client 85.203.15.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/lx.php"] [unique_id "aSSXMPqZbniwaNwL8XkuIQAAAQM"]
[Tue Nov 25 01:34:42.978566 2025] [:error] [pid 48599:tid 48615] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Tue Nov 25 01:34:43.435333 2025] [:error] [pid 48599:tid 48609] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Tue Nov 25 01:34:43.902987 2025] [:error] [pid 48599:tid 48603] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Tue Nov 25 01:34:44.423472 2025] [:error] [pid 48599:tid 48626] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Tue Nov 25 01:34:44.992909 2025] [:error] [pid 48599:tid 48611] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Tue Nov 25 01:34:46.361107 2025] [:error] [pid 48599:tid 48620] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Tue Nov 25 01:34:46.938251 2025] [:error] [pid 48599:tid 48608] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Tue Nov 25 01:34:47.575831 2025] [:error] [pid 48599:tid 48617] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Tue Nov 25 01:34:48.022074 2025] [:error] [pid 48599:tid 48625] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Tue Nov 25 01:34:49.039664 2025] [:error] [pid 48599:tid 48616] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Tue Nov 25 01:34:49.619739 2025] [:error] [pid 48599:tid 48618] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Nov 25 01:34:50.352709 2025] [:error] [pid 48599:tid 48614] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Tue Nov 25 01:34:52.073097 2025] [:error] [pid 48599:tid 48622] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Tue Nov 25 01:34:53.841846 2025] [:error] [pid 48599:tid 48624] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Tue Nov 25 01:34:54.365097 2025] [:error] [pid 48599:tid 48604] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Tue Nov 25 01:34:55.120204 2025] [:error] [pid 48599:tid 48613] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Tue Nov 25 01:34:55.680196 2025] [:error] [pid 48599:tid 48615] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Tue Nov 25 01:34:56.210239 2025] [:error] [pid 48599:tid 48610] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Tue Nov 25 01:34:56.672185 2025] [:error] [pid 48599:tid 48603] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Tue Nov 25 01:34:57.576439 2025] [:error] [pid 48599:tid 48620] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Tue Nov 25 01:34:58.023580 2025] [:error] [pid 48599:tid 48608] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Tue Nov 25 01:34:58.590319 2025] [:error] [pid 48599:tid 48617] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Nov 25 01:34:59.148409 2025] [:error] [pid 48599:tid 48625] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Tue Nov 25 01:34:59.871237 2025] [:error] [pid 48599:tid 48622] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Tue Nov 25 01:35:04.145508 2025] [:error] [pid 48599:tid 48604] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Tue Nov 25 01:35:05.703983 2025] [:error] [pid 48599:tid 48607] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Nov 25 01:35:06.304754 2025] [:error] [pid 48599:tid 48613] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Tue Nov 25 01:35:07.742615 2025] [:error] [pid 48599:tid 48612] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Nov 25 01:35:08.224002 2025] [:error] [pid 48599:tid 48610] [client 81.199.26.3:34185] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Tue Nov 25 01:35:26.144881 2025] [:error] [pid 48599:tid 48623] [client 81.199.26.3:34185] [client 81.199.26.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aSSXXpzvu6PDJiRKE3J3EAAAAZQ"]
[Tue Nov 25 01:35:29.148318 2025] [:error] [pid 48600:tid 48635] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-widget-archives.php
[Tue Nov 25 01:35:34.987767 2025] [:error] [pid 48600:tid 48633] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Tue Nov 25 01:35:36.571423 2025] [:error] [pid 48600:tid 48638] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Tue Nov 25 01:35:37.423580 2025] [:error] [pid 48600:tid 48642] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Tue Nov 25 01:35:40.459840 2025] [:error] [pid 48600:tid 48646] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Tue Nov 25 01:35:47.163785 2025] [:error] [pid 48600:tid 48635] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-apxupx.php
[Tue Nov 25 01:35:47.677783 2025] [:error] [pid 48600:tid 48632] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Tue Nov 25 01:35:48.285422 2025] [:error] [pid 48600:tid 48647] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Nov 25 01:35:48.965153 2025] [:error] [pid 48600:tid 48644] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Nov 25 01:35:49.565182 2025] [:error] [pid 48600:tid 48650] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Tue Nov 25 01:35:50.334012 2025] [:error] [pid 48600:tid 48634] [client 85.203.15.253:22263] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Tue Nov 25 01:35:53.153612 2025] [:error] [pid 48600:tid 48636] [client 85.203.15.253:22263] [client 85.203.15.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSSXeftOzSUAQvWVjBfAiwAAAcY"]
[Tue Nov 25 01:35:56.449308 2025] [:error] [pid 16516:tid 16538] [client 85.203.15.71:32335] [client 85.203.15.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.15.71, incrementing ddos counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSXfPqZbniwaNwL8XkuNgAAARM"]
[Tue Nov 25 01:35:56.452923 2025] [:error] [pid 16516:tid 16538] [client 85.203.15.71:32335] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Nov 25 01:35:56.992157 2025] [:error] [pid 16516:tid 16526] [client 85.203.15.71:32335] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Tue Nov 25 01:35:58.349479 2025] [:error] [pid 16516:tid 16536] [client 85.203.15.71:32335] [client 85.203.15.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSSXfvqZbniwaNwL8XkuPgAAARE"]
[Tue Nov 25 01:36:00.211654 2025] [:error] [pid 48599:tid 48614] [client 85.203.15.35:37135] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Tue Nov 25 01:36:19.173882 2025] [:error] [pid 48599:tid 48623] [client 85.203.15.105:60621] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Nov 25 01:36:21.786901 2025] [:error] [pid 48599:tid 48611] [client 85.203.15.105:60621] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Tue Nov 25 01:36:22.474665 2025] [:error] [pid 48599:tid 48620] [client 85.203.15.105:60621] [client 85.203.15.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSSXlpzvu6PDJiRKE3J3OwAAAZE"]
[Tue Nov 25 01:36:23.459722 2025] [:error] [pid 16516:tid 16524] [client 81.199.26.10:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/gebase.php
[Tue Nov 25 01:36:24.184919 2025] [:error] [pid 16516:tid 16522] [client 81.199.26.10:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Tue Nov 25 01:36:25.611054 2025] [:error] [pid 16516:tid 16541] [client 81.199.26.10:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Tue Nov 25 01:36:29.056231 2025] [:error] [pid 16516:tid 16521] [client 81.199.26.10:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Tue Nov 25 01:36:30.084948 2025] [:error] [pid 16516:tid 16537] [client 81.199.26.10:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Nov 25 01:36:30.652322 2025] [:error] [pid 16516:tid 16530] [client 81.199.26.10:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Nov 25 01:36:31.615121 2025] [:error] [pid 16516:tid 16533] [client 81.199.26.10:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add.php
[Tue Nov 25 01:36:36.611857 2025] [:error] [pid 16516:tid 16534] [client 81.199.26.10:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Tue Nov 25 01:36:37.871434 2025] [:error] [pid 16516:tid 16525] [client 81.199.26.10:59035] [client 81.199.26.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSSXpfqZbniwaNwL8XkuXgAAAQY"]
[Tue Nov 25 01:36:38.807863 2025] [:error] [pid 16593:tid 16609] [client 85.203.15.22:30725] [client 85.203.15.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSSXphVGznHBJI2LKpSNiQAAAo4"]
[Tue Nov 25 01:36:40.145636 2025] [:error] [pid 48600:tid 48635] [client 81.199.26.2:41957] [client 81.199.26.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSSXqPtOzSUAQvWVjBfAqAAAAcU"]
[Tue Nov 25 01:36:41.859980 2025] [:error] [pid 16441:tid 16461] [client 85.203.15.55:44459] [client 85.203.15.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSSXqYq_bc5MOa9Hflnh0QAAAJE"]
[Tue Nov 25 01:36:43.820668 2025] [:error] [pid 48688:tid 48692] [client 85.203.15.55:63513] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Tue Nov 25 01:36:44.325196 2025] [:error] [pid 48688:tid 48707] [client 85.203.15.55:63513] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Tue Nov 25 01:36:47.234663 2025] [:error] [pid 48688:tid 48700] [client 85.203.15.55:63513] [client 85.203.15.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.55, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aSSXrxm2q1FkzLam7A33iQAAAkg"]
[Tue Nov 25 01:36:51.808639 2025] [:error] [pid 48688:tid 48706] [client 85.203.15.55:63513] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Nov 25 01:36:53.673036 2025] [:error] [pid 48688:tid 48708] [client 85.203.15.55:63513] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Nov 25 01:36:59.970117 2025] [:error] [pid 48688:tid 48707] [client 85.203.15.55:63513] [client 85.203.15.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSSXuxm2q1FkzLam7A33lwAAAk8"]
[Tue Nov 25 01:37:03.805073 2025] [:error] [pid 9630:tid 9632] [client 85.203.15.7:63105] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Nov 25 01:37:08.349049 2025] [:error] [pid 9630:tid 9639] [client 85.203.15.7:63105] [client 85.203.15.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.7, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSSXxCrSgUgPGkizt2pxKwAAAEc"]
[Tue Nov 25 01:37:08.977781 2025] [:error] [pid 9630:tid 9638] [client 85.203.15.7:63105] File does not exist: /usr/local/apache/htdocs/suspended-page/baxa1.php
[Tue Nov 25 01:37:10.450305 2025] [:error] [pid 9630:tid 9641] [client 85.203.15.7:63105] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Tue Nov 25 01:37:11.040346 2025] [:error] [pid 9630:tid 9650] [client 85.203.15.7:63105] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Tue Nov 25 01:37:12.101453 2025] [:error] [pid 9630:tid 9634] [client 85.203.15.7:63105] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Nov 25 01:37:12.640089 2025] [:error] [pid 9630:tid 9633] [client 85.203.15.7:63105] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Nov 25 01:37:13.279127 2025] [:error] [pid 9630:tid 9632] [client 85.203.15.7:63105] [client 85.203.15.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aSSXySrSgUgPGkizt2pxNgAAAEA"]
[Tue Nov 25 01:37:17.137513 2025] [:error] [pid 16593:tid 16616] [client 81.199.26.2:41281] [client 81.199.26.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSSXzRVGznHBJI2LKpSNkwAAApU"]
[Tue Nov 25 01:37:18.222887 2025] [:error] [pid 16441:tid 16464] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen-667.php
[Tue Nov 25 01:37:18.702148 2025] [:error] [pid 16441:tid 16447] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Tue Nov 25 01:37:19.525518 2025] [:error] [pid 16441:tid 16458] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Nov 25 01:37:20.054136 2025] [:error] [pid 16441:tid 16457] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Nov 25 01:37:21.105047 2025] [:error] [pid 16441:tid 16445] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Tue Nov 25 01:37:23.398292 2025] [:error] [pid 16441:tid 16463] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/zmFM.php
[Tue Nov 25 01:37:31.301873 2025] [:error] [pid 16441:tid 16450] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny.php
[Tue Nov 25 01:37:32.636802 2025] [:error] [pid 16441:tid 16450] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Nov 25 01:37:33.146278 2025] [:error] [pid 16441:tid 16444] [client 81.199.26.10:45733] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Tue Nov 25 01:37:34.977230 2025] [:error] [pid 16441:tid 16465] [client 81.199.26.10:45733] [client 81.199.26.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSSX3oq_bc5MOa9Hflnh_wAAAJU"]
[Tue Nov 25 01:37:38.480241 2025] [:error] [pid 48688:tid 48704] [client 81.199.26.9:50985] [client 81.199.26.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bak.php"] [unique_id "aSSX4hm2q1FkzLam7A33uwAAAkw"]
[Tue Nov 25 01:37:39.553826 2025] [:error] [pid 9630:tid 9656] [client 81.199.26.10:54839] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Tue Nov 25 01:37:40.154354 2025] [:error] [pid 9630:tid 9651] [client 81.199.26.10:54839] [client 81.199.26.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSSX5CrSgUgPGkizt2pxSQAAAFM"]
[Tue Nov 25 01:37:43.682208 2025] [:error] [pid 48601:tid 48663] [client 81.199.26.7:24379] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Tue Nov 25 01:37:45.780128 2025] [:error] [pid 48601:tid 48660] [client 81.199.26.7:24379] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Nov 25 01:37:46.598434 2025] [:error] [pid 48601:tid 48677] [client 81.199.26.7:24379] [client 81.199.26.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aSSX6oMM4MaVTk74-AYTogAAAhQ"]
[Tue Nov 25 01:37:47.689045 2025] [:error] [pid 16441:tid 16452] [client 81.199.26.3:58283] [client 81.199.26.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSSX64q_bc5MOa9HflniBQAAAIg"]
[Tue Nov 25 01:37:48.882448 2025] [:error] [pid 16549:tid 16577] [client 85.203.15.103:41135] [client 85.203.15.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.103, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aSSX7KeWW19A99PUw_eIpAAAAVg"]
[Tue Nov 25 01:37:50.557421 2025] [:error] [pid 16549:tid 16555] [client 85.203.15.103:41135] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Tue Nov 25 01:37:52.465696 2025] [:error] [pid 16549:tid 16562] [client 85.203.15.103:41135] [client 85.203.15.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/themes.php"] [unique_id "aSSX8KeWW19A99PUw_eItwAAAUo"]
[Tue Nov 25 01:37:53.450290 2025] [:error] [pid 16516:tid 16533] [client 85.203.15.28:38843] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Nov 25 01:37:54.916944 2025] [:error] [pid 16516:tid 16530] [client 85.203.15.28:38843] File does not exist: /usr/local/apache/htdocs/suspended-page/back.php
[Tue Nov 25 01:37:58.064786 2025] [:error] [pid 16516:tid 16519] [client 85.203.15.28:38843] [client 85.203.15.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aSSX9vqZbniwaNwL8XkupwAAAQA"]
[Tue Nov 25 01:38:00.197023 2025] [:error] [pid 49900:tid 49919] [client 81.199.26.4:37079] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Nov 25 01:38:01.527106 2025] [:error] [pid 49900:tid 49907] [client 81.199.26.4:37079] [client 81.199.26.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aSSX-TCyPLrvg06aorl7qQAAAAU"]
[Tue Nov 25 01:38:05.148851 2025] [:error] [pid 16549:tid 16552] [client 85.203.15.177:63473] File does not exist: /usr/local/apache/htdocs/suspended-page/phpfm3.php
[Tue Nov 25 01:38:05.577998 2025] [:error] [pid 16549:tid 16574] [client 85.203.15.177:63473] [client 85.203.15.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSSX_aeWW19A99PUw_eI3AAAAVU"]
[Tue Nov 25 01:38:08.212161 2025] [:error] [pid 16441:tid 16452] [client 85.203.15.30:41975] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Tue Nov 25 01:38:08.632469 2025] [:error] [pid 16441:tid 16468] [client 85.203.15.30:41975] [client 85.203.15.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.15.30, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aSSYAIq_bc5MOa9HflniLQAAAJg"]
[Tue Nov 25 01:38:09.980103 2025] [:error] [pid 16441:tid 16455] [client 85.203.15.30:41975] [client 85.203.15.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aSSYAYq_bc5MOa9HflniMQAAAIs"]
[Tue Nov 25 01:38:11.356461 2025] [:error] [pid 16549:tid 16566] [client 85.203.15.12:57231] [client 85.203.15.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSSYA6eWW19A99PUw_eI3wAAAU4"]
[Tue Nov 25 01:38:13.971599 2025] [:error] [pid 48600:tid 48638] [client 85.203.15.27:32089] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Nov 25 01:38:17.723579 2025] [:error] [pid 48600:tid 48644] [client 85.203.15.27:32089] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Tue Nov 25 01:38:18.971017 2025] [:error] [pid 48600:tid 48649] [client 85.203.15.27:32089] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Nov 25 01:38:19.513076 2025] [:error] [pid 48600:tid 48641] [client 85.203.15.27:32089] File does not exist: /usr/local/apache/htdocs/suspended-page/zip.php
[Tue Nov 25 01:38:20.736949 2025] [:error] [pid 48600:tid 48648] [client 85.203.15.27:32089] [client 85.203.15.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSSYDPtOzSUAQvWVjBfA7gAAAdI"]
[Tue Nov 25 01:38:22.970509 2025] [:error] [pid 49900:tid 49918] [client 85.203.15.253:62315] [client 85.203.15.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSSYDjCyPLrvg06aorl7vAAAABA"]
[Tue Nov 25 01:38:26.633429 2025] [:error] [pid 16441:tid 16453] [client 81.199.26.8:47619] [client 81.199.26.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aSSYEoq_bc5MOa9HflniTgAAAIk"]
[Tue Nov 25 01:38:29.719262 2025] [:error] [pid 48601:tid 48681] [client 85.203.15.177:49853] [client 85.203.15.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aSSYFYMM4MaVTk74-AYT1gAAAhg"]
[Tue Nov 25 01:38:31.444614 2025] [:error] [pid 16516:tid 16526] [client 85.203.15.176:41029] [client 85.203.15.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSSYF_qZbniwaNwL8XkuzgAAAQc"]
[Tue Nov 25 01:38:48.815469 2025] [autoindex:error] [pid 49900:tid 49925] [client 85.203.15.27:24667] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 25 04:20:54.948743 2025] [:error] [pid 14078:tid 14140] [client 20.10.152.15:5167] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Tue Nov 25 04:20:55.153894 2025] [:error] [pid 14078:tid 14159] [client 20.10.152.15:5167] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Nov 25 04:20:55.367849 2025] [:error] [pid 14078:tid 14145] [client 20.10.152.15:5167] File does not exist: /usr/local/apache/htdocs/suspended-page/golden.php
[Tue Nov 25 04:20:55.572860 2025] [:error] [pid 14078:tid 14155] [client 20.10.152.15:5167] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Tue Nov 25 04:20:55.785499 2025] [:error] [pid 14078:tid 14152] [client 20.10.152.15:5167] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Nov 25 04:20:55.988744 2025] [:error] [pid 14078:tid 14151] [client 20.10.152.15:5167] [client 20.10.152.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aSS-J9VXYbb0ii_rVoI39wAAAI4"]
[Tue Nov 25 04:20:58.091101 2025] [:error] [pid 14688:tid 14714] [client 20.10.152.15:5487] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Nov 25 04:20:58.459894 2025] [:error] [pid 14688:tid 14697] [client 20.10.152.15:5487] File does not exist: /usr/local/apache/htdocs/suspended-page/ffile.php
[Tue Nov 25 04:20:58.684691 2025] [:error] [pid 14688:tid 14690] [client 20.10.152.15:5487] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Nov 25 04:20:58.951129 2025] [:error] [pid 14688:tid 14712] [client 20.10.152.15:5487] File does not exist: /usr/local/apache/htdocs/suspended-page/re.php
[Tue Nov 25 04:20:59.160583 2025] [:error] [pid 14688:tid 14692] [client 20.10.152.15:5487] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Tue Nov 25 04:20:59.388043 2025] [:error] [pid 14688:tid 14693] [client 20.10.152.15:5487] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aSS-K29vYrBoEsiDnizOQwAAAQM"]
[Tue Nov 25 04:21:01.024006 2025] [:error] [pid 14688:tid 14699] [client 20.10.152.15:4197] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aSS-LW9vYrBoEsiDnizORAAAAQk"]
[Tue Nov 25 04:21:01.992457 2025] [:error] [pid 14077:tid 14128] [client 20.10.152.15:6491] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aSS-LRG9n7UHEkwDTyg_sAAAAFI"]
[Tue Nov 25 04:21:03.508934 2025] [:error] [pid 14076:tid 14094] [client 20.10.152.15:5459] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aSS-L3sB4Gz6Qw-pvBv79AAAAA0"]
[Tue Nov 25 04:21:04.235954 2025] [:error] [pid 14076:tid 14084] [client 20.10.152.15:1171] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file7.php"] [unique_id "aSS-MHsB4Gz6Qw-pvBv79wAAAAM"]
[Tue Nov 25 04:21:05.486872 2025] [:error] [pid 14168:tid 14189] [client 20.10.152.15:3339] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file7.php"] [unique_id "aSS-MfR-ZDU0QEgAIItVtwAAANI"]
[Tue Nov 25 04:21:07.364490 2025] [:error] [pid 14076:tid 14088] [client 20.10.152.15:3376] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file7.php"] [unique_id "aSS-M3sB4Gz6Qw-pvBv7_AAAAAc"]
[Tue Nov 25 04:21:08.561216 2025] [:error] [pid 14688:tid 14714] [client 20.10.152.15:3608] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file7.php"] [unique_id "aSS-NG9vYrBoEsiDnizOTwAAARg"]
[Tue Nov 25 04:21:09.699862 2025] [:error] [pid 14076:tid 14105] [client 20.10.152.15:5466] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "aSS-NXsB4Gz6Qw-pvBv8AAAAABg"]
[Tue Nov 25 04:21:11.890788 2025] [:error] [pid 14168:tid 14190] [client 20.10.152.15:6516] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "aSS-N_R-ZDU0QEgAIItVugAAANM"]
[Tue Nov 25 04:21:14.517213 2025] [:error] [pid 14077:tid 14133] [client 20.10.152.15:1835] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "aSS-OhG9n7UHEkwDTyg_uwAAAFc"]
[Tue Nov 25 04:21:15.766394 2025] [:error] [pid 14688:tid 14704] [client 20.10.152.15:2013] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "aSS-O29vYrBoEsiDnizOVgAAAQ4"]
[Tue Nov 25 04:21:18.105030 2025] [:error] [pid 14688:tid 14697] [client 20.10.152.15:5629] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless2.php"] [unique_id "aSS-Pm9vYrBoEsiDnizOVwAAAQc"]
[Tue Nov 25 04:21:19.562688 2025] [:error] [pid 14168:tid 14172] [client 20.10.152.15:1804] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless2.php"] [unique_id "aSS-P_R-ZDU0QEgAIItVxQAAAME"]
[Tue Nov 25 04:21:21.295615 2025] [:error] [pid 14077:tid 14112] [client 20.10.152.15:2034] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless2.php"] [unique_id "aSS-QRG9n7UHEkwDTyg_xQAAAEI"]
[Tue Nov 25 04:21:22.581975 2025] [:error] [pid 14078:tid 14153] [client 20.10.152.15:5915] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless2.php"] [unique_id "aSS-QtVXYbb0ii_rVoI4DwAAAJA"]
[Tue Nov 25 04:21:23.502908 2025] [:error] [pid 14168:tid 14192] [client 20.10.152.15:7228] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aSS-Q_R-ZDU0QEgAIItV1QAAANU"]
[Tue Nov 25 04:21:24.467301 2025] [:error] [pid 14688:tid 14694] [client 20.10.152.15:5578] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aSS-RG9vYrBoEsiDnizOXQAAAQQ"]
[Tue Nov 25 04:21:25.262485 2025] [:error] [pid 14076:tid 14095] [client 20.10.152.15:1937] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aSS-RXsB4Gz6Qw-pvBv8DAAAAA4"]
[Tue Nov 25 04:21:26.232985 2025] [:error] [pid 14688:tid 14695] [client 20.10.152.15:3685] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aSS-Rm9vYrBoEsiDnizOYAAAAQU"]
[Tue Nov 25 04:21:27.056420 2025] [:error] [pid 14688:tid 14713] [client 20.10.152.15:1217] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "aSS-R29vYrBoEsiDnizOYQAAARc"]
[Tue Nov 25 04:21:28.093269 2025] [:error] [pid 14168:tid 14190] [client 20.10.152.15:8205] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "aSS-SPR-ZDU0QEgAIItV2gAAANM"]
[Tue Nov 25 04:21:29.424078 2025] [:error] [pid 14168:tid 14188] [client 20.10.152.15:4497] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "aSS-SfR-ZDU0QEgAIItV4QAAANE"]
[Tue Nov 25 04:21:30.136168 2025] [:error] [pid 14078:tid 14160] [client 20.10.152.15:3061] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "aSS-StVXYbb0ii_rVoI4HgAAAJc"]
[Tue Nov 25 04:21:31.747425 2025] [:error] [pid 14168:tid 14181] [client 20.10.152.15:3062] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsa.php"] [unique_id "aSS-S_R-ZDU0QEgAIItV5QAAAMo"]
[Tue Nov 25 04:21:32.841195 2025] [:error] [pid 14688:tid 14700] [client 20.10.152.15:8082] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsa.php"] [unique_id "aSS-TG9vYrBoEsiDnizOaAAAAQo"]
[Tue Nov 25 04:21:33.883532 2025] [:error] [pid 14168:tid 14172] [client 20.10.152.15:2140] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsa.php"] [unique_id "aSS-TfR-ZDU0QEgAIItV5wAAAME"]
[Tue Nov 25 04:21:35.081272 2025] [:error] [pid 14168:tid 14171] [client 20.10.152.15:7564] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsa.php"] [unique_id "aSS-T_R-ZDU0QEgAIItV6AAAAMA"]
[Tue Nov 25 04:21:37.606805 2025] [:error] [pid 14168:tid 14177] [client 20.10.152.15:4377] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/z.php"] [unique_id "aSS-UfR-ZDU0QEgAIItV6wAAAMY"]
[Tue Nov 25 04:21:38.583111 2025] [:error] [pid 14076:tid 14081] [client 20.10.152.15:4374] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/z.php"] [unique_id "aSS-UnsB4Gz6Qw-pvBv8FAAAAAA"]
[Tue Nov 25 04:21:39.611924 2025] [:error] [pid 14077:tid 14119] [client 20.10.152.15:6824] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/z.php"] [unique_id "aSS-UxG9n7UHEkwDTyg_2QAAAEk"]
[Tue Nov 25 04:21:40.470975 2025] [:error] [pid 14077:tid 14125] [client 20.10.152.15:1876] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/z.php"] [unique_id "aSS-VBG9n7UHEkwDTyg_2gAAAE8"]
[Tue Nov 25 04:21:41.153629 2025] [:error] [pid 14078:tid 14160] [client 20.10.152.15:7607] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "aSS-VdVXYbb0ii_rVoI4KAAAAJc"]
[Tue Nov 25 04:21:41.993493 2025] [:error] [pid 14688:tid 14696] [client 20.10.152.15:7052] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "aSS-VW9vYrBoEsiDnizOeQAAAQY"]
[Tue Nov 25 04:21:42.688101 2025] [:error] [pid 14688:tid 14710] [client 20.10.152.15:4314] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "aSS-Vm9vYrBoEsiDnizOegAAARQ"]
[Tue Nov 25 04:21:43.728503 2025] [:error] [pid 14688:tid 14697] [client 20.10.152.15:7609] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "aSS-V29vYrBoEsiDnizOewAAAQc"]
[Tue Nov 25 04:21:44.829872 2025] [:error] [pid 14688:tid 14692] [client 20.10.152.15:5128] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "aSS-WG9vYrBoEsiDnizOfAAAAQI"]
[Tue Nov 25 04:21:45.563722 2025] [:error] [pid 14077:tid 14131] [client 20.10.152.15:4692] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "aSS-WRG9n7UHEkwDTyg_3wAAAFU"]
[Tue Nov 25 04:21:46.369103 2025] [:error] [pid 14078:tid 14147] [client 20.10.152.15:2459] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "aSS-WtVXYbb0ii_rVoI4KwAAAIo"]
[Tue Nov 25 04:21:47.442099 2025] [:error] [pid 14688:tid 14711] [client 20.10.152.15:6797] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "aSS-W29vYrBoEsiDnizOfgAAARU"]
[Tue Nov 25 04:21:48.563915 2025] [:error] [pid 14688:tid 14708] [client 20.10.152.15:1201] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dejavu.php"] [unique_id "aSS-XG9vYrBoEsiDnizOgAAAARI"]
[Tue Nov 25 04:21:49.474419 2025] [:error] [pid 14688:tid 14698] [client 20.10.152.15:2390] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dejavu.php"] [unique_id "aSS-XW9vYrBoEsiDnizOgQAAAQg"]
[Tue Nov 25 04:21:50.469732 2025] [:error] [pid 14078:tid 14139] [client 20.10.152.15:7323] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dejavu.php"] [unique_id "aSS-XtVXYbb0ii_rVoI4MwAAAII"]
[Tue Nov 25 04:21:51.668832 2025] [:error] [pid 14168:tid 14195] [client 20.10.152.15:3687] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dejavu.php"] [unique_id "aSS-X_R-ZDU0QEgAIItV8wAAANg"]
[Tue Nov 25 04:21:53.441047 2025] [:error] [pid 14078:tid 14155] [client 20.10.152.15:5127] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "aSS-YdVXYbb0ii_rVoI4PAAAAJI"]
[Tue Nov 25 04:21:54.277749 2025] [:error] [pid 14076:tid 14094] [client 20.10.152.15:8083] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "aSS-YnsB4Gz6Qw-pvBv8JwAAAA0"]
[Tue Nov 25 04:21:55.030061 2025] [:error] [pid 14077:tid 14126] [client 20.10.152.15:7430] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "aSS-YxG9n7UHEkwDTyg_6wAAAFA"]
[Tue Nov 25 04:21:56.389694 2025] [:error] [pid 14168:tid 14180] [client 20.10.152.15:6686] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "aSS-ZPR-ZDU0QEgAIItV-QAAAMk"]
[Tue Nov 25 04:21:57.169956 2025] [:error] [pid 14078:tid 14145] [client 20.10.152.15:6785] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "aSS-ZdVXYbb0ii_rVoI4QgAAAIg"]
[Tue Nov 25 04:21:58.971058 2025] [:error] [pid 14076:tid 14098] [client 20.10.152.15:1042] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "aSS-ZnsB4Gz6Qw-pvBv8LgAAABE"]
[Tue Nov 25 04:22:00.681187 2025] [:error] [pid 14078:tid 14155] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Nov 25 04:22:01.271826 2025] [:error] [pid 14078:tid 14147] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Nov 25 04:22:01.493915 2025] [:error] [pid 14078:tid 14137] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php
[Tue Nov 25 04:22:01.702879 2025] [:error] [pid 14078:tid 14150] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Nov 25 04:22:01.914735 2025] [:error] [pid 14078:tid 14138] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Tue Nov 25 04:22:02.178436 2025] [:error] [pid 14078:tid 14158] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Nov 25 04:22:02.394967 2025] [:error] [pid 14078:tid 14161] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Tue Nov 25 04:22:02.625673 2025] [:error] [pid 14078:tid 14141] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Nov 25 04:22:02.832968 2025] [:error] [pid 14078:tid 14143] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php
[Tue Nov 25 04:22:03.042234 2025] [:error] [pid 14078:tid 14139] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/ot.php
[Tue Nov 25 04:22:03.252632 2025] [:error] [pid 14078:tid 14144] [client 20.10.152.15:3701] File does not exist: /usr/local/apache/htdocs/suspended-page/lc.php
[Tue Nov 25 04:22:03.482493 2025] [:error] [pid 14078:tid 14148] [client 20.10.152.15:3701] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cool.php"] [unique_id "aSS-a9VXYbb0ii_rVoI4VgAAAIs"]
[Tue Nov 25 04:22:04.804869 2025] [:error] [pid 14077:tid 14132] [client 20.10.152.15:1943] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cool.php"] [unique_id "aSS-bBG9n7UHEkwDTyg_9gAAAFY"]
[Tue Nov 25 04:22:05.890585 2025] [:error] [pid 14077:tid 14112] [client 20.10.152.15:3690] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cool.php"] [unique_id "aSS-bRG9n7UHEkwDTyg_-QAAAEI"]
[Tue Nov 25 04:22:07.035997 2025] [:error] [pid 14168:tid 14172] [client 20.10.152.15:4097] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cool.php"] [unique_id "aSS-b_R-ZDU0QEgAIItWCQAAAME"]
[Tue Nov 25 04:22:08.144750 2025] [:error] [pid 14688:tid 14691] [client 20.10.152.15:4030] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSS-cG9vYrBoEsiDnizOjQAAAQE"]
[Tue Nov 25 04:22:09.002767 2025] [:error] [pid 14076:tid 14105] [client 20.10.152.15:4015] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSS-cXsB4Gz6Qw-pvBv8MAAAABg"]
[Tue Nov 25 04:22:09.706986 2025] [:error] [pid 14076:tid 14082] [client 20.10.152.15:8168] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSS-cXsB4Gz6Qw-pvBv8MgAAAAE"]
[Tue Nov 25 04:22:10.457231 2025] [:error] [pid 14076:tid 14103] [client 20.10.152.15:3988] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSS-cnsB4Gz6Qw-pvBv8MwAAABY"]
[Tue Nov 25 04:22:11.373647 2025] [:error] [pid 14076:tid 14095] [client 20.10.152.15:7096] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aSS-c3sB4Gz6Qw-pvBv8NQAAAA4"]
[Tue Nov 25 04:22:12.127352 2025] [:error] [pid 14076:tid 14086] [client 20.10.152.15:5738] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aSS-dHsB4Gz6Qw-pvBv8OQAAAAU"]
[Tue Nov 25 04:22:13.685610 2025] [:error] [pid 14688:tid 14701] [client 20.10.152.15:7089] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aSS-dW9vYrBoEsiDnizOkQAAAQs"]
[Tue Nov 25 04:22:14.874702 2025] [:error] [pid 14077:tid 14121] [client 20.10.152.15:5700] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aSS-dhG9n7UHEkwDTyg__wAAAEs"]
[Tue Nov 25 04:22:17.001818 2025] [:error] [pid 14077:tid 14123] [client 20.10.152.15:3981] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfile.php"] [unique_id "aSS-eBG9n7UHEkwDTyhAAAAAAE0"]
[Tue Nov 25 04:22:17.918439 2025] [:error] [pid 14078:tid 14151] [client 20.10.152.15:4127] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfile.php"] [unique_id "aSS-edVXYbb0ii_rVoI4XAAAAI4"]
[Tue Nov 25 04:22:18.759366 2025] [:error] [pid 14076:tid 14084] [client 20.10.152.15:4885] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfile.php"] [unique_id "aSS-ensB4Gz6Qw-pvBv8OwAAAAM"]
[Tue Nov 25 04:22:21.340933 2025] [:error] [pid 14168:tid 14174] [client 20.10.152.15:2564] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfile.php"] [unique_id "aSS-ffR-ZDU0QEgAIItWFQAAAMM"]
[Tue Nov 25 04:22:22.193856 2025] [:error] [pid 14168:tid 14185] [client 20.10.152.15:1168] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file5.php"] [unique_id "aSS-fvR-ZDU0QEgAIItWFwAAAM4"]
[Tue Nov 25 04:22:22.898565 2025] [:error] [pid 14168:tid 14191] [client 20.10.152.15:4105] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file5.php"] [unique_id "aSS-fvR-ZDU0QEgAIItWGAAAANQ"]
[Tue Nov 25 04:22:23.729201 2025] [:error] [pid 14168:tid 14192] [client 20.10.152.15:2600] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file5.php"] [unique_id "aSS-f_R-ZDU0QEgAIItWGgAAANU"]
[Tue Nov 25 04:22:24.570547 2025] [:error] [pid 14076:tid 14105] [client 20.10.152.15:7059] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file5.php"] [unique_id "aSS-gHsB4Gz6Qw-pvBv8QQAAABg"]
[Tue Nov 25 04:22:25.712478 2025] [:error] [pid 14168:tid 14186] [client 20.10.152.15:4617] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aSS-gfR-ZDU0QEgAIItWIwAAAM8"]
[Tue Nov 25 04:22:27.586937 2025] [:error] [pid 14168:tid 14191] [client 20.10.152.15:2589] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aSS-g_R-ZDU0QEgAIItWJwAAANQ"]
[Tue Nov 25 04:22:28.747698 2025] [:error] [pid 14168:tid 14178] [client 20.10.152.15:4608] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aSS-hPR-ZDU0QEgAIItWKQAAAMc"]
[Tue Nov 25 04:22:29.715408 2025] [:error] [pid 14168:tid 14173] [client 20.10.152.15:2093] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aSS-hfR-ZDU0QEgAIItWLQAAAMI"]
[Tue Nov 25 04:22:31.263608 2025] [:error] [pid 14168:tid 14189] [client 20.10.152.15:6811] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/num.php"] [unique_id "aSS-h_R-ZDU0QEgAIItWLgAAANI"]
[Tue Nov 25 04:22:32.494612 2025] [:error] [pid 14077:tid 14130] [client 20.10.152.15:2313] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/num.php"] [unique_id "aSS-iBG9n7UHEkwDTyhAOQAAAFQ"]
[Tue Nov 25 04:22:34.096214 2025] [:error] [pid 14077:tid 14132] [client 20.10.152.15:6929] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/num.php"] [unique_id "aSS-ihG9n7UHEkwDTyhAQQAAAFY"]
[Tue Nov 25 04:22:35.355152 2025] [:error] [pid 14077:tid 14127] [client 20.10.152.15:6958] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/num.php"] [unique_id "aSS-ixG9n7UHEkwDTyhASAAAAFE"]
[Tue Nov 25 04:22:36.880818 2025] [:error] [pid 14076:tid 14083] [client 20.10.152.15:7685] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/astab.php"] [unique_id "aSS-jHsB4Gz6Qw-pvBv8TAAAAAI"]
[Tue Nov 25 04:22:38.303586 2025] [:error] [pid 14077:tid 14124] [client 20.10.152.15:6971] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/astab.php"] [unique_id "aSS-jhG9n7UHEkwDTyhATgAAAE4"]
[Tue Nov 25 04:22:39.113816 2025] [:error] [pid 14688:tid 14691] [client 20.10.152.15:7071] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/astab.php"] [unique_id "aSS-j29vYrBoEsiDnizOqAAAAQE"]
[Tue Nov 25 04:22:40.161576 2025] [:error] [pid 14168:tid 14171] [client 20.10.152.15:1936] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/astab.php"] [unique_id "aSS-kPR-ZDU0QEgAIItWOAAAAMA"]
[Tue Nov 25 04:22:41.186724 2025] [:error] [pid 14076:tid 14089] [client 20.10.152.15:4667] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xl.php"] [unique_id "aSS-kXsB4Gz6Qw-pvBv8XQAAAAg"]
[Tue Nov 25 04:22:42.474441 2025] [:error] [pid 14076:tid 14095] [client 20.10.152.15:4623] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xl.php"] [unique_id "aSS-knsB4Gz6Qw-pvBv8YAAAAA4"]
[Tue Nov 25 04:22:46.932680 2025] [:error] [pid 14168:tid 14182] [client 20.10.152.15:7027] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xl.php"] [unique_id "aSS-lvR-ZDU0QEgAIItWPgAAAMs"]
[Tue Nov 25 04:22:48.482203 2025] [:error] [pid 14168:tid 14193] [client 20.10.152.15:4616] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xl.php"] [unique_id "aSS-mPR-ZDU0QEgAIItWQAAAANY"]
[Tue Nov 25 04:22:49.841368 2025] [:error] [pid 14168:tid 14181] [client 20.10.152.15:3951] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file17.php"] [unique_id "aSS-mfR-ZDU0QEgAIItWQwAAAMo"]
[Tue Nov 25 04:22:50.903619 2025] [:error] [pid 14078:tid 14147] [client 20.10.152.15:7727] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file17.php"] [unique_id "aSS-mtVXYbb0ii_rVoI4eAAAAIo"]
[Tue Nov 25 04:22:53.278099 2025] [:error] [pid 14077:tid 14124] [client 20.10.152.15:7705] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file17.php"] [unique_id "aSS-nRG9n7UHEkwDTyhAeAAAAE4"]
[Tue Nov 25 04:22:54.219330 2025] [:error] [pid 14688:tid 14698] [client 20.10.152.15:3940] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file17.php"] [unique_id "aSS-nm9vYrBoEsiDnizOsgAAAQg"]
[Tue Nov 25 04:22:55.277892 2025] [:error] [pid 14168:tid 14188] [client 20.10.152.15:6828] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pepe.php"] [unique_id "aSS-n_R-ZDU0QEgAIItWUQAAANE"]
[Tue Nov 25 04:22:56.202015 2025] [:error] [pid 14168:tid 14195] [client 20.10.152.15:4204] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pepe.php"] [unique_id "aSS-oPR-ZDU0QEgAIItWVwAAANg"]
[Tue Nov 25 04:22:57.903460 2025] [:error] [pid 14077:tid 14121] [client 20.10.152.15:1949] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pepe.php"] [unique_id "aSS-oRG9n7UHEkwDTyhAfgAAAEs"]
[Tue Nov 25 04:22:58.967195 2025] [:error] [pid 14168:tid 14183] [client 20.10.152.15:7708] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pepe.php"] [unique_id "aSS-ovR-ZDU0QEgAIItWWQAAAMw"]
[Tue Nov 25 04:23:00.369482 2025] [:error] [pid 14688:tid 14702] [client 20.10.152.15:1954] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aSS-pG9vYrBoEsiDnizOtAAAAQw"]
[Tue Nov 25 04:23:01.587398 2025] [:error] [pid 14688:tid 14714] [client 20.10.152.15:1966] [client 20.10.152.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aSS-pW9vYrBoEsiDnizOtwAAARg"]
[Tue Nov 25 04:23:03.253948 2025] [:error] [pid 14077:tid 14119] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Nov 25 04:23:03.672611 2025] [:error] [pid 14077:tid 14128] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Tue Nov 25 04:23:04.414774 2025] [:error] [pid 14077:tid 14113] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Nov 25 04:23:04.627821 2025] [:error] [pid 14077:tid 14116] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/faq.php
[Tue Nov 25 04:23:04.851430 2025] [:error] [pid 14077:tid 14112] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue Nov 25 04:23:05.080319 2025] [:error] [pid 14077:tid 14125] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/CLA.php
[Tue Nov 25 04:23:05.316039 2025] [:error] [pid 14077:tid 14124] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Nov 25 04:23:05.553108 2025] [:error] [pid 14077:tid 14115] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mn.php
[Tue Nov 25 04:23:05.915287 2025] [:error] [pid 14077:tid 14122] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Tue Nov 25 04:23:06.147168 2025] [:error] [pid 14077:tid 14120] [client 20.10.152.15:1598] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logiin.php
[Tue Nov 25 05:54:45.566337 2025] [:error] [pid 14076:tid 14098] [client 147.185.41.135:39526] [client 147.185.41.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aSTUJXsB4Gz6Qw-pvBsR-AAAABE"]
[Tue Nov 25 09:46:46.166528 2025] [:error] [pid 14077:tid 14112] [client 216.26.243.139:38357] [client 216.26.243.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "aSUKhhG9n7UHEkwDTyirDgAAAEI"]
[Tue Nov 25 09:46:47.671596 2025] [:error] [pid 1103:tid 1109] [client 104.167.19.157:16279] [client 104.167.19.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aSUKh40LETdqOlq63sRRBwAAAUA"]
[Tue Nov 25 09:46:48.291978 2025] [:error] [pid 14077:tid 14114] [client 65.111.13.128:29037] [client 65.111.13.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.svn/wc.db"] [unique_id "aSUKiBG9n7UHEkwDTyirEgAAAEQ"]
[Tue Nov 25 18:53:14.605732 2025] [:error] [pid 28739:tid 28774] [client 138.199.60.187:54540] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSWKmhxGpKmlkG4FexRwcAAAAgw"]
[Tue Nov 25 18:53:14.884615 2025] [:error] [pid 2987:tid 3002] [client 138.199.60.187:54706] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSWKms-djEt-pTzPxnyULwAAAU0"]
[Tue Nov 25 18:53:15.119011 2025] [:error] [pid 28739:tid 28770] [client 138.199.60.187:54876] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSWKmxxGpKmlkG4FexRwcgAAAgg"]
[Tue Nov 25 18:53:15.413487 2025] [:error] [pid 14077:tid 14123] [client 138.199.60.187:55056] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSWKmxG9n7UHEkwDTyh-agAAAE0"]
[Tue Nov 25 18:53:15.628927 2025] [:error] [pid 14168:tid 14176] [client 138.199.60.187:55312] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "aSWKm_R-ZDU0QEgAIItcaQAAAMU"]
[Tue Nov 25 18:53:15.888952 2025] [:error] [pid 14078:tid 14138] [client 138.199.60.187:55556] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKm9VXYbb0ii_rVoI4BAAAAIE"]
[Tue Nov 25 18:53:16.188882 2025] [:error] [pid 28740:tid 28807] [client 138.199.60.187:55796] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnFppQCoYxWW6V0Vy-wAAAlA"]
[Tue Nov 25 18:53:16.399761 2025] [:error] [pid 28842:tid 29023] [client 138.199.60.187:55980] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnNNmoaPf6T4-6C2D9gAAA1U"]
[Tue Nov 25 18:53:16.668236 2025] [:error] [pid 2987:tid 3013] [client 138.199.60.187:40693] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnM-djEt-pTzPxnyURwAAAVg"]
[Tue Nov 25 18:53:16.936357 2025] [:error] [pid 28842:tid 29001] [client 138.199.60.187:56484] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnNNmoaPf6T4-6C2EAgAAA0s"]
[Tue Nov 25 21:09:13.684425 2025] [:error] [pid 2987:tid 2991] [client 54.173.250.15:43710] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aSWqec-djEt-pTzPxnzAlAAAAUI"]
[Wed Nov 26 05:33:55.986319 2025] [:error] [pid 38796:tid 38801] [client 54.173.250.15:53530] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aSYgwwGcUUzaXxvjCXOxkwAAAUI"]
[Wed Nov 26 07:20:31.735302 2025] [:error] [pid 3011:tid 3055] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php, referer: https://www.google.com/
[Wed Nov 26 07:20:33.110338 2025] [:error] [pid 3011:tid 3055] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php, referer: https://duckduckgo.com/
[Wed Nov 26 07:20:33.323373 2025] [:error] [pid 3011:tid 3058] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php, referer: https://www.google.fr/
[Wed Nov 26 07:20:33.541764 2025] [:error] [pid 3011:tid 3047] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php, referer: https://www.bing.com/
[Wed Nov 26 07:20:33.754960 2025] [:error] [pid 3011:tid 3052] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php, referer: https://www.google.de/
[Wed Nov 26 07:20:33.974921 2025] [:error] [pid 3011:tid 3066] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php, referer: https://www.google.com/
[Wed Nov 26 07:20:34.419109 2025] [:error] [pid 3011:tid 3063] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php, referer: https://www.google.co.uk/
[Wed Nov 26 07:20:37.202098 2025] [:error] [pid 3011:tid 3064] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php, referer: https://www.bing.com/
[Wed Nov 26 07:20:37.419953 2025] [:error] [pid 3011:tid 3043] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php, referer: https://www.bing.com/
[Wed Nov 26 07:20:37.632395 2025] [:error] [pid 3011:tid 3045] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php, referer: https://www.yahoo.com/
[Wed Nov 26 07:20:37.869297 2025] [:error] [pid 3011:tid 3058] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/ds.php, referer: https://duckduckgo.com/
[Wed Nov 26 07:20:38.081996 2025] [:error] [pid 3011:tid 3062] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php, referer: https://www.google.fr/
[Wed Nov 26 07:20:38.296032 2025] [:error] [pid 3011:tid 3047] [client 52.254.81.63:6020] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php, referer: https://www.google.co.uk/
[Wed Nov 26 07:20:51.674180 2025] [autoindex:error] [pid 3011:tid 3045] [client 52.254.81.63:6020] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Nov 26 14:22:29.749400 2025] [:error] [pid 35540:tid 35558] [client 207.154.216.0:52596] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aSacpcGrIq2A6SZSnkKFTgAAAIw"]
[Wed Nov 26 14:22:30.712007 2025] [:error] [pid 34744:tid 34805] [client 207.154.216.0:49229] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aSacpktgOvVbhyALkTQM7gAAAYI"]
[Wed Nov 26 14:22:31.946427 2025] [:error] [pid 34743:tid 34785] [client 207.154.216.0:58886] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aSacpwvyX7Q5oU7_mByiXQAAAUk"]
[Wed Nov 26 14:22:32.628898 2025] [:error] [pid 34744:tid 34825] [client 207.154.216.0:53704] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aSacqEtgOvVbhyALkTQNHgAAAZY"]
[Wed Nov 26 14:22:33.443287 2025] [:error] [pid 34742:tid 34754] [client 207.154.216.0:50534] [client 207.154.216.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aSacqZSuLNwpQF_jzAdJXwAAAEY"]
[Thu Nov 27 03:02:37.381005 2025] [:error] [pid 8184:tid 8236] [client 213.21.239.4:48834] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/;/.git/config"] [unique_id "aSdOzb-M2IHkRYVrcbOoxwAAAEA"]
[Thu Nov 27 03:02:37.383086 2025] [:error] [pid 25262:tid 25342] [client 213.21.239.4:48872] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css../.git/config"] [unique_id "aSdOzU3p81VU3bYILBVaIAAAAhU"]
[Thu Nov 27 03:02:37.384360 2025] [:error] [pid 25262:tid 25321] [client 213.21.239.4:48904] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants../config"] [unique_id "aSdOzU3p81VU3bYILBVaIQAAAgA"]
[Thu Nov 27 03:02:37.384793 2025] [:error] [pid 8184:tid 8248] [client 213.21.239.4:49044] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/static../.git/config"] [unique_id "aSdOzb-M2IHkRYVrcbOoyAAAAEs"]
[Thu Nov 27 03:02:37.390121 2025] [:error] [pid 25262:tid 25341] [client 213.21.239.4:48966] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/content../.git/config"] [unique_id "aSdOzU3p81VU3bYILBVaIgAAAhQ"]
[Thu Nov 27 03:02:37.390439 2025] [:error] [pid 8184:tid 8252] [client 213.21.239.4:48840] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets../.git/config"] [unique_id "aSdOzb-M2IHkRYVrcbOoyQAAAE4"]
[Thu Nov 27 03:02:37.391193 2025] [:error] [pid 8184:tid 8251] [client 213.21.239.4:48968] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application/.git/config"] [unique_id "aSdOzb-M2IHkRYVrcbOoygAAAE0"]
[Thu Nov 27 03:02:37.391391 2025] [:error] [pid 8184:tid 8258] [client 213.21.239.4:48900] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/.git/config;.."] [unique_id "aSdOzb-M2IHkRYVrcbOoywAAAFQ"]
[Thu Nov 27 03:02:37.395077 2025] [:error] [pid 8184:tid 8242] [client 213.21.239.4:49076] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/.git/config"] [unique_id "aSdOzb-M2IHkRYVrcbOozAAAAEY"]
[Thu Nov 27 03:02:37.396200 2025] [:error] [pid 8184:tid 8257] [client 213.21.239.4:49000] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/.git;/config"] [unique_id "aSdOzb-M2IHkRYVrcbOozQAAAFM"]
[Thu Nov 27 03:02:37.396519 2025] [:error] [pid 8184:tid 8254] [client 213.21.239.4:48964] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/config"] [unique_id "aSdOzb-M2IHkRYVrcbOozgAAAFA"]
[Thu Nov 27 03:02:37.397689 2025] [:error] [pid 8184:tid 8238] [client 213.21.239.4:48880] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dev/.git/config"] [unique_id "aSdOzb-M2IHkRYVrcbOozwAAAEI"]
[Thu Nov 27 03:02:37.400566 2025] [:error] [pid 24826:tid 25140] [client 213.21.239.4:49020] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/..;/.git/config"] [unique_id "aSdOzVEvPXLVl-nh-yL2pAAAARg"]
[Thu Nov 27 03:02:37.401465 2025] [:error] [pid 8184:tid 8262] [client 213.21.239.4:48938] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/.git/config;"] [unique_id "aSdOzb-M2IHkRYVrcbOo0AAAAFg"]
[Thu Nov 27 03:02:37.402849 2025] [:error] [pid 24826:tid 25116] [client 213.21.239.4:48886] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.git/config"] [unique_id "aSdOzVEvPXLVl-nh-yL2pQAAAQE"]
[Thu Nov 27 03:02:37.405690 2025] [:error] [pid 25262:tid 25337] [client 213.21.239.4:48828] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/.git/%0Aconfig"] [unique_id "aSdOzU3p81VU3bYILBVaIwAAAhA"]
[Thu Nov 27 03:02:37.408705 2025] [:error] [pid 25180:tid 25204] [client 213.21.239.4:49058] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.git/config"] [unique_id "aSdOzb-owhtiwMHXYlzrTgAAAZY"]
[Thu Nov 27 03:02:37.408835 2025] [:error] [pid 25262:tid 25327] [client 213.21.239.4:49062] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/developer/.git/config"] [unique_id "aSdOzU3p81VU3bYILBVaJAAAAgY"]
[Thu Nov 27 03:02:37.409764 2025] [:error] [pid 25262:tid 25332] [client 213.21.239.4:48854] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/database/.git/config"] [unique_id "aSdOzU3p81VU3bYILBVaJQAAAgs"]
[Thu Nov 27 03:02:37.411039 2025] [:error] [pid 8184:tid 8260] [client 213.21.239.4:48860] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/config"] [unique_id "aSdOzb-M2IHkRYVrcbOo0QAAAFY"]
[Thu Nov 27 03:02:37.412324 2025] [:error] [pid 8184:tid 8255] [client 213.21.239.4:48924] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au../config"] [unique_id "aSdOzb-M2IHkRYVrcbOo0gAAAFE"]
[Thu Nov 27 03:02:37.414723 2025] [:error] [pid 25180:tid 25200] [client 213.21.239.4:48922] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/backup/.git/config"] [unique_id "aSdOzb-owhtiwMHXYlzrTwAAAZI"]
[Thu Nov 27 03:02:37.415132 2025] [:error] [pid 25180:tid 25184] [client 213.21.239.4:48920] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants../.git/config"] [unique_id "aSdOzb-owhtiwMHXYlzrUQAAAYI"]
[Thu Nov 27 03:02:37.416376 2025] [:error] [pid 25262:tid 25338] [client 213.21.239.4:49030] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.git/config"] [unique_id "aSdOzU3p81VU3bYILBVaJgAAAhE"]
[Thu Nov 27 03:02:37.419088 2025] [:error] [pid 25180:tid 25186] [client 213.21.239.4:49010] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/common/.git/config"] [unique_id "aSdOzb-owhtiwMHXYlzrUgAAAYQ"]
[Thu Nov 27 03:02:39.406906 2025] [:error] [pid 25180:tid 25186] [client 213.21.239.4:49310] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants../config"] [unique_id "aSdOz7-owhtiwMHXYlzrWgAAAYQ"]
[Thu Nov 27 03:02:39.426445 2025] [:error] [pid 25180:tid 25206] [client 213.21.239.4:49336] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au../config"] [unique_id "aSdOz7-owhtiwMHXYlzrWwAAAZg"]
[Thu Nov 27 03:02:39.429319 2025] [:error] [pid 54723:tid 54740] [client 213.21.239.4:49326] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/config"] [unique_id "aSdOzw2CEg7QoyDosdIUFAAAAAo"]
[Thu Nov 27 03:02:39.431007 2025] [:error] [pid 54723:tid 54741] [client 213.21.239.4:49324] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants/.git;/config"] [unique_id "aSdOzw2CEg7QoyDosdIUFQAAAAs"]
[Thu Nov 27 03:02:39.434877 2025] [:error] [pid 25262:tid 25330] [client 213.21.239.4:49328] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/config"] [unique_id "aSdOz03p81VU3bYILBVaKgAAAgk"]
[Thu Nov 27 03:02:39.490424 2025] [:error] [pid 8184:tid 8247] [client 213.21.239.4:49640] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/.git/config"] [unique_id "aSdOz7-M2IHkRYVrcbOo1wAAAEo"]
[Thu Nov 27 03:02:39.497495 2025] [:error] [pid 24814:tid 25089] [client 213.21.239.4:49574] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/%0Aconfig"] [unique_id "aSdOzwPn1NMGCdo6Rsi5gAAAAU4"]
[Thu Nov 27 03:02:39.498001 2025] [:error] [pid 54723:tid 54749] [client 213.21.239.4:49688] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git;/config;"] [unique_id "aSdOzw2CEg7QoyDosdIUGgAAABM"]
[Thu Nov 27 03:02:39.498687 2025] [:error] [pid 8184:tid 8245] [client 213.21.239.4:49754] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au../.git/config"] [unique_id "aSdOz7-M2IHkRYVrcbOo2QAAAEg"]
[Thu Nov 27 03:02:39.505040 2025] [:error] [pid 8184:tid 8236] [client 213.21.239.4:49794] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/.git;/config"] [unique_id "aSdOz7-M2IHkRYVrcbOo2wAAAEA"]
[Thu Nov 27 03:02:39.508101 2025] [:error] [pid 8184:tid 8248] [client 213.21.239.4:49838] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config;.."] [unique_id "aSdOz7-M2IHkRYVrcbOo3QAAAEs"]
[Thu Nov 27 03:02:39.512811 2025] [:error] [pid 54723:tid 54754] [client 213.21.239.4:49900] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/static../.git/config"] [unique_id "aSdOzw2CEg7QoyDosdIUHgAAABg"]
[Thu Nov 27 03:02:39.514116 2025] [:error] [pid 54723:tid 54753] [client 213.21.239.4:49720] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/.git/%0Aconfig"] [unique_id "aSdOzw2CEg7QoyDosdIUHwAAABc"]
[Thu Nov 27 03:02:39.521179 2025] [:error] [pid 8184:tid 8251] [client 213.21.239.4:49828] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/;/.git/config"] [unique_id "aSdOz7-M2IHkRYVrcbOo4AAAAE0"]
[Thu Nov 27 03:02:39.524374 2025] [:error] [pid 54723:tid 54734] [client 213.21.239.4:49866] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/;/.git/config"] [unique_id "aSdOzw2CEg7QoyDosdIUIgAAAAQ"]
[Thu Nov 27 03:02:39.529274 2025] [:error] [pid 25180:tid 25195] [client 213.21.239.4:49924] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/.git/config;.."] [unique_id "aSdOz7-owhtiwMHXYlzrXgAAAY0"]
[Thu Nov 27 03:02:39.530331 2025] [:error] [pid 25180:tid 25183] [client 213.21.239.4:49926] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/img../.git/config"] [unique_id "aSdOz7-owhtiwMHXYlzrXwAAAYE"]
[Thu Nov 27 03:02:39.533458 2025] [:error] [pid 25180:tid 25185] [client 213.21.239.4:49626] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/..;/.git/config"] [unique_id "aSdOz7-owhtiwMHXYlzrYAAAAYM"]
[Thu Nov 27 03:02:39.542426 2025] [:error] [pid 25262:tid 25323] [client 213.21.239.4:49844] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/git/.git/config"] [unique_id "aSdOz03p81VU3bYILBVaLgAAAgI"]
[Thu Nov 27 03:02:39.544197 2025] [:error] [pid 25262:tid 25326] [client 213.21.239.4:49910] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images../.git/config"] [unique_id "aSdOz03p81VU3bYILBVaLwAAAgU"]
[Thu Nov 27 03:02:39.550092 2025] [:error] [pid 25180:tid 25203] [client 213.21.239.4:49678] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/..;/.git/config"] [unique_id "aSdOz7-owhtiwMHXYlzrZAAAAZU"]
[Thu Nov 27 03:02:39.551738 2025] [:error] [pid 25180:tid 25197] [client 213.21.239.4:49736] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/.git/config;"] [unique_id "aSdOz7-owhtiwMHXYlzrZQAAAY8"]
[Thu Nov 27 03:02:39.552799 2025] [:error] [pid 8184:tid 8238] [client 213.21.239.4:49738] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aSdOz7-M2IHkRYVrcbOo5QAAAEI"]
[Thu Nov 27 03:02:39.555976 2025] [:error] [pid 25180:tid 25201] [client 213.21.239.4:49878] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git;/config"] [unique_id "aSdOz7-owhtiwMHXYlzrZgAAAZM"]
[Thu Nov 27 03:02:39.560301 2025] [:error] [pid 25180:tid 25190] [client 213.21.239.4:49814] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config;"] [unique_id "aSdOz7-owhtiwMHXYlzraAAAAYg"]
[Thu Nov 27 03:02:41.513316 2025] [:error] [pid 25180:tid 25196] [client 213.21.239.4:40500] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc.windfarmcoolants.com.au/.git;/config"] [unique_id "aSdO0b-owhtiwMHXYlzrcQAAAY4"]
[Thu Nov 27 03:02:41.524170 2025] [:error] [pid 25180:tid 25204] [client 213.21.239.4:40486] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git;/config;"] [unique_id "aSdO0b-owhtiwMHXYlzrcgAAAZY"]
[Thu Nov 27 03:02:41.569650 2025] [:error] [pid 24814:tid 25081] [client 213.21.239.4:40536] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git;/config"] [unique_id "aSdO0QPn1NMGCdo6Rsi5igAAAUY"]
[Thu Nov 27 03:02:42.463421 2025] [:error] [pid 54723:tid 54754] [client 213.21.239.4:40538] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/live/.git/config"] [unique_id "aSdO0g2CEg7QoyDosdIULwAAABg"]
[Thu Nov 27 03:02:42.468432 2025] [:error] [pid 54723:tid 54729] [client 213.21.239.4:40580] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qa/.git/config"] [unique_id "aSdO0g2CEg7QoyDosdIUMQAAAAA"]
[Thu Nov 27 03:02:42.484295 2025] [:error] [pid 54723:tid 54744] [client 213.21.239.4:40742] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au../config"] [unique_id "aSdO0g2CEg7QoyDosdIUNAAAAA4"]
[Thu Nov 27 03:02:42.484689 2025] [:error] [pid 25262:tid 25328] [client 213.21.239.4:40558] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/m/.git/config"] [unique_id "aSdO0k3p81VU3bYILBVaOgAAAgc"]
[Thu Nov 27 03:02:42.485141 2025] [:error] [pid 25262:tid 25344] [client 213.21.239.4:40550] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/message-api/.git/config"] [unique_id "aSdO0k3p81VU3bYILBVaOwAAAhc"]
[Thu Nov 27 03:02:42.503882 2025] [:error] [pid 54723:tid 54737] [client 213.21.239.4:40888] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js../.git/config"] [unique_id "aSdO0g2CEg7QoyDosdIUOQAAAAc"]
[Thu Nov 27 03:02:42.505170 2025] [:error] [pid 25262:tid 25345] [client 213.21.239.4:40768] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new/.git/config"] [unique_id "aSdO0k3p81VU3bYILBVaQwAAAhg"]
[Thu Nov 27 03:02:42.513846 2025] [:error] [pid 24814:tid 25091] [client 213.21.239.4:40988] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/.git/%0Aconfig"] [unique_id "aSdO0gPn1NMGCdo6Rsi5jAAAAVA"]
[Thu Nov 27 03:02:42.518254 2025] [:error] [pid 24814:tid 25082] [client 213.21.239.4:40828] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/config"] [unique_id "aSdO0gPn1NMGCdo6Rsi5jQAAAUc"]
[Thu Nov 27 03:02:42.521180 2025] [:error] [pid 25262:tid 25327] [client 213.21.239.4:40922] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/.git/config;.."] [unique_id "aSdO0k3p81VU3bYILBVaRQAAAgY"]
[Thu Nov 27 03:02:42.522209 2025] [:error] [pid 24814:tid 25086] [client 213.21.239.4:41054] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au../.git/config"] [unique_id "aSdO0gPn1NMGCdo6Rsi5jwAAAUs"]
[Thu Nov 27 03:02:42.523310 2025] [:error] [pid 25262:tid 25333] [client 213.21.239.4:40948] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prod/.git/config"] [unique_id "aSdO0k3p81VU3bYILBVaRgAAAgw"]
[Thu Nov 27 03:02:42.526227 2025] [:error] [pid 24814:tid 25078] [client 213.21.239.4:41078] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/.git/config"] [unique_id "aSdO0gPn1NMGCdo6Rsi5kAAAAUM"]
[Thu Nov 27 03:02:42.530977 2025] [:error] [pid 24814:tid 25085] [client 213.21.239.4:40796] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib../.git/config"] [unique_id "aSdO0gPn1NMGCdo6Rsi5kQAAAUo"]
[Thu Nov 27 03:02:42.536407 2025] [:error] [pid 25262:tid 25330] [client 213.21.239.4:41088] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/config"] [unique_id "aSdO0k3p81VU3bYILBVaRwAAAgk"]
[Thu Nov 27 03:02:42.537234 2025] [:error] [pid 25262:tid 25332] [client 213.21.239.4:40930] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/.git;/config"] [unique_id "aSdO0k3p81VU3bYILBVaSAAAAgs"]
[Thu Nov 27 03:02:42.539781 2025] [:error] [pid 25262:tid 25322] [client 213.21.239.4:41094] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/.git/config;"] [unique_id "aSdO0k3p81VU3bYILBVaSQAAAgE"]
[Thu Nov 27 03:02:42.540230 2025] [:error] [pid 24826:tid 25119] [client 213.21.239.4:40834] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/;/.git/config"] [unique_id "aSdO0lEvPXLVl-nh-yL2zAAAAQQ"]
[Thu Nov 27 03:02:42.547752 2025] [:error] [pid 24814:tid 25076] [client 213.21.239.4:40878] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/..;/.git/config"] [unique_id "aSdO0gPn1NMGCdo6Rsi5lQAAAUE"]
[Thu Nov 27 03:02:42.554546 2025] [:error] [pid 24814:tid 25092] [client 213.21.239.4:41030] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/static../.git/config"] [unique_id "aSdO0gPn1NMGCdo6Rsi5mAAAAVE"]
[Thu Nov 27 03:02:42.554889 2025] [:error] [pid 25262:tid 25323] [client 213.21.239.4:41106] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/.git/config"] [unique_id "aSdO0k3p81VU3bYILBVaTgAAAgI"]
[Thu Nov 27 03:02:42.558473 2025] [:error] [pid 8184:tid 8261] [client 213.21.239.4:41034] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc../config"] [unique_id "aSdO0r-M2IHkRYVrcbOo6QAAAFc"]
[Thu Nov 27 03:02:44.468452 2025] [:error] [pid 54723:tid 54754] [client 213.21.239.4:41292] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/.git/%0Aconfig"] [unique_id "aSdO1A2CEg7QoyDosdIUQgAAABg"]
[Thu Nov 27 03:02:44.469538 2025] [:error] [pid 54723:tid 54743] [client 213.21.239.4:41294] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc../.git/config"] [unique_id "aSdO1A2CEg7QoyDosdIUQwAAAA0"]
[Thu Nov 27 03:02:44.478740 2025] [:error] [pid 54723:tid 54729] [client 213.21.239.4:41214] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/..;/.git/config"] [unique_id "aSdO1A2CEg7QoyDosdIURwAAAAA"]
[Thu Nov 27 03:02:44.537854 2025] [:error] [pid 25180:tid 25191] [client 213.21.239.4:41394] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/config"] [unique_id "aSdO1L-owhtiwMHXYlzreQAAAYk"]
[Thu Nov 27 03:02:44.538294 2025] [:error] [pid 8184:tid 8242] [client 213.21.239.4:41356] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au../config"] [unique_id "aSdO1L-M2IHkRYVrcbOo7QAAAEY"]
[Thu Nov 27 03:02:44.559903 2025] [:error] [pid 8184:tid 8255] [client 213.21.239.4:41442] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/config"] [unique_id "aSdO1L-M2IHkRYVrcbOo8AAAAFE"]
[Thu Nov 27 03:02:44.568778 2025] [:error] [pid 54723:tid 54738] [client 213.21.239.4:41452] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfarmcoolants.com.au/.git;/config"] [unique_id "aSdO1A2CEg7QoyDosdIUSwAAAAg"]
[Thu Nov 27 03:02:44.583979 2025] [:error] [pid 25262:tid 25335] [client 213.21.239.4:41478] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc../config"] [unique_id "aSdO1E3p81VU3bYILBVaUgAAAg4"]
[Thu Nov 27 03:02:45.458977 2025] [:error] [pid 24826:tid 25129] [client 213.21.239.4:41550] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/;/.git/config"] [unique_id "aSdO1VEvPXLVl-nh-yL21gAAAQ4"]
[Thu Nov 27 03:02:45.461134 2025] [:error] [pid 8184:tid 8239] [client 213.21.239.4:41658] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/.git/config;"] [unique_id "aSdO1b-M2IHkRYVrcbOo8wAAAEM"]
[Thu Nov 27 03:02:45.461448 2025] [:error] [pid 8184:tid 8246] [client 213.21.239.4:41622] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/.git;/config"] [unique_id "aSdO1b-M2IHkRYVrcbOo9AAAAEk"]
[Thu Nov 27 03:02:45.467935 2025] [:error] [pid 54723:tid 54744] [client 213.21.239.4:41580] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/.git/config"] [unique_id "aSdO1Q2CEg7QoyDosdIUUAAAAA4"]
[Thu Nov 27 03:02:45.474175 2025] [:error] [pid 24826:tid 25140] [client 213.21.239.4:41610] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/.git/config;.."] [unique_id "aSdO1VEvPXLVl-nh-yL22AAAARg"]
[Thu Nov 27 03:02:45.477887 2025] [:error] [pid 8184:tid 8259] [client 213.21.239.4:41694] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/static../.git/config"] [unique_id "aSdO1b-M2IHkRYVrcbOo9gAAAFU"]
[Thu Nov 27 03:02:45.482095 2025] [:error] [pid 8184:tid 8247] [client 213.21.239.4:41562] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/.git/config"] [unique_id "aSdO1b-M2IHkRYVrcbOo9wAAAEo"]
[Thu Nov 27 03:02:45.484798 2025] [:error] [pid 54723:tid 54747] [client 213.21.239.4:41780] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/.git/config"] [unique_id "aSdO1Q2CEg7QoyDosdIUWQAAABE"]
[Thu Nov 27 03:02:45.485886 2025] [:error] [pid 8184:tid 8260] [client 213.21.239.4:41670] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/.git/config"] [unique_id "aSdO1b-M2IHkRYVrcbOo-AAAAFY"]
[Thu Nov 27 03:02:45.488954 2025] [:error] [pid 8184:tid 8253] [client 213.21.239.4:41744] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/static../.git/config"] [unique_id "aSdO1b-M2IHkRYVrcbOo-QAAAE8"]
[Thu Nov 27 03:02:45.491434 2025] [:error] [pid 8184:tid 8261] [client 213.21.239.4:41710] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uat/.git/config"] [unique_id "aSdO1b-M2IHkRYVrcbOo-gAAAFc"]
[Thu Nov 27 03:02:45.491977 2025] [:error] [pid 54723:tid 54735] [client 213.21.239.4:41788] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/.git/config"] [unique_id "aSdO1Q2CEg7QoyDosdIUWwAAAAU"]
[Thu Nov 27 03:02:45.498958 2025] [:error] [pid 24826:tid 25123] [client 213.21.239.4:41800] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/staging/.git/config"] [unique_id "aSdO1VEvPXLVl-nh-yL23AAAAQg"]
[Thu Nov 27 03:02:47.495379 2025] [:error] [pid 25262:tid 25321] [client 213.21.239.4:41820] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/windfc/.git;/config"] [unique_id "aSdO103p81VU3bYILBVaVQAAAgA"]
2026/03/10 19:32:37 [error] 14457#14457: *68276 "/usr/local/apache/htdocs/suspended-page/wp-admin/css/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /wp-admin/css/ HTTP/1.1", host: "windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:32:49 [error] 14449#14449: *68436 "/usr/local/apache/htdocs/suspended-page/.well-known/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /.well-known/ HTTP/1.1", host: "windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:33:01 [error] 14454#14454: *68607 "/usr/local/apache/htdocs/suspended-page/sites/default/files/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /sites/default/files/ HTTP/1.1", host: "windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:33:12 [error] 14441#14441: *68728 "/usr/local/apache/htdocs/suspended-page/admin/controller/extension/extension/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /admin/controller/extension/extension/ HTTP/1.1", host: "windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:33:21 [error] 14444#14444: *68824 "/usr/local/apache/htdocs/suspended-page/uploads/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /uploads/ HTTP/1.1", host: "windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:33:36 [error] 14455#14455: *68996 "/usr/local/apache/htdocs/suspended-page/images/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /images/ HTTP/1.1", host: "windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:33:51 [error] 14448#14448: *69163 "/usr/local/apache/htdocs/suspended-page/files/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /files/ HTTP/1.1", host: "windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:54:47 [error] 14438#14438: *83736 "/usr/local/apache/htdocs/suspended-page/wp-admin/css/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /wp-admin/css/ HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:54:58 [error] 14458#14458: *83867 "/usr/local/apache/htdocs/suspended-page/.well-known/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /.well-known/ HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:55:09 [error] 14458#14458: *84030 "/usr/local/apache/htdocs/suspended-page/sites/default/files/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /sites/default/files/ HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:55:23 [error] 14451#14451: *84206 "/usr/local/apache/htdocs/suspended-page/admin/controller/extension/extension/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /admin/controller/extension/extension/ HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:55:35 [error] 14441#14441: *84345 "/usr/local/apache/htdocs/suspended-page/uploads/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /uploads/ HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:55:44 [error] 14455#14455: *84439 "/usr/local/apache/htdocs/suspended-page/images/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /images/ HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/10 19:55:55 [error] 14441#14441: *84553 "/usr/local/apache/htdocs/suspended-page/files/index.html" is not found (2: No such file or directory), client: 139.59.32.166, server: windfc.windfarmcoolants.com.au, request: "GET /files/ HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au", referrer: "binance.com"
2026/03/11 06:47:10 [error] 3465#3465: *541229 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 74.7.244.55, server: windfc.windfarmcoolants.com.au, request: "GET /robots.txt HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 12:40:22 [error] 53944#53944: *748869 openat() "/usr/local/apache/htdocs/suspended-page/favicon.ico" failed (2: No such file or directory), client: 162.142.125.117, server: windfc.windfarmcoolants.com.au, request: "GET /favicon.ico HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 14:46:47 [error] 53939#53939: *825989 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 74.7.228.57, server: windfc.windfarmcoolants.com.au, request: "GET /robots.txt HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au"
2026/03/11 19:59:24 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-content/plugins/hellopress/wp_filemanager.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:24 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/nw.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /nw.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:25 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ws81.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ws81.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:25 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/vx.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /vx.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:25 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/public/wp-blog.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /public/wp-blog.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:25 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/s.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /s.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:26 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/bolt.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /bolt.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:26 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp5.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp5.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:26 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/inputs.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /inputs.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:26 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/155.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /155.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:26 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ws80.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ws80.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:27 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/t.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /t.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:27 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/bgymj.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /bgymj.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:27 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ms.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ms.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:27 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ms-edit.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ms-edit.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:27 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ws49.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ws49.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:28 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ioxi-o.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ioxi-o.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:28 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/hots.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /hots.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:28 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/666.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /666.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:28 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/hplfuns.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /hplfuns.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:28 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wen.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wen.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:29 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/gifclass.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /gifclass.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:29 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ccs.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ccs.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:29 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/a4.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /a4.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:30 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/bnm.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /bnm.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:30 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/sid3.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /sid3.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:30 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/tool.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /tool.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:30 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/222.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /222.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:31 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ws77.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ws77.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:31 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/edit.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /edit.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:31 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-the.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-the.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:31 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-blog.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-blog.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:31 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-act.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-act.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:32 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/1.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /1.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:32 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/tfm.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /tfm.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:32 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/file.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /file.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:32 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/tfm.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET //tfm.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:33 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/abc.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /abc.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:33 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/gettest.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /gettest.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:33 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/amp.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /amp.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:33 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/kj.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /kj.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:33 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/xxw.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /xxw.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:34 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/term.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /term.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:34 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ws60.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ws60.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:34 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/gfd.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /gfd.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:34 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/admin-footer.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /admin-footer.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:35 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/166.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /166.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:35 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/jga.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /jga.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:35 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-p2r3q9c8k4.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:35 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-admin/css/bolt.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-admin/css/bolt.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:35 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/myfile.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /myfile.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:36 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/sa.php7" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /sa.php7 HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:36 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ws75.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ws75.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:36 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-access.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-access.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:37 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/init.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /init.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:37 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/public/ws49.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /public/ws49.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:37 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/66.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /66.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:37 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/b.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /b.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:37 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp9.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp9.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:38 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/grsiuk.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /grsiuk.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:38 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-content/radio.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-content/radio.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:38 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/motu.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /motu.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:38 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/fs.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /fs.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:39 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ajax.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ajax.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:39 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/tx78.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /tx78.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:39 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/jp.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /jp.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:39 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-blogs.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-blogs.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:40 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/edit-tags.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /edit-tags.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:40 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-png.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-png.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:40 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wpc2.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wpc2.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:40 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/intall.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /intall.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:40 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/cu.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /cu.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:41 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/callback.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /callback.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:41 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/byypas.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /byypas.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:41 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/abrand.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /abrand.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:41 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/camara.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /camara.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:42 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/assacc.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /assacc.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:42 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ws83.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ws83.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:42 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-good.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-good.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:42 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/の.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /%E3%81%AE.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:43 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/xtsr.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /xtsr.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:43 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/zz8.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /zz8.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:43 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/mh.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /mh.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:43 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/a5.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /a5.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:43 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ai.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ai.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:44 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/amwxl.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /amwxl.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:44 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/awdld.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /awdld.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:44 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/bkyac.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /bkyac.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:44 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/krntz.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /krntz.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:45 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/vhwwnrnmqc.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /vhwwnrnmqc.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:45 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/xenium4.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /xenium4.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:45 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/vaza.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /vaza.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:45 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/8573.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /8573.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:45 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/rip.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /rip.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:46 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/drhunthq.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /drhunthq.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:46 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/sbhu.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /sbhu.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:46 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/inege.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /inege.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:46 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/ws84.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /ws84.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:46 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/c4.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /c4.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:47 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/lclnqiii.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /lclnqiii.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:47 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/goat.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /goat.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:47 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-tot.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-tot.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:47 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/wp-tap.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /wp-tap.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:48 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/vrhiw.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /vrhiw.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:48 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/qqjki.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /qqjki.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/11 19:59:48 [error] 53947#53947: *1052803 openat() "/usr/local/apache/htdocs/suspended-page/koiy.php" failed (2: No such file or directory), client: 20.151.107.165, server: windfc.windfarmcoolants.com.au, request: "GET /koiy.php HTTP/1.1", host: "windfc.windfarmcoolants.com.au"
2026/03/12 00:42:34 [error] 53500#53500: *1257309 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 44.251.92.56, server: windfc.windfarmcoolants.com.au, request: "GET /robots.txt HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au"
2026/03/12 05:45:03 [error] 58923#58923: *1430021 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 192.177.58.186, server: windfc.windfarmcoolants.com.au, request: "GET /robots.txt HTTP/1.1", host: "www.windfc.windfarmcoolants.com.au", referrer: "https://www.windfc.windfarmcoolants.com.au/"
2026/03/12 05:45:04 [error] 58922#58922: *1430028 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 104.37.27.149, server: windfc.windfarmcoolants.com.au, request: "GET /robots.txt HTTP/1.1", host: "windfc.windfarmcoolants.com.au", referrer: "https://windfc.windfarmcoolants.com.au/"
[Thu Mar 12 08:20:25.467759 2026] [:error] [pid 51456:tid 51491] [client 34.48.116.172:38526] [client 34.48.116.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "abIGyRXu8LzVixNGr0s2yQAAAEQ"]
[Thu Mar 12 22:30:54.001715 2026] [:error] [pid 11986:tid 12030] [client 35.237.6.187:42714] [client 35.237.6.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "abLOHjKqY2w-DVCrxTA29wAAAcw"]
[Fri Mar 13 01:38:27.902508 2026] [:error] [pid 48029:tid 48035] [client 20.194.2.185:15267] File does not exist: /usr/local/apache/htdocs/suspended-page/xmr.php
[Fri Mar 13 01:38:28.041866 2026] [:error] [pid 48029:tid 48041] [client 20.194.2.185:15267] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Mar 13 01:38:28.180502 2026] [:error] [pid 48029:tid 48034] [client 20.194.2.185:15267] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Mar 13 01:38:28.319472 2026] [:error] [pid 48029:tid 48044] [client 20.194.2.185:15267] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Mar 13 01:38:28.459681 2026] [:error] [pid 48029:tid 48036] [client 20.194.2.185:15267] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Mar 13 01:38:28.597917 2026] [:error] [pid 48029:tid 48048] [client 20.194.2.185:15267] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Mar 13 01:38:28.733537 2026] [:error] [pid 48029:tid 48046] [client 20.194.2.185:15267] [client 20.194.2.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/"] [unique_id "abL6FG7cFKMmtdGhPH_HQwAAAA8"]
[Fri Mar 13 01:38:29.273473 2026] [:error] [pid 48029:tid 48045] [client 20.194.2.185:16774] [client 20.194.2.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/"] [unique_id "abL6FW7cFKMmtdGhPH_HRgAAAA4"]
[Fri Mar 13 01:38:29.818149 2026] [:error] [pid 48029:tid 48053] [client 20.194.2.185:7543] [client 20.194.2.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/"] [unique_id "abL6FW7cFKMmtdGhPH_HRwAAABY"]
[Fri Mar 13 01:38:30.362030 2026] [:error] [pid 48029:tid 48031] [client 20.194.2.185:12980] [client 20.194.2.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/"] [unique_id "abL6Fm7cFKMmtdGhPH_HSQAAAAA"]
[Fri Mar 13 01:45:29.717605 2026] [:error] [pid 56003:tid 56029] [client 157.230.169.220:62029] [client 157.230.169.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.169.220, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "abL7uRQtM0oeMdFWe6Vv0gAAANg"]
[Fri Mar 13 01:45:29.720439 2026] [:error] [pid 56003:tid 56029] [client 157.230.169.220:62029] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 13 01:45:30.948710 2026] [:error] [pid 56003:tid 56007] [client 157.230.169.220:62382] [client 157.230.169.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.169.220, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "abL7uhQtM0oeMdFWe6Vv4gAAAMI"]
[Fri Mar 13 01:45:30.952612 2026] [:error] [pid 56003:tid 56007] [client 157.230.169.220:62382] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 13 22:02:53.115190 2026] [:error] [pid 60398:tid 60414] [client 104.28.166.127:26093] [client 104.28.166.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "abQZDUCJdGSTt6QlH2BQuwAAAos"]
[Sat Mar 14 00:16:17.926413 2026] [:error] [pid 60436:tid 60487] [client 20.151.4.179:29273] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abQ4UYI3PEddCArY1Aa-TgAAAxI"]
[Sat Mar 14 00:16:18.757612 2026] [:error] [pid 60436:tid 60478] [client 20.151.4.179:29311] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abQ4UoI3PEddCArY1Aa-UAAAAwk"]
[Sat Mar 14 00:16:19.606503 2026] [:error] [pid 60436:tid 60483] [client 20.151.4.179:29278] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abQ4U4I3PEddCArY1Aa-UQAAAw4"]
[Sat Mar 14 00:16:20.435657 2026] [:error] [pid 60496:tid 60520] [client 20.151.4.179:28995] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/hp2.php"] [unique_id "abQ4VAb67oGiJ3jaL8w6aAAAA1A"]
[Sat Mar 14 00:19:49.735455 2026] [:error] [pid 47878:tid 47953] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sat Mar 14 00:19:49.946261 2026] [:error] [pid 47878:tid 47955] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Mar 14 00:19:50.159601 2026] [:error] [pid 47878:tid 47953] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Mar 14 00:19:50.369831 2026] [:error] [pid 47878:tid 47944] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Mar 14 00:19:50.580891 2026] [:error] [pid 47878:tid 47954] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Mar 14 00:19:50.790365 2026] [:error] [pid 47878:tid 47960] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Sat Mar 14 00:19:51.000594 2026] [:error] [pid 47878:tid 47956] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sat Mar 14 00:19:51.211387 2026] [:error] [pid 47878:tid 47959] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/nux.php
[Sat Mar 14 00:19:51.437853 2026] [:error] [pid 47878:tid 47943] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Sat Mar 14 00:19:51.648668 2026] [:error] [pid 47878:tid 47952] [client 4.204.233.55:12623] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sat Mar 14 00:19:51.855499 2026] [:error] [pid 47878:tid 47951] [client 4.204.233.55:12623] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chati.php"] [unique_id "abQ5J38jymmmpr1jcBebzQAAAEw"]
[Sat Mar 14 00:19:52.682751 2026] [:error] [pid 47891:tid 47973] [client 4.204.233.55:12964] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chati.php"] [unique_id "abQ5KPchNnuMqi7I_WHiagAAAIc"]
[Sat Mar 14 00:19:53.522797 2026] [:error] [pid 47891:tid 47974] [client 4.204.233.55:12986] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chati.php"] [unique_id "abQ5KfchNnuMqi7I_WHibAAAAIg"]
[Sat Mar 14 00:19:54.355284 2026] [:error] [pid 47891:tid 47977] [client 4.204.233.55:12962] [client 4.204.233.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chati.php"] [unique_id "abQ5KvchNnuMqi7I_WHibgAAAIs"]
[Sat Mar 14 00:42:51.391083 2026] [:error] [pid 47878:tid 47956] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sat Mar 14 00:42:51.605839 2026] [:error] [pid 47878:tid 47951] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Mar 14 00:42:51.815643 2026] [:error] [pid 47878:tid 47946] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Mar 14 00:42:52.025608 2026] [:error] [pid 47878:tid 47942] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Mar 14 00:42:52.235693 2026] [:error] [pid 47878:tid 47945] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Mar 14 00:42:52.445741 2026] [:error] [pid 47878:tid 47960] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Sat Mar 14 00:42:52.655596 2026] [:error] [pid 47878:tid 47943] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sat Mar 14 00:42:52.866389 2026] [:error] [pid 47878:tid 47954] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/nux.php
[Sat Mar 14 00:42:53.076411 2026] [:error] [pid 47878:tid 47948] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Sat Mar 14 00:42:53.286592 2026] [:error] [pid 47878:tid 47939] [client 20.151.4.179:63559] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sat Mar 14 00:42:53.493264 2026] [:error] [pid 47878:tid 47953] [client 20.151.4.179:63559] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chati.php"] [unique_id "abQ-jX8jymmmpr1jcBehLAAAAE4"]
[Sat Mar 14 00:42:54.323731 2026] [:error] [pid 47905:tid 48011] [client 20.151.4.179:63554] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chati.php"] [unique_id "abQ-jhaYZayP4o4wpJcO6AAAAVI"]
[Sat Mar 14 00:42:55.151831 2026] [:error] [pid 47905:tid 48009] [client 20.151.4.179:63612] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chati.php"] [unique_id "abQ-jxaYZayP4o4wpJcO6wAAAVA"]
[Sat Mar 14 00:42:55.982932 2026] [:error] [pid 47891:tid 47982] [client 20.151.4.179:59977] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chati.php"] [unique_id "abQ-j_chNnuMqi7I_WHo3QAAAJA"]
[Sat Mar 14 01:33:17.728297 2026] [:error] [pid 48070:tid 48074] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Mar 14 01:33:17.937647 2026] [:error] [pid 48070:tid 48072] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Mar 14 01:33:18.147062 2026] [:error] [pid 48070:tid 48077] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Sat Mar 14 01:33:18.360194 2026] [:error] [pid 48070:tid 48082] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Mar 14 01:33:18.569426 2026] [:error] [pid 48070:tid 48084] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Mar 14 01:33:18.778481 2026] [:error] [pid 48070:tid 48088] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sat Mar 14 01:33:18.987538 2026] [:error] [pid 48070:tid 48087] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/y.php
[Sat Mar 14 01:33:19.196823 2026] [:error] [pid 48070:tid 48083] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Sat Mar 14 01:33:19.621807 2026] [:error] [pid 48070:tid 48079] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Mar 14 01:33:19.830844 2026] [:error] [pid 48070:tid 48073] [client 20.151.4.179:42713] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sat Mar 14 01:33:20.040691 2026] [:error] [pid 48070:tid 48080] [client 20.151.4.179:42713] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "abRKYEIvrhMS5BVHxNkhQQAAAAg"]
[Sat Mar 14 01:33:20.897473 2026] [:error] [pid 47891:tid 47974] [client 20.151.4.179:42748] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "abRKYPchNnuMqi7I_WH5egAAAIg"]
[Sat Mar 14 01:33:21.783723 2026] [:error] [pid 47905:tid 47994] [client 20.151.4.179:42711] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "abRKYRaYZayP4o4wpJclJgAAAUE"]
[Sat Mar 14 01:33:22.656965 2026] [:error] [pid 47878:tid 47960] [client 20.151.4.179:42720] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "abRKYn8jymmmpr1jcBeunAAAAFU"]
[Sat Mar 14 13:07:28.185179 2026] [:error] [pid 54017:tid 54044] [client 185.137.164.13:48137] [client 185.137.164.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "abTtEJh88Lk5QZp0lWWAigAAAlQ"]
[Sat Mar 14 13:07:28.950440 2026] [:error] [pid 13360:tid 13382] [client 185.137.164.18:30131] [client 185.137.164.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "abTtEPoSWtMry3M5X6v2RwAAApI"]
[Sat Mar 14 17:09:56.905097 2026] [:error] [pid 30154:tid 30170] [client 192.227.138.144:53124] [client 192.227.138.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||windfc.windfarmcoolants.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "abUl5F6OP9woRgp3v0E5jgAAAMo"], referer: https://www.google.com
[Sun Mar 15 04:51:33.946376 2026] [:error] [pid 9995:tid 10017] [client 20.205.99.175:26117] File does not exist: /usr/local/apache/htdocs/suspended-page/xmr.php
[Sun Mar 15 04:51:34.069159 2026] [:error] [pid 9995:tid 10009] [client 20.205.99.175:26117] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 15 04:51:34.191805 2026] [:error] [pid 9995:tid 10011] [client 20.205.99.175:26117] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 15 04:51:34.315540 2026] [:error] [pid 9995:tid 10001] [client 20.205.99.175:26117] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 15 04:51:34.438962 2026] [:error] [pid 9995:tid 10014] [client 20.205.99.175:26117] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Mar 15 04:51:34.572228 2026] [:error] [pid 9995:tid 10005] [client 20.205.99.175:26117] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sun Mar 15 04:51:34.695219 2026] [:error] [pid 9995:tid 10015] [client 20.205.99.175:26117] [client 20.205.99.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/"] [unique_id "abXKVga8xkcaSmgTbwjMzQAAARE"]
[Sun Mar 15 04:51:35.200966 2026] [:error] [pid 9995:tid 10010] [client 20.205.99.175:20268] [client 20.205.99.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/"] [unique_id "abXKVwa8xkcaSmgTbwjM0AAAAQw"]
[Sun Mar 15 04:51:35.674306 2026] [:error] [pid 9995:tid 10013] [client 20.205.99.175:6870] [client 20.205.99.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/"] [unique_id "abXKVwa8xkcaSmgTbwjM0wAAAQ8"]
[Sun Mar 15 04:51:36.161336 2026] [:error] [pid 38645:tid 38665] [client 20.205.99.175:6858] [client 20.205.99.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/"] [unique_id "abXKWBFPHtsDUuVrWDZYHgAAANI"]
[Sun Mar 15 09:44:46.218759 2026] [:error] [pid 38645:tid 38652] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 15 09:44:46.340843 2026] [:error] [pid 38645:tid 38660] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/ammika.php
[Sun Mar 15 09:44:46.465901 2026] [:error] [pid 38645:tid 38650] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Mar 15 09:44:46.586799 2026] [:error] [pid 38645:tid 38648] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 15 09:44:46.705115 2026] [:error] [pid 38645:tid 38669] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 15 09:44:46.822262 2026] [:error] [pid 38645:tid 38668] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sun Mar 15 09:44:46.940120 2026] [:error] [pid 38645:tid 38665] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sun Mar 15 09:44:47.064780 2026] [:error] [pid 38645:tid 38649] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Mar 15 09:44:47.184604 2026] [:error] [pid 38645:tid 38664] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Sun Mar 15 09:44:47.301901 2026] [:error] [pid 38645:tid 38659] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 15 09:44:47.419972 2026] [:error] [pid 38645:tid 38666] [client 52.243.60.223:25931] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Mar 15 09:44:47.534364 2026] [:error] [pid 38645:tid 38651] [client 52.243.60.223:25931] [client 52.243.60.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "abYPDxFPHtsDUuVrWDaaZQAAAMQ"]
[Sun Mar 15 09:44:48.023466 2026] [:error] [pid 50986:tid 50993] [client 52.243.60.223:25739] [client 52.243.60.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "abYPECknK4c779bcQqHF2gAAAUU"]
[Sun Mar 15 09:44:48.620121 2026] [:error] [pid 38540:tid 38592] [client 52.243.60.223:27417] [client 52.243.60.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "abYPEF8bnHsJ1dE90bIQ7gAAAEY"]
[Sun Mar 15 09:44:49.078120 2026] [:error] [pid 38645:tid 38658] [client 52.243.60.223:27432] [client 52.243.60.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "abYPERFPHtsDUuVrWDaaZwAAAMs"]
[Mon Mar 16 00:24:40.818091 2026] [:error] [pid 60679:tid 60791] [client 104.28.246.112:55952] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "abbdSJnX8fEKZeqoouEOtgAAAEw"]
[Mon Mar 16 00:24:41.237394 2026] [:error] [pid 60666:tid 60765] [client 104.28.246.112:55954] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/style.php"] [unique_id "abbdSRLlrGpRCJDg8VLc1gAAAA0"]
[Mon Mar 16 00:25:01.970709 2026] [:error] [pid 60694:tid 60808] [client 104.28.163.77:45849] [client 104.28.163.77] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "abbdXWEURh3k32p5sFJtFwAAAII"]
[Mon Mar 16 22:53:46.882677 2026] [:error] [pid 1871:tid 1876] [client 20.120.91.203:40046] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 16 22:53:47.228586 2026] [:error] [pid 1871:tid 1874] [client 20.120.91.203:40046] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 16 22:53:47.655100 2026] [:error] [pid 1871:tid 1887] [client 20.120.91.203:40046] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Mar 16 22:53:47.868114 2026] [:error] [pid 1871:tid 1886] [client 20.120.91.203:40046] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 16 22:53:48.303419 2026] [:error] [pid 1871:tid 1878] [client 20.120.91.203:40046] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Mar 16 22:53:48.514761 2026] [:error] [pid 1871:tid 1885] [client 20.120.91.203:40046] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Mar 16 22:53:48.796204 2026] [:error] [pid 1871:tid 1882] [client 20.120.91.203:40046] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Mar 16 22:53:49.293124 2026] [:error] [pid 1871:tid 1894] [client 20.120.91.203:40046] [client 20.120.91.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abgZfTinTnZ8uiUPekGN3wAAAZU"]
[Mon Mar 16 22:53:56.520702 2026] [:error] [pid 36198:tid 36201] [client 20.120.91.203:40024] [client 20.120.91.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abgZhOlL1GNckmsdWlNoKgAAAQA"]
[Mon Mar 16 22:53:58.526958 2026] [:error] [pid 35929:tid 35946] [client 20.120.91.203:13733] [client 20.120.91.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abgZhtW47dGpmA63hwS-vAAAAM8"]
[Mon Mar 16 22:54:01.773428 2026] [:error] [pid 39154:tid 39166] [client 20.120.91.203:13505] [client 20.120.91.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "abgZiRgq1_qjm7J1LqtMLQAAAUk"]
[Wed Mar 18 03:09:56.560572 2026] [:error] [pid 63412:tid 63436] [client 20.116.1.191:18424] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Mar 18 03:09:56.981214 2026] [:error] [pid 63412:tid 63419] [client 20.116.1.191:18424] [client 20.116.1.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.1.191, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abmnBDKUzzFOGoXRLQ_XagAAAMM"]
[Wed Mar 18 03:09:57.197683 2026] [:error] [pid 63412:tid 63437] [client 20.116.1.191:18424] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Wed Mar 18 03:09:58.037172 2026] [:error] [pid 63412:tid 63429] [client 20.116.1.191:18424] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Wed Mar 18 03:09:58.719152 2026] [:error] [pid 63412:tid 63416] [client 20.116.1.191:18424] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Mar 18 03:09:58.998846 2026] [:error] [pid 63412:tid 63435] [client 20.116.1.191:18424] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abmnBjKUzzFOGoXRLQ_XewAAANM"]
[Wed Mar 18 03:10:03.522653 2026] [:error] [pid 40716:tid 41044] [client 20.116.1.191:18108] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abmnCxR6i4ByUuhUBASe0AAAAFc"]
[Wed Mar 18 03:10:07.953896 2026] [:error] [pid 40716:tid 41035] [client 20.116.1.191:55405] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abmnDxR6i4ByUuhUBASe1QAAAE4"]
[Wed Mar 18 03:10:10.308775 2026] [:error] [pid 63449:tid 63451] [client 20.116.1.191:18390] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abmnEgplutP4IZ5mr13vjgAAAUA"]
[Wed Mar 18 08:36:51.879610 2026] [:error] [pid 30648:tid 30668] [client 20.78.145.167:1641] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Wed Mar 18 08:36:52.008856 2026] [:error] [pid 30648:tid 30672] [client 20.78.145.167:1641] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Wed Mar 18 08:36:52.133416 2026] [:error] [pid 30648:tid 30662] [client 20.78.145.167:1641] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Mar 18 08:36:52.517931 2026] [:error] [pid 30648:tid 30657] [client 20.78.145.167:1641] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 18 08:36:52.651222 2026] [:error] [pid 30648:tid 30671] [client 20.78.145.167:1641] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Mar 18 08:36:52.901923 2026] [:error] [pid 30648:tid 30665] [client 20.78.145.167:1641] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Mar 18 08:36:53.276404 2026] [:error] [pid 30648:tid 30654] [client 20.78.145.167:1641] [client 20.78.145.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "abnzpQPR9mHejEczjojEYQAAAAI"]
[Wed Mar 18 08:36:53.790067 2026] [:error] [pid 30649:tid 30692] [client 20.78.145.167:1609] [client 20.78.145.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "abnzpZVMiEiN8KB1tN5wLgAAAI0"]
[Wed Mar 18 08:36:54.281209 2026] [:error] [pid 30714:tid 30728] [client 20.78.145.167:1661] [client 20.78.145.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "abnzplCwje2YoheelQamrwAAAco"]
[Wed Mar 18 08:36:54.794061 2026] [:error] [pid 30649:tid 30684] [client 20.78.145.167:13073] [client 20.78.145.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "abnzppVMiEiN8KB1tN5wMAAAAIU"]
[Wed Mar 18 10:36:55.845884 2026] [:error] [pid 42870:tid 42891] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 18 10:36:55.955020 2026] [:error] [pid 42870:tid 42885] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/lite.php
[Wed Mar 18 10:36:56.046499 2026] [:error] [pid 42870:tid 42888] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Mar 18 10:36:56.137721 2026] [:error] [pid 42870:tid 42900] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 18 10:36:56.229821 2026] [:error] [pid 42870:tid 42908] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Mar 18 10:36:56.509870 2026] [:error] [pid 42870:tid 42906] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Mar 18 10:36:56.601664 2026] [:error] [pid 42870:tid 42902] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Wed Mar 18 10:36:56.694816 2026] [:error] [pid 42870:tid 42901] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Mar 18 10:36:56.790913 2026] [:error] [pid 42870:tid 42903] [client 4.194.59.74:17162] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Mar 18 10:36:56.879312 2026] [:error] [pid 42870:tid 42893] [client 4.194.59.74:17162] [client 4.194.59.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "aboPyJ6axlAooiuYyUxXugAAAAg"]
[Wed Mar 18 10:36:57.253042 2026] [:error] [pid 42871:tid 42915] [client 4.194.59.74:11369] [client 4.194.59.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "aboPyWPUS0lM1M9nUaKTyQAAAIE"]
[Wed Mar 18 10:36:57.629180 2026] [:error] [pid 42871:tid 42927] [client 4.194.59.74:11367] [client 4.194.59.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "aboPyWPUS0lM1M9nUaKTywAAAI0"]
[Wed Mar 18 10:36:58.015863 2026] [:error] [pid 42970:tid 42987] [client 4.194.59.74:17201] [client 4.194.59.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "aboPyo5YFUj4vBJI0KTLfAAAAM8"]
[Wed Mar 18 11:16:14.437780 2026] [:error] [pid 42872:tid 42958] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 18 11:16:14.578745 2026] [:error] [pid 42872:tid 42941] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/lite.php
[Wed Mar 18 11:16:14.721319 2026] [:error] [pid 42872:tid 42943] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Mar 18 11:16:14.865338 2026] [:error] [pid 42872:tid 42944] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 18 11:16:15.007715 2026] [:error] [pid 42872:tid 42964] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Mar 18 11:16:15.432291 2026] [:error] [pid 42872:tid 42955] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Mar 18 11:16:15.574492 2026] [:error] [pid 42872:tid 42947] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Wed Mar 18 11:16:15.715137 2026] [:error] [pid 42872:tid 42965] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Mar 18 11:16:15.879182 2026] [:error] [pid 42872:tid 42959] [client 52.140.125.218:1913] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Mar 18 11:16:16.016639 2026] [:error] [pid 42872:tid 42949] [client 52.140.125.218:1913] [client 52.140.125.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "aboZADchM8PQMaMEWJmHagAAAcg"]
[Wed Mar 18 11:16:16.584350 2026] [:error] [pid 31232:tid 31236] [client 52.140.125.218:33764] [client 52.140.125.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "aboZAGX6HV7dqh3BQD14egAAAEE"]
[Wed Mar 18 11:16:17.148025 2026] [:error] [pid 43009:tid 43019] [client 52.140.125.218:32713] [client 52.140.125.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "aboZAX8aUp4Sm6m3nmPLogAAAQg"]
[Wed Mar 18 11:16:17.712445 2026] [:error] [pid 31232:tid 31238] [client 52.140.125.218:32382] [client 52.140.125.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "aboZAWX6HV7dqh3BQD14gAAAAEM"]
[Thu Mar 19 02:03:26.405940 2026] [:error] [pid 41180:tid 41203] [client 20.48.234.9:50197] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Mar 19 02:03:26.835386 2026] [:error] [pid 41180:tid 41190] [client 20.48.234.9:50197] [client 20.48.234.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.48.234.9, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abro7ruSQ3z2YqXgnyck3gAAAMg"]
[Thu Mar 19 02:03:27.055619 2026] [:error] [pid 41180:tid 41187] [client 20.48.234.9:50197] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Thu Mar 19 02:03:28.011107 2026] [:error] [pid 41180:tid 41186] [client 20.48.234.9:50197] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Thu Mar 19 02:03:28.805569 2026] [:error] [pid 41180:tid 41199] [client 20.48.234.9:50197] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Mar 19 02:03:29.072298 2026] [:error] [pid 41180:tid 41190] [client 20.48.234.9:50197] [client 20.48.234.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abro8buSQ3z2YqXgnyck6wAAAMg"]
[Thu Mar 19 02:03:30.412636 2026] [:error] [pid 41180:tid 41198] [client 20.48.234.9:51151] [client 20.48.234.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abro8ruSQ3z2YqXgnyck9wAAANA"]
[Thu Mar 19 02:03:32.882683 2026] [:error] [pid 41180:tid 41191] [client 20.48.234.9:51140] [client 20.48.234.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abro9LuSQ3z2YqXgnyclAwAAAMk"]
[Thu Mar 19 02:03:36.209978 2026] [:error] [pid 19431:tid 19489] [client 20.48.234.9:50215] [client 20.48.234.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abro-DioVgnJ_ZdBjcuItQAAAEQ"]
[Thu Mar 19 22:18:59.101691 2026] [:error] [pid 1397:tid 1406] [client 34.139.95.246:64433] [client 34.139.95.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.139.95.246, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "abwF03ptc6vBjy-kgOMllgAAAsc"]
[Thu Mar 19 22:18:59.104941 2026] [:error] [pid 1397:tid 1406] [client 34.139.95.246:64433] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Mar 19 22:18:59.811784 2026] [:error] [pid 1397:tid 1399] [client 34.139.95.246:64433] [client 34.139.95.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "abwF03ptc6vBjy-kgOMlowAAAsA"]
[Thu Mar 19 22:19:00.257895 2026] [:error] [pid 11110:tid 11133] [client 34.139.95.246:61939] [client 34.139.95.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "abwF1ASNPqGfikw7k8LONwAAABI"]
[Thu Mar 19 22:19:00.724855 2026] [:error] [pid 11015:tid 11056] [client 34.139.95.246:57878] [client 34.139.95.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "abwF1PPcMwFQZAVfzLSSEAAAAIo"]
[Thu Mar 19 22:19:01.202953 2026] [:error] [pid 1285:tid 1303] [client 34.139.95.246:62180] [client 34.139.95.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "abwF1VE95r3zR75X1HpY1wAAAhA"]
[Fri Mar 20 01:58:32.076640 2026] [:error] [pid 46264:tid 46291] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Mar 20 01:58:32.197807 2026] [:error] [pid 46264:tid 46288] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/lite.php
[Fri Mar 20 01:58:32.326757 2026] [:error] [pid 46264:tid 46301] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Mar 20 01:58:32.447569 2026] [:error] [pid 46264:tid 46283] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Mar 20 01:58:32.568348 2026] [:error] [pid 46264:tid 46296] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Mar 20 01:58:32.961881 2026] [:error] [pid 46264:tid 46305] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Mar 20 01:58:33.083659 2026] [:error] [pid 46264:tid 46292] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Fri Mar 20 01:58:33.205266 2026] [:error] [pid 46264:tid 46291] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Mar 20 01:58:33.338476 2026] [:error] [pid 46264:tid 46287] [client 104.208.81.111:2110] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Mar 20 01:58:33.456876 2026] [:error] [pid 46264:tid 46283] [client 104.208.81.111:2110] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "abw5SYp3TruHFmWOt5HxdwAAAAA"]
[Fri Mar 20 01:58:33.944630 2026] [:error] [pid 46264:tid 46296] [client 104.208.81.111:4116] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "abw5SYp3TruHFmWOt5HxegAAAA0"]
[Fri Mar 20 01:58:34.946739 2026] [:error] [pid 46264:tid 46291] [client 104.208.81.111:5624] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "abw5Sop3TruHFmWOt5HxggAAAAg"]
[Fri Mar 20 01:58:35.425216 2026] [:error] [pid 11258:tid 11270] [client 104.208.81.111:5591] [client 104.208.81.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/"] [unique_id "abw5S5PHb95f6xzHJOcokwAAAMo"]
[Fri Mar 20 04:38:22.139400 2026] [:error] [pid 58125:tid 58160] [client 64.89.163.113:51647] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "abxevvKqkvJQoqsQGeVS-AAAABA"]
[Fri Mar 20 04:38:23.185175 2026] [:error] [pid 58125:tid 58149] [client 64.89.163.113:59217] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "abxev_KqkvJQoqsQGeVTLwAAAAU"]
[Fri Mar 20 04:38:23.946196 2026] [:error] [pid 58126:tid 58172] [client 64.89.163.113:51416] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "abxev6KAmdXQSS0Y5KBEpgAAAEA"]
[Fri Mar 20 04:38:25.000994 2026] [:error] [pid 58126:tid 58182] [client 64.89.163.113:62496] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "abxewKKAmdXQSS0Y5KBEtgAAAEo"]
[Fri Mar 20 04:38:26.061227 2026] [:error] [pid 58127:tid 58216] [client 64.89.163.113:57537] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "abxewrQ_HbYy8C6I_EHZVgAAAJE"]
[Fri Mar 20 10:13:06.689168 2026] [:error] [pid 51714:tid 51739] [client 4.193.168.228:11311] File does not exist: /usr/local/apache/htdocs/suspended-page/xmr.php
[Fri Mar 20 10:13:06.781407 2026] [:error] [pid 51714:tid 51719] [client 4.193.168.228:11311] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Fri Mar 20 10:13:06.873872 2026] [:error] [pid 51714:tid 51725] [client 4.193.168.228:11311] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Mar 20 10:13:08.501644 2026] [:error] [pid 51714:tid 51726] [client 4.193.168.228:11311] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Mar 20 10:13:08.593998 2026] [:error] [pid 51714:tid 51733] [client 4.193.168.228:11311] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Fri Mar 20 10:13:08.686198 2026] [:error] [pid 51714:tid 51738] [client 4.193.168.228:11311] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Fri Mar 20 10:13:08.774561 2026] [:error] [pid 51714:tid 51719] [client 4.193.168.228:11311] [client 4.193.168.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/root.php"] [unique_id "abytNDWI82pxvQ0gksse-QAAAIM"]
[Fri Mar 20 10:13:09.130947 2026] [:error] [pid 51714:tid 51718] [client 4.193.168.228:16386] [client 4.193.168.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/root.php"] [unique_id "abytNTWI82pxvQ0gksse-wAAAII"]
[Fri Mar 20 10:13:09.488503 2026] [:error] [pid 49170:tid 49174] [client 4.193.168.228:17205] [client 4.193.168.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/root.php"] [unique_id "abytNc-c8ctLVDCqUJWzKAAAAAA"]
[Fri Mar 20 10:13:09.840576 2026] [:error] [pid 51714:tid 51727] [client 4.193.168.228:11318] [client 4.193.168.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/root.php"] [unique_id "abytNTWI82pxvQ0gksse_gAAAIs"]
[Fri Mar 20 13:17:41.413572 2026] [:error] [pid 49081:tid 49134] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Mar 20 13:17:41.508411 2026] [:error] [pid 49081:tid 49125] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Fri Mar 20 13:17:41.601255 2026] [:error] [pid 49081:tid 49137] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Mar 20 13:17:41.694914 2026] [:error] [pid 49081:tid 49116] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/xmr.php
[Fri Mar 20 13:17:41.788246 2026] [:error] [pid 49081:tid 49138] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Mar 20 13:17:41.881885 2026] [:error] [pid 49081:tid 49121] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Mar 20 13:17:41.977288 2026] [:error] [pid 49081:tid 49126] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Mar 20 13:17:42.086301 2026] [:error] [pid 49081:tid 49139] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Mar 20 13:17:43.867294 2026] [:error] [pid 49081:tid 49132] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Mar 20 13:17:43.960059 2026] [:error] [pid 49081:tid 49130] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/detail.php
[Fri Mar 20 13:17:44.080052 2026] [:error] [pid 49081:tid 49138] [client 4.193.168.228:30912] File does not exist: /usr/local/apache/htdocs/suspended-page/demo.php
[Fri Mar 20 13:17:44.170311 2026] [:error] [pid 49081:tid 49129] [client 4.193.168.228:30912] [client 4.193.168.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ds.php"] [unique_id "abzYeBo1LBAUhfhYPR2QogAAAQ4"]
[Fri Mar 20 13:17:44.533767 2026] [:error] [pid 49081:tid 49126] [client 4.193.168.228:30932] [client 4.193.168.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ds.php"] [unique_id "abzYeBo1LBAUhfhYPR2QpAAAAQs"]
[Fri Mar 20 13:17:44.912917 2026] [:error] [pid 49170:tid 49191] [client 4.193.168.228:19534] [client 4.193.168.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ds.php"] [unique_id "abzYeM-c8ctLVDCqUJUJCAAAABE"]
[Fri Mar 20 13:17:45.294006 2026] [:error] [pid 49081:tid 49132] [client 4.193.168.228:34621] [client 4.193.168.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ds.php"] [unique_id "abzYeRo1LBAUhfhYPR2QqQAAARE"]
[Fri Mar 20 20:38:19.239208 2026] [:error] [pid 49082:tid 49165] [client 141.98.11.17:54457] [client 141.98.11.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uploads/"] [unique_id "ab0_u6pllYJI1LUIdL_BdAAAAVc"], referer: binance.com
[Fri Mar 20 20:38:22.940595 2026] [:error] [pid 38378:tid 38390] [client 141.98.11.17:56061] [client 141.98.11.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/"] [unique_id "ab0_vlKb3npPsu9Iib11EgAAAgg"], referer: binance.com
[Fri Mar 20 20:38:29.407797 2026] [:error] [pid 49170:tid 49192] [client 141.98.11.17:54591] [client 141.98.11.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/files/"] [unique_id "ab0_xc-c8ctLVDCqUJWGXgAAABI"], referer: binance.com
[Sat Mar 21 07:24:57.134944 2026] [:error] [pid 1601:tid 1626] [client 45.89.60.157:57312] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Sun Mar 22 02:21:31.851485 2026] [:error] [pid 41061:tid 41070] [client 52.138.39.105:13064] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sun Mar 22 02:21:32.079338 2026] [:error] [pid 41061:tid 41067] [client 52.138.39.105:13064] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sun Mar 22 02:21:32.289798 2026] [:error] [pid 41061:tid 41083] [client 52.138.39.105:13064] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 22 02:21:32.498136 2026] [:error] [pid 41061:tid 41077] [client 52.138.39.105:13064] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Sun Mar 22 02:21:32.724572 2026] [:error] [pid 41061:tid 41081] [client 52.138.39.105:13064] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Sun Mar 22 02:21:33.143637 2026] [:error] [pid 41061:tid 41073] [client 52.138.39.105:13064] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sun Mar 22 02:21:33.357367 2026] [:error] [pid 41061:tid 41067] [client 52.138.39.105:13064] File does not exist: /usr/local/apache/htdocs/suspended-page/wa.php
[Sun Mar 22 02:21:33.778288 2026] [:error] [pid 41061:tid 41082] [client 52.138.39.105:13064] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sun Mar 22 02:21:34.193911 2026] [:error] [pid 41061:tid 41072] [client 52.138.39.105:13064] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab7hrqksT6woy-Od6iHrVgAAAMg"]
[Sun Mar 22 02:21:35.025714 2026] [:error] [pid 40782:tid 41037] [client 52.138.39.105:13060] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab7hr-aE0aGWZHNA90uPpAAAAIQ"]
[Sun Mar 22 02:21:35.871716 2026] [:error] [pid 41061:tid 41067] [client 52.138.39.105:13087] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab7hr6ksT6woy-Od6iHrXQAAAMM"]
[Sun Mar 22 02:21:36.742287 2026] [:error] [pid 40782:tid 41055] [client 52.138.39.105:12812] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab7hsOaE0aGWZHNA90uPqAAAAJY"]
[Sun Mar 22 12:09:05.692796 2026] [:error] [pid 40039:tid 40055] [client 52.138.39.105:43156] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sun Mar 22 12:09:05.904360 2026] [:error] [pid 40039:tid 40044] [client 52.138.39.105:43156] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sun Mar 22 12:09:06.114361 2026] [:error] [pid 40039:tid 40056] [client 52.138.39.105:43156] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 22 12:09:06.324860 2026] [:error] [pid 40039:tid 40047] [client 52.138.39.105:43156] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Sun Mar 22 12:09:06.534116 2026] [:error] [pid 40039:tid 40050] [client 52.138.39.105:43156] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Sun Mar 22 12:09:06.953423 2026] [:error] [pid 40039:tid 40055] [client 52.138.39.105:43156] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sun Mar 22 12:09:07.163293 2026] [:error] [pid 40039:tid 40049] [client 52.138.39.105:43156] File does not exist: /usr/local/apache/htdocs/suspended-page/wa.php
[Sun Mar 22 12:09:07.589624 2026] [:error] [pid 40039:tid 40047] [client 52.138.39.105:43156] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sun Mar 22 12:09:08.005479 2026] [:error] [pid 40039:tid 40045] [client 52.138.39.105:43156] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab9rZB3aDgUJfBYishn2OQAAAQQ"]
[Sun Mar 22 12:09:08.861321 2026] [:error] [pid 40039:tid 40058] [client 52.138.39.105:49650] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab9rZB3aDgUJfBYishn2PQAAARE"]
[Sun Mar 22 12:09:09.685841 2026] [:error] [pid 40039:tid 40047] [client 52.138.39.105:47942] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab9rZR3aDgUJfBYishn2QgAAAQY"]
[Sun Mar 22 12:09:10.517415 2026] [:error] [pid 51468:tid 51497] [client 52.138.39.105:47944] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab9rZk2TppSvA8W5CBRFPwAAANU"]
[Sun Mar 22 21:16:40.371596 2026] [:error] [pid 51361:tid 51388] [client 20.63.98.69:14771] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Mar 22 21:16:40.789003 2026] [:error] [pid 51361:tid 51385] [client 20.63.98.69:14771] [client 20.63.98.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.98.69, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ab_ruBXYUsdvKC9YWpUF_AAAAA4"]
[Sun Mar 22 21:16:41.028660 2026] [:error] [pid 51361:tid 51378] [client 20.63.98.69:14771] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Sun Mar 22 21:16:41.875651 2026] [:error] [pid 51361:tid 51375] [client 20.63.98.69:14771] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Sun Mar 22 21:16:42.514149 2026] [:error] [pid 51361:tid 51373] [client 20.63.98.69:14771] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Mar 22 21:16:42.719684 2026] [:error] [pid 51361:tid 51393] [client 20.63.98.69:14771] [client 20.63.98.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ab_ruhXYUsdvKC9YWpUGDAAAABU"]
[Sun Mar 22 21:16:43.546953 2026] [:error] [pid 51361:tid 51385] [client 20.63.98.69:2867] [client 20.63.98.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ab_ruxXYUsdvKC9YWpUGDwAAAA4"]
[Sun Mar 22 21:16:44.377312 2026] [:error] [pid 30166:tid 30200] [client 20.63.98.69:13797] [client 20.63.98.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ab_rvLm4_26jKMD0zy0VjAAAAVc"]
[Sun Mar 22 21:16:45.203848 2026] [:error] [pid 51362:tid 51407] [client 20.63.98.69:34926] [client 20.63.98.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ab_rvcOwPm3DXzTDjUfZAAAAAEY"]
[Mon Mar 23 02:00:08.857645 2026] [:error] [pid 20584:tid 20624] [client 20.220.223.1:27607] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acAuKCWzr-bD_t6AP_TMeQAAAEg"]
[Mon Mar 23 02:00:09.274728 2026] [:error] [pid 20584:tid 20623] [client 20.220.223.1:27603] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acAuKSWzr-bD_t6AP_TMegAAAEc"]
[Mon Mar 23 02:00:09.687204 2026] [:error] [pid 20574:tid 20598] [client 20.220.223.1:27591] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acAuKddMXEnEZrwyzJkLNwAAAAk"]
[Mon Mar 23 02:00:10.099319 2026] [:error] [pid 20584:tid 20621] [client 20.220.223.1:27539] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acAuKiWzr-bD_t6AP_TMewAAAEU"]
[Mon Mar 23 04:06:56.010069 2026] [:error] [pid 23440:tid 23495] [client 20.220.145.74:45186] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Mar 23 04:06:56.426026 2026] [:error] [pid 23440:tid 23500] [client 20.220.145.74:45186] [client 20.220.145.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.145.74, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acBL4D49_8n8h_ttcUq0jwAAAFg"]
[Mon Mar 23 04:06:56.639672 2026] [:error] [pid 23440:tid 23497] [client 20.220.145.74:45186] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Mon Mar 23 04:06:57.479271 2026] [:error] [pid 23440:tid 23476] [client 20.220.145.74:45186] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Mon Mar 23 04:06:58.109292 2026] [:error] [pid 23440:tid 23496] [client 20.220.145.74:45186] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Mon Mar 23 04:06:58.315539 2026] [:error] [pid 23440:tid 23492] [client 20.220.145.74:45186] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acBL4j49_8n8h_ttcUq0mQAAAFA"]
[Mon Mar 23 04:06:59.141249 2026] [:error] [pid 23441:tid 23506] [client 20.220.145.74:45836] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acBL4xq7S-oOqSXZEr43fAAAAIM"]
[Mon Mar 23 04:06:59.985942 2026] [:error] [pid 23441:tid 23503] [client 20.220.145.74:45842] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acBL4xq7S-oOqSXZEr43gAAAAIA"]
[Mon Mar 23 04:07:00.812366 2026] [:error] [pid 23440:tid 23489] [client 20.220.145.74:45190] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acBL5D49_8n8h_ttcUq0ngAAAE0"]
[Mon Mar 23 17:07:06.370757 2026] [:error] [pid 57265:tid 57290] [client 20.63.98.227:13452] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Mar 23 17:07:06.784568 2026] [:error] [pid 57265:tid 57277] [client 20.63.98.227:13452] [client 20.63.98.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.98.227, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acECumNLjPJJkhuqCsgIpwAAAQo"]
[Mon Mar 23 17:07:06.999069 2026] [:error] [pid 57265:tid 57276] [client 20.63.98.227:13452] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Mon Mar 23 17:07:07.839995 2026] [:error] [pid 57265:tid 57271] [client 20.63.98.227:13452] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Mon Mar 23 17:07:08.475771 2026] [:error] [pid 57265:tid 57275] [client 20.63.98.227:13452] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Mon Mar 23 17:07:08.682291 2026] [:error] [pid 57265:tid 57282] [client 20.63.98.227:13452] [client 20.63.98.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acECvGNLjPJJkhuqCsgItQAAAQ8"]
[Mon Mar 23 17:07:09.512965 2026] [:error] [pid 23441:tid 23517] [client 20.63.98.227:14311] [client 20.63.98.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acECvRq7S-oOqSXZEr7NWgAAAI4"]
[Mon Mar 23 17:07:10.340958 2026] [:error] [pid 35165:tid 35178] [client 20.63.98.227:13459] [client 20.63.98.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acECvs6udpN6Esk7JKufBQAAAYo"]
[Mon Mar 23 17:07:11.171166 2026] [:error] [pid 14573:tid 14588] [client 20.63.98.227:14330] [client 20.63.98.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acECv--oSmHn3q4_J1GgaAAAAU0"]
[Mon Mar 23 21:19:08.018442 2026] [:error] [pid 38306:tid 38330] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Mon Mar 23 21:19:08.229077 2026] [:error] [pid 38306:tid 38322] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Mon Mar 23 21:19:08.439615 2026] [:error] [pid 38306:tid 38310] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/sty.php
[Mon Mar 23 21:19:08.648912 2026] [:error] [pid 38306:tid 38327] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Mon Mar 23 21:19:08.859761 2026] [:error] [pid 38306:tid 38324] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Mon Mar 23 21:19:09.069819 2026] [:error] [pid 38306:tid 38323] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Mon Mar 23 21:19:10.410262 2026] [:error] [pid 38306:tid 38323] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Mon Mar 23 21:19:10.621635 2026] [:error] [pid 38306:tid 38325] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Mon Mar 23 21:19:10.831638 2026] [:error] [pid 38306:tid 38329] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Mon Mar 23 21:19:11.043879 2026] [:error] [pid 38306:tid 38309] [client 40.85.222.197:45319] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Mon Mar 23 21:19:11.250723 2026] [:error] [pid 38306:tid 38321] [client 40.85.222.197:45319] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acE9zzkL8qwu-hHc6BienwAAAQ0"]
[Mon Mar 23 21:19:11.669765 2026] [:error] [pid 38178:tid 38258] [client 40.85.222.197:46877] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acE9zw0axWfXsVvR9udBmAAAAJA"]
[Mon Mar 23 21:19:12.183455 2026] [:error] [pid 38176:tid 38199] [client 40.85.222.197:7390] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/path.php"] [unique_id "acE90EtG4qlh1gvNjuI6NwAAAAw"]
[Mon Mar 23 21:19:12.612832 2026] [:error] [pid 38176:tid 38190] [client 40.85.222.197:7367] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/path.php"] [unique_id "acE90EtG4qlh1gvNjuI6OQAAAAM"]
[Mon Mar 23 21:19:13.093709 2026] [:error] [pid 38178:tid 38243] [client 40.85.222.197:45396] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/path.php"] [unique_id "acE90Q0axWfXsVvR9udBmQAAAIE"]
[Mon Mar 23 21:19:13.554127 2026] [:error] [pid 38176:tid 38199] [client 40.85.222.197:45438] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/path.php"] [unique_id "acE90UtG4qlh1gvNjuI6QAAAAAw"]
[Mon Mar 23 21:19:13.978342 2026] [:error] [pid 38276:tid 38281] [client 40.85.222.197:46874] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wdf.php"] [unique_id "acE90ZoKGiI-a7oME3L3KwAAAMI"]
[Mon Mar 23 21:19:14.396751 2026] [:error] [pid 38276:tid 38296] [client 40.85.222.197:7399] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wdf.php"] [unique_id "acE90poKGiI-a7oME3L3LQAAANE"]
[Mon Mar 23 21:19:14.815871 2026] [:error] [pid 38177:tid 38216] [client 40.85.222.197:46139] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wdf.php"] [unique_id "acE90nsYW-_HCI66MunxyAAAAEE"]
[Mon Mar 23 21:19:15.227025 2026] [:error] [pid 38176:tid 38198] [client 40.85.222.197:45346] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wdf.php"] [unique_id "acE900tG4qlh1gvNjuI6RAAAAAs"]
[Mon Mar 23 21:19:15.861315 2026] [:error] [pid 38276:tid 38289] [client 40.85.222.197:7428] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fleen.php"] [unique_id "acE905oKGiI-a7oME3L3NAAAAMo"]
[Mon Mar 23 21:19:16.289834 2026] [:error] [pid 38176:tid 38189] [client 40.85.222.197:45385] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fleen.php"] [unique_id "acE91EtG4qlh1gvNjuI6RwAAAAI"]
[Mon Mar 23 21:19:16.794290 2026] [:error] [pid 38276:tid 38295] [client 40.85.222.197:7659] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fleen.php"] [unique_id "acE91JoKGiI-a7oME3L3NgAAANA"]
[Mon Mar 23 21:19:17.249624 2026] [:error] [pid 38276:tid 38303] [client 40.85.222.197:7624] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fleen.php"] [unique_id "acE91ZoKGiI-a7oME3L3OAAAANg"]
[Mon Mar 23 21:19:17.679613 2026] [:error] [pid 38176:tid 38208] [client 40.85.222.197:7421] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-tem.php"] [unique_id "acE91UtG4qlh1gvNjuI6SgAAABU"]
[Mon Mar 23 21:19:18.114811 2026] [:error] [pid 38176:tid 38205] [client 40.85.222.197:7980] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-tem.php"] [unique_id "acE91ktG4qlh1gvNjuI6SwAAABI"]
[Mon Mar 23 21:19:18.596605 2026] [:error] [pid 38276:tid 38301] [client 40.85.222.197:46121] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-tem.php"] [unique_id "acE91poKGiI-a7oME3L3OgAAANY"]
[Mon Mar 23 21:19:19.340777 2026] [:error] [pid 38306:tid 38316] [client 40.85.222.197:46891] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/btx25.php"] [unique_id "acE91zkL8qwu-hHc6BiepwAAAQg"]
[Mon Mar 23 21:19:19.881704 2026] [:error] [pid 38176:tid 38192] [client 40.85.222.197:45326] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/btx25.php"] [unique_id "acE910tG4qlh1gvNjuI6TgAAAAU"]
[Mon Mar 23 21:19:20.368394 2026] [:error] [pid 38177:tid 38222] [client 40.85.222.197:45431] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/btx25.php"] [unique_id "acE92HsYW-_HCI66MunxzAAAAEc"]
[Mon Mar 23 21:19:20.828343 2026] [:error] [pid 38276:tid 38289] [client 40.85.222.197:7661] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/btx25.php"] [unique_id "acE92JoKGiI-a7oME3L3PQAAAMo"]
[Mon Mar 23 21:19:21.294097 2026] [:error] [pid 38178:tid 38262] [client 40.85.222.197:45348] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mga.php"] [unique_id "acE92Q0axWfXsVvR9udBnAAAAJQ"]
[Mon Mar 23 21:19:21.753664 2026] [:error] [pid 38276:tid 38297] [client 40.85.222.197:44606] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mga.php"] [unique_id "acE92ZoKGiI-a7oME3L3QAAAANI"]
[Mon Mar 23 21:19:22.171821 2026] [:error] [pid 38276:tid 38284] [client 40.85.222.197:45331] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mga.php"] [unique_id "acE92poKGiI-a7oME3L3QQAAAMU"]
[Mon Mar 23 21:19:22.637980 2026] [:error] [pid 38276:tid 38295] [client 40.85.222.197:46894] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mga.php"] [unique_id "acE92poKGiI-a7oME3L3RAAAANA"]
[Mon Mar 23 21:19:23.085223 2026] [:error] [pid 38178:tid 38252] [client 40.85.222.197:45344] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maxro.php"] [unique_id "acE92w0axWfXsVvR9udBnwAAAIo"]
[Mon Mar 23 21:19:23.525407 2026] [:error] [pid 38276:tid 38292] [client 40.85.222.197:45398] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maxro.php"] [unique_id "acE925oKGiI-a7oME3L3SgAAAM0"]
[Mon Mar 23 21:19:24.149055 2026] [:error] [pid 38177:tid 38224] [client 40.85.222.197:46122] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maxro.php"] [unique_id "acE93HsYW-_HCI66MunxzgAAAEk"]
[Mon Mar 23 21:19:24.642509 2026] [:error] [pid 38177:tid 38227] [client 40.85.222.197:7988] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maxro.php"] [unique_id "acE93HsYW-_HCI66Munx0wAAAEw"]
[Mon Mar 23 21:19:25.088608 2026] [:error] [pid 38276:tid 38289] [client 40.85.222.197:46084] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/agg.php"] [unique_id "acE93ZoKGiI-a7oME3L3SwAAAMo"]
[Mon Mar 23 21:19:25.508909 2026] [:error] [pid 38178:tid 38255] [client 40.85.222.197:45413] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/agg.php"] [unique_id "acE93Q0axWfXsVvR9udBoQAAAI0"]
[Mon Mar 23 21:19:25.953973 2026] [:error] [pid 38306:tid 38332] [client 40.85.222.197:7666] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/agg.php"] [unique_id "acE93TkL8qwu-hHc6BierQAAARg"]
[Mon Mar 23 21:19:26.391784 2026] [:error] [pid 38178:tid 38249] [client 40.85.222.197:45418] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsvvs.php"] [unique_id "acE93g0axWfXsVvR9udBpAAAAIc"]
[Mon Mar 23 21:19:26.859779 2026] [:error] [pid 38306:tid 38317] [client 40.85.222.197:45314] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsvvs.php"] [unique_id "acE93jkL8qwu-hHc6BiesQAAAQk"]
[Mon Mar 23 21:19:27.271010 2026] [:error] [pid 38306:tid 38311] [client 40.85.222.197:44578] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsvvs.php"] [unique_id "acE93zkL8qwu-hHc6BiesgAAAQM"]
[Mon Mar 23 21:19:27.692679 2026] [:error] [pid 38176:tid 38202] [client 40.85.222.197:44574] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsvvs.php"] [unique_id "acE930tG4qlh1gvNjuI6VgAAAA8"]
[Mon Mar 23 21:19:28.139163 2026] [:error] [pid 38176:tid 38205] [client 40.85.222.197:46125] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "acE94EtG4qlh1gvNjuI6VwAAABI"]
[Mon Mar 23 21:19:28.550628 2026] [:error] [pid 38306:tid 38321] [client 40.85.222.197:7952] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "acE94DkL8qwu-hHc6BieuAAAAQ0"]
[Mon Mar 23 21:19:28.988767 2026] [:error] [pid 38306:tid 38308] [client 40.85.222.197:7387] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "acE94DkL8qwu-hHc6BieuwAAAQA"]
[Mon Mar 23 21:19:29.424880 2026] [:error] [pid 38306:tid 38317] [client 40.85.222.197:46101] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "acE94TkL8qwu-hHc6BievAAAAQk"]
[Mon Mar 23 21:19:29.837382 2026] [:error] [pid 38306:tid 38313] [client 40.85.222.197:45394] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acE94TkL8qwu-hHc6BievwAAAQU"]
[Mon Mar 23 21:19:30.263580 2026] [:error] [pid 38306:tid 38328] [client 40.85.222.197:7994] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acE94jkL8qwu-hHc6BiewgAAARQ"]
[Mon Mar 23 21:19:30.703336 2026] [:error] [pid 38177:tid 38226] [client 40.85.222.197:44582] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acE94nsYW-_HCI66Munx1QAAAEs"]
[Mon Mar 23 21:19:31.118361 2026] [:error] [pid 38306:tid 38331] [client 40.85.222.197:7449] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acE94zkL8qwu-hHc6BieyAAAARc"]
[Mon Mar 23 21:19:31.570280 2026] [:error] [pid 38276:tid 38294] [client 40.85.222.197:45376] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acE945oKGiI-a7oME3L3UQAAAM8"]
[Mon Mar 23 21:19:32.036640 2026] [:error] [pid 38276:tid 38296] [client 40.85.222.197:45407] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acE95JoKGiI-a7oME3L3UwAAANE"]
[Mon Mar 23 21:19:32.556656 2026] [:error] [pid 38276:tid 38287] [client 40.85.222.197:7420] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "acE95JoKGiI-a7oME3L3VAAAAMg"]
[Mon Mar 23 21:19:32.971738 2026] [:error] [pid 38177:tid 38228] [client 40.85.222.197:45323] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "acE95HsYW-_HCI66Munx1wAAAE0"]
[Mon Mar 23 21:19:33.411894 2026] [:error] [pid 38276:tid 38289] [client 40.85.222.197:44588] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "acE95ZoKGiI-a7oME3L3VwAAAMo"]
[Mon Mar 23 21:19:33.932411 2026] [:error] [pid 38306:tid 38315] [client 40.85.222.197:7961] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "acE95TkL8qwu-hHc6BieygAAAQc"]
[Mon Mar 23 21:19:34.364762 2026] [:error] [pid 38306:tid 38314] [client 40.85.222.197:45415] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/css/index.php"] [unique_id "acE95jkL8qwu-hHc6BieywAAAQY"]
[Mon Mar 23 21:19:34.789553 2026] [:error] [pid 38306:tid 38329] [client 40.85.222.197:44562] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/css/index.php"] [unique_id "acE95jkL8qwu-hHc6BiezAAAARU"]
[Tue Mar 24 07:51:50.397523 2026] [:error] [pid 3031:tid 3100] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Tue Mar 24 07:51:50.660717 2026] [:error] [pid 3031:tid 3091] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Tue Mar 24 07:51:50.952854 2026] [:error] [pid 3031:tid 3087] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Mar 24 07:51:51.216105 2026] [:error] [pid 3031:tid 3077] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Mar 24 07:51:51.583438 2026] [:error] [pid 3031:tid 3093] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Tue Mar 24 07:51:51.987334 2026] [:error] [pid 3031:tid 3076] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/baixy.php
[Tue Mar 24 07:51:52.257008 2026] [:error] [pid 3031:tid 3085] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Tue Mar 24 07:51:52.559874 2026] [:error] [pid 3031:tid 3092] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Mar 24 07:51:53.292575 2026] [:error] [pid 3031:tid 3087] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Tue Mar 24 07:51:53.559130 2026] [:error] [pid 3031:tid 3080] [client 20.251.9.203:37904] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Tue Mar 24 07:51:53.864954 2026] [:error] [pid 3031:tid 3088] [client 20.251.9.203:37904] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acHSGaJBKytnG47nuib2QAAAAEw"]
[Tue Mar 24 07:51:57.871899 2026] [:error] [pid 38767:tid 38780] [client 20.251.9.203:28580] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acHSHfwkUqN4GJAI5oWnVAAAAQo"]
[Tue Mar 24 07:51:58.821399 2026] [:error] [pid 3032:tid 3107] [client 20.251.9.203:4394] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acHSHia_-JXXD03-JNzmjwAAAIQ"]
[Tue Mar 24 07:52:01.931388 2026] [:error] [pid 64198:tid 64212] [client 20.251.9.203:4555] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acHSIXVzJqf6OS_oSZ0KPAAAAUw"]
[Tue Mar 24 07:52:03.789040 2026] [:error] [pid 3032:tid 3115] [client 20.251.9.203:37948] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "acHSIya_-JXXD03-JNzmmQAAAIw"]
[Tue Mar 24 07:52:05.961826 2026] [:error] [pid 3031:tid 3084] [client 20.251.9.203:34176] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "acHSJaJBKytnG47nuib2UQAAAEg"]
[Tue Mar 24 07:52:07.426508 2026] [:error] [pid 3137:tid 3151] [client 20.251.9.203:50884] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "acHSJ5dZesutm6dfYM8nKwAAAMw"]
[Tue Mar 24 07:52:08.664290 2026] [:error] [pid 3137:tid 3144] [client 20.251.9.203:9424] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "acHSKJdZesutm6dfYM8nMAAAAMU"]
[Tue Mar 24 07:52:09.784453 2026] [:error] [pid 64198:tid 64204] [client 20.251.9.203:50280] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acHSKXVzJqf6OS_oSZ0KQwAAAUQ"]
[Tue Mar 24 07:52:11.606395 2026] [:error] [pid 3137:tid 3153] [client 20.251.9.203:10649] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acHSK5dZesutm6dfYM8nMwAAAM4"]
[Tue Mar 24 07:52:15.002382 2026] [:error] [pid 3031:tid 3098] [client 20.251.9.203:4175] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acHSL6JBKytnG47nuib2ZwAAAFY"]
[Tue Mar 24 07:52:16.415090 2026] [:error] [pid 3137:tid 3153] [client 20.251.9.203:37886] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acHSMJdZesutm6dfYM8nPQAAAM4"]
[Tue Mar 24 07:52:18.969087 2026] [:error] [pid 3137:tid 3159] [client 20.251.9.203:30583] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acHSMpdZesutm6dfYM8nRQAAANQ"]
[Tue Mar 24 07:52:20.577921 2026] [:error] [pid 64198:tid 64215] [client 20.251.9.203:23858] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acHSNHVzJqf6OS_oSZ0KTgAAAU8"]
[Tue Mar 24 07:52:22.771474 2026] [:error] [pid 38767:tid 38776] [client 20.251.9.203:22817] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acHSNvwkUqN4GJAI5oWnagAAAQY"]
[Tue Mar 24 07:52:24.265498 2026] [:error] [pid 64198:tid 64206] [client 20.251.9.203:28153] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acHSOHVzJqf6OS_oSZ0KWgAAAUY"]
[Tue Mar 24 07:52:27.845439 2026] [:error] [pid 38767:tid 38793] [client 20.251.9.203:49608] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "acHSO_wkUqN4GJAI5oWncAAAARc"]
[Tue Mar 24 07:52:29.205914 2026] [:error] [pid 64198:tid 64204] [client 20.251.9.203:10336] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "acHSPXVzJqf6OS_oSZ0KbAAAAUQ"]
[Tue Mar 24 07:52:32.821645 2026] [:error] [pid 3137:tid 3163] [client 20.251.9.203:11707] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "acHSQJdZesutm6dfYM8nTgAAANg"]
[Tue Mar 24 07:52:35.251944 2026] [:error] [pid 3137:tid 3153] [client 20.251.9.203:9813] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "acHSQ5dZesutm6dfYM8nVwAAAM4"]
[Tue Mar 24 07:52:38.144398 2026] [:error] [pid 3032:tid 3109] [client 20.251.9.203:12421] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "acHSRia_-JXXD03-JNzmoAAAAIY"]
[Tue Mar 24 07:52:40.022070 2026] [:error] [pid 3137:tid 3159] [client 20.251.9.203:25335] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "acHSSJdZesutm6dfYM8nXgAAANQ"]
[Tue Mar 24 07:52:41.287791 2026] [:error] [pid 3137:tid 3152] [client 20.251.9.203:12417] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "acHSSZdZesutm6dfYM8nZAAAAM0"]
[Tue Mar 24 07:52:42.175897 2026] [:error] [pid 3030:tid 3065] [client 20.251.9.203:29671] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "acHSSgyOuILyynfcqfkLngAAABA"]
[Tue Mar 24 07:52:43.334959 2026] [:error] [pid 3030:tid 3056] [client 20.251.9.203:60480] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "acHSSwyOuILyynfcqfkLpAAAAAc"]
[Tue Mar 24 07:52:44.528304 2026] [:error] [pid 3137:tid 3155] [client 20.251.9.203:34706] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "acHSTJdZesutm6dfYM8naQAAANA"]
[Tue Mar 24 07:52:46.407680 2026] [:error] [pid 3137:tid 3139] [client 20.251.9.203:25297] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "acHSTpdZesutm6dfYM8ncQAAAMA"]
[Tue Mar 24 07:53:05.360130 2026] [:error] [pid 3031:tid 3096] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Tue Mar 24 07:53:05.650854 2026] [:error] [pid 3031:tid 3076] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Mar 24 07:53:05.913527 2026] [:error] [pid 3031:tid 3081] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Tue Mar 24 07:53:06.175572 2026] [:error] [pid 3031:tid 3097] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Tue Mar 24 07:53:06.477920 2026] [:error] [pid 3031:tid 3082] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Tue Mar 24 07:53:06.743561 2026] [:error] [pid 3031:tid 3084] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Tue Mar 24 07:53:07.021048 2026] [:error] [pid 3031:tid 3083] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/ws83.php
[Tue Mar 24 07:53:07.320845 2026] [:error] [pid 3031:tid 3086] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/ws75.php
[Tue Mar 24 07:53:08.747431 2026] [:error] [pid 3031:tid 3086] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Mar 24 07:53:09.029940 2026] [:error] [pid 3031:tid 3093] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Tue Mar 24 07:53:09.378726 2026] [:error] [pid 3031:tid 3081] [client 20.251.9.203:13449] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Tue Mar 24 07:53:10.642290 2026] [:error] [pid 3031:tid 3081] [client 20.251.9.203:13449] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acHSZqJBKytnG47nuib2wwAAAEU"]
[Tue Mar 24 07:53:11.490392 2026] [:error] [pid 3032:tid 3111] [client 20.251.9.203:9961] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acHSZya_-JXXD03-JNzmsQAAAIg"]
[Tue Mar 24 07:53:13.187880 2026] [:error] [pid 64198:tid 64217] [client 20.251.9.203:4120] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acHSaXVzJqf6OS_oSZ0KogAAAVE"]
[Tue Mar 24 07:53:14.891765 2026] [:error] [pid 38767:tid 38792] [client 20.251.9.203:11722] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acHSavwkUqN4GJAI5oWnjgAAARY"]
[Tue Mar 24 07:53:15.918712 2026] [:error] [pid 3032:tid 3114] [client 20.251.9.203:23205] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acHSaya_-JXXD03-JNzmuQAAAIs"]
[Tue Mar 24 07:53:17.275409 2026] [:error] [pid 64198:tid 64223] [client 20.251.9.203:19742] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acHSbXVzJqf6OS_oSZ0KqQAAAVc"]
[Tue Mar 24 07:53:19.317404 2026] [:error] [pid 64198:tid 64220] [client 20.251.9.203:9312] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acHSb3VzJqf6OS_oSZ0KrAAAAVQ"]
[Tue Mar 24 07:53:23.367158 2026] [:error] [pid 64198:tid 64204] [client 20.251.9.203:14008] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acHSc3VzJqf6OS_oSZ0KuQAAAUQ"]
[Tue Mar 24 07:53:24.563028 2026] [:error] [pid 64198:tid 64206] [client 20.251.9.203:25244] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acHSdHVzJqf6OS_oSZ0KuwAAAUY"]
[Tue Mar 24 07:53:27.770465 2026] [:error] [pid 38767:tid 38790] [client 20.251.9.203:16353] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acHSd_wkUqN4GJAI5oWnoQAAARQ"]
[Tue Mar 24 07:53:30.309813 2026] [:error] [pid 3137:tid 3156] [client 20.251.9.203:30485] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acHSepdZesutm6dfYM8n1AAAANE"]
[Tue Mar 24 07:53:31.401607 2026] [:error] [pid 38767:tid 38794] [client 20.251.9.203:19268] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acHSe_wkUqN4GJAI5oWnpwAAARg"]
[Tue Mar 24 07:53:32.265295 2026] [:error] [pid 38767:tid 38793] [client 20.251.9.203:49666] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "acHSfPwkUqN4GJAI5oWnqwAAARc"]
[Tue Mar 24 07:53:33.665845 2026] [:error] [pid 3137:tid 3161] [client 20.251.9.203:19290] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "acHSfZdZesutm6dfYM8n3AAAANY"]
[Tue Mar 24 07:53:37.073682 2026] [:error] [pid 3137:tid 3145] [client 20.251.9.203:15763] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "acHSgZdZesutm6dfYM8n5AAAAMY"]
[Tue Mar 24 07:53:40.021720 2026] [:error] [pid 3030:tid 3056] [client 20.251.9.203:31783] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "acHShAyOuILyynfcqfkLxQAAAAc"]
[Tue Mar 24 07:53:41.192640 2026] [:error] [pid 3032:tid 3120] [client 20.251.9.203:31791] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "acHShSa_-JXXD03-JNzm0QAAAJE"]
[Tue Mar 24 07:53:43.199781 2026] [:error] [pid 3032:tid 3112] [client 20.251.9.203:47020] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "acHShya_-JXXD03-JNzm2gAAAIk"]
[Tue Mar 24 07:53:45.557300 2026] [:error] [pid 3032:tid 3111] [client 20.251.9.203:25763] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "acHSiSa_-JXXD03-JNzm4wAAAIg"]
[Tue Mar 24 07:53:48.230862 2026] [:error] [pid 3137:tid 3161] [client 20.251.9.203:33177] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "acHSjJdZesutm6dfYM8oDgAAANY"]
[Tue Mar 24 07:53:51.433168 2026] [:error] [pid 3031:tid 3093] [client 20.251.9.203:21511] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acHSj6JBKytnG47nuib3OQAAAFE"]
[Tue Mar 24 07:53:59.902890 2026] [:error] [pid 3137:tid 3141] [client 20.251.9.203:20927] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acHSl5dZesutm6dfYM8oJgAAAMI"]
[Tue Mar 24 07:54:00.956928 2026] [:error] [pid 3032:tid 3120] [client 20.251.9.203:48372] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acHSmCa_-JXXD03-JNzm-QAAAJE"]
[Tue Mar 24 07:54:03.235304 2026] [:error] [pid 64198:tid 64220] [client 20.251.9.203:46946] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acHSm3VzJqf6OS_oSZ0K4AAAAVQ"]
[Tue Mar 24 07:54:05.587304 2026] [:error] [pid 3031:tid 3082] [client 20.251.9.203:12693] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acHSnaJBKytnG47nuib3PwAAAEY"]
[Tue Mar 24 07:54:07.331249 2026] [:error] [pid 3031:tid 3080] [client 20.251.9.203:15590] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acHSn6JBKytnG47nuib3QAAAAEQ"]
[Tue Mar 24 07:54:08.800604 2026] [:error] [pid 3031:tid 3078] [client 20.251.9.203:18119] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acHSoKJBKytnG47nuib3QwAAAEI"]
[Tue Mar 24 07:54:11.712786 2026] [:error] [pid 3137:tid 3144] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Tue Mar 24 07:54:12.240938 2026] [:error] [pid 3137:tid 3158] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Mar 24 07:54:13.262566 2026] [:error] [pid 3137:tid 3139] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Mar 24 07:54:13.677654 2026] [:error] [pid 3137:tid 3159] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Mar 24 07:54:13.993292 2026] [:error] [pid 3137:tid 3147] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Mar 24 07:54:14.407838 2026] [:error] [pid 3137:tid 3140] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/amp.php
[Tue Mar 24 07:54:17.299730 2026] [:error] [pid 3137:tid 3157] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Mar 24 07:54:17.573962 2026] [:error] [pid 3137:tid 3142] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Mar 24 07:54:18.165870 2026] [:error] [pid 3137:tid 3154] [client 20.251.9.203:12010] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Tue Mar 24 07:54:18.459387 2026] [:error] [pid 3137:tid 3152] [client 20.251.9.203:12010] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acHSqpdZesutm6dfYM8oTAAAAM0"]
[Tue Mar 24 07:54:19.840892 2026] [:error] [pid 3031:tid 3088] [client 20.251.9.203:18175] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acHSq6JBKytnG47nuib3SQAAAEw"]
[Tue Mar 24 07:54:23.192134 2026] [:error] [pid 64198:tid 64212] [client 20.251.9.203:13250] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acHSr3VzJqf6OS_oSZ0LBQAAAUw"]
[Tue Mar 24 07:54:24.288436 2026] [:error] [pid 38767:tid 38790] [client 20.251.9.203:48365] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acHSsPwkUqN4GJAI5oWoAwAAARQ"]
[Tue Mar 24 07:54:25.046394 2026] [:error] [pid 3137:tid 3147] [client 20.251.9.203:16584] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "acHSsZdZesutm6dfYM8oVAAAAMg"]
[Tue Mar 24 07:54:28.967379 2026] [:error] [pid 38767:tid 38779] [client 20.251.9.203:20912] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "acHStPwkUqN4GJAI5oWoBwAAAQk"]
[Tue Mar 24 07:54:30.449221 2026] [:error] [pid 64198:tid 64215] [client 20.251.9.203:12015] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "acHStnVzJqf6OS_oSZ0LFwAAAU8"]
[Tue Mar 24 07:54:31.100634 2026] [:error] [pid 38767:tid 38790] [client 20.251.9.203:13274] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "acHSt_wkUqN4GJAI5oWoDgAAARQ"]
[Tue Mar 24 07:54:32.209509 2026] [:error] [pid 38767:tid 38777] [client 20.251.9.203:10058] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "acHSuPwkUqN4GJAI5oWoEgAAAQc"]
[Tue Mar 24 07:54:34.473438 2026] [:error] [pid 64198:tid 64206] [client 20.251.9.203:16616] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "acHSunVzJqf6OS_oSZ0LHAAAAUY"]
[Tue Mar 24 07:54:35.453637 2026] [:error] [pid 3137:tid 3148] [client 20.251.9.203:9749] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "acHSu5dZesutm6dfYM8oYwAAAMk"]
[Tue Mar 24 07:54:36.826499 2026] [:error] [pid 3031:tid 3094] [client 20.251.9.203:14284] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "acHSvKJBKytnG47nuib3TAAAAFI"]
[Tue Mar 24 07:54:40.480603 2026] [:error] [pid 3137:tid 3141] [client 20.251.9.203:20900] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acHSwJdZesutm6dfYM8ocAAAAMI"]
[Tue Mar 24 07:54:42.439601 2026] [:error] [pid 3031:tid 3091] [client 20.251.9.203:10065] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acHSwqJBKytnG47nuib3UQAAAE8"]
[Tue Mar 24 07:54:43.997357 2026] [:error] [pid 38767:tid 38772] [client 20.251.9.203:9773] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acHSw_wkUqN4GJAI5oWoGgAAAQI"]
[Tue Mar 24 07:54:45.735329 2026] [:error] [pid 3137:tid 3141] [client 20.251.9.203:13308] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acHSxZdZesutm6dfYM8oeQAAAMI"]
[Tue Mar 24 07:54:46.427676 2026] [:error] [pid 64198:tid 64200] [client 20.251.9.203:20914] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "acHSxnVzJqf6OS_oSZ0LKgAAAUA"]
[Tue Mar 24 07:54:47.367941 2026] [:error] [pid 3137:tid 3147] [client 20.251.9.203:18318] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "acHSx5dZesutm6dfYM8ogAAAAMg"]
[Tue Mar 24 07:54:49.304314 2026] [:error] [pid 3137:tid 3157] [client 20.251.9.203:15553] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "acHSyZdZesutm6dfYM8oiAAAANI"]
[Tue Mar 24 07:54:51.975403 2026] [:error] [pid 64198:tid 64205] [client 20.251.9.203:42940] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "acHSy3VzJqf6OS_oSZ0LLAAAAUU"]
[Tue Mar 24 07:54:53.062746 2026] [:error] [pid 3137:tid 3159] [client 20.251.9.203:21569] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acHSzZdZesutm6dfYM8okQAAANQ"]
[Tue Mar 24 07:54:55.565332 2026] [:error] [pid 38767:tid 38790] [client 20.251.9.203:14079] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acHSz_wkUqN4GJAI5oWoJgAAARQ"]
[Tue Mar 24 07:54:56.818605 2026] [:error] [pid 64198:tid 64202] [client 20.251.9.203:48363] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acHS0HVzJqf6OS_oSZ0LMwAAAUI"]
[Tue Mar 24 07:55:00.564941 2026] [:error] [pid 3030:tid 3062] [client 20.251.9.203:18325] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acHS1AyOuILyynfcqfkMTgAAAA0"]
[Tue Mar 24 07:55:01.362387 2026] [:error] [pid 3030:tid 3055] [client 20.251.9.203:14514] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHS1QyOuILyynfcqfkMUQAAAAY"]
[Tue Mar 24 07:55:03.009895 2026] [:error] [pid 3137:tid 3157] [client 20.251.9.203:13559] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHS15dZesutm6dfYM8ooAAAANI"]
[Tue Mar 24 07:55:03.973505 2026] [:error] [pid 3030:tid 3054] [client 20.251.9.203:15611] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHS1wyOuILyynfcqfkMUgAAAAU"]
[Tue Mar 24 07:55:08.624541 2026] [:error] [pid 38767:tid 38783] [client 20.251.9.203:48349] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHS3PwkUqN4GJAI5oWoLAAAAQ0"]
[Tue Mar 24 07:55:20.511285 2026] [:error] [pid 3032:tid 3112] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Tue Mar 24 07:55:20.800393 2026] [:error] [pid 3032:tid 3111] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Mar 24 07:55:21.079290 2026] [:error] [pid 3032:tid 3109] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Mar 24 07:55:21.374158 2026] [:error] [pid 3032:tid 3106] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax.php
[Tue Mar 24 07:55:21.672390 2026] [:error] [pid 3032:tid 3119] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Mar 24 07:55:22.211266 2026] [:error] [pid 3032:tid 3117] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Tue Mar 24 07:55:22.516629 2026] [:error] [pid 3032:tid 3121] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Tue Mar 24 07:55:22.807415 2026] [:error] [pid 3032:tid 3105] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/drhunthq.php
[Tue Mar 24 07:55:23.112501 2026] [:error] [pid 3032:tid 3124] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Mar 24 07:55:23.417829 2026] [:error] [pid 3032:tid 3110] [client 20.251.9.203:14073] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Mar 24 07:55:23.683882 2026] [:error] [pid 3032:tid 3115] [client 20.251.9.203:14073] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acHS6ya_-JXXD03-JNznUgAAAIw"]
[Tue Mar 24 07:56:10.474298 2026] [:error] [pid 64198:tid 64223] [client 20.251.9.203:20528] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "acHTGnVzJqf6OS_oSZ0LrgAAAVc"]
[Tue Mar 24 07:56:18.093681 2026] [:error] [pid 38767:tid 38785] [client 20.251.9.203:9517] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acHTIvwkUqN4GJAI5oWoiQAAAQ8"]
[Tue Mar 24 07:56:23.388875 2026] [:error] [pid 38767:tid 38772] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Mar 24 07:56:23.680081 2026] [:error] [pid 38767:tid 38775] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Mar 24 07:56:23.943295 2026] [:error] [pid 38767:tid 38783] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Mar 24 07:56:24.470955 2026] [:error] [pid 38767:tid 38778] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Tue Mar 24 07:56:24.906952 2026] [:error] [pid 38767:tid 38779] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Tue Mar 24 07:56:25.210680 2026] [:error] [pid 38767:tid 38788] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Tue Mar 24 07:56:25.591951 2026] [:error] [pid 38767:tid 38786] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Tue Mar 24 07:56:25.893903 2026] [:error] [pid 38767:tid 38773] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/hots.php
[Tue Mar 24 07:56:26.158394 2026] [:error] [pid 38767:tid 38782] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Tue Mar 24 07:56:26.463411 2026] [:error] [pid 38767:tid 38792] [client 20.251.9.203:34225] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Tue Mar 24 07:56:26.737347 2026] [:error] [pid 38767:tid 38770] [client 20.251.9.203:34225] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acHTKvwkUqN4GJAI5oWopAAAAQA"]
[Tue Mar 24 07:56:28.025046 2026] [:error] [pid 64198:tid 64213] [client 20.251.9.203:8879] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acHTLHVzJqf6OS_oSZ0LywAAAU0"]
[Tue Mar 24 07:56:31.190526 2026] [:error] [pid 38767:tid 38786] [client 20.251.9.203:24411] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acHTL_wkUqN4GJAI5oWorgAAARA"]
[Tue Mar 24 07:56:32.105339 2026] [:error] [pid 3030:tid 3049] [client 20.251.9.203:37848] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acHTMAyOuILyynfcqfkMoAAAAAA"]
[Tue Mar 24 07:56:33.452514 2026] [:error] [pid 3137:tid 3139] [client 20.251.9.203:52600] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acHTMZdZesutm6dfYM8poAAAAMA"]
[Tue Mar 24 07:56:35.037980 2026] [:error] [pid 3137:tid 3140] [client 20.251.9.203:23851] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acHTM5dZesutm6dfYM8ppAAAAME"]
[Tue Mar 24 07:56:37.436644 2026] [:error] [pid 64198:tid 64219] [client 20.251.9.203:24325] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acHTNXVzJqf6OS_oSZ0L1wAAAVM"]
[Tue Mar 24 07:56:38.612637 2026] [:error] [pid 3030:tid 3068] [client 20.251.9.203:8839] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acHTNgyOuILyynfcqfkMpwAAABM"]
[Tue Mar 24 07:56:39.881677 2026] [:error] [pid 3137:tid 3147] [client 20.251.9.203:17767] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acHTN5dZesutm6dfYM8puQAAAMg"]
[Tue Mar 24 07:56:41.363430 2026] [:error] [pid 3137:tid 3140] [client 20.251.9.203:9856] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acHTOZdZesutm6dfYM8pxwAAAME"]
[Tue Mar 24 07:56:42.718145 2026] [:error] [pid 3137:tid 3154] [client 20.251.9.203:22812] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acHTOpdZesutm6dfYM8p0AAAAM8"]
[Tue Mar 24 07:56:46.764106 2026] [:error] [pid 3137:tid 3143] [client 20.251.9.203:9903] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acHTPpdZesutm6dfYM8p2AAAAMQ"]
[Tue Mar 24 07:56:50.770037 2026] [:error] [pid 38767:tid 38777] [client 20.251.9.203:10654] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acHTQvwkUqN4GJAI5oWovwAAAQc"]
[Tue Mar 24 07:56:52.087452 2026] [:error] [pid 3137:tid 3148] [client 20.251.9.203:24885] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acHTRJdZesutm6dfYM8p3wAAAMk"]
[Tue Mar 24 07:56:54.669307 2026] [:error] [pid 38767:tid 38789] [client 20.251.9.203:21261] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acHTRvwkUqN4GJAI5oWoxwAAARM"]
[Tue Mar 24 07:56:56.422615 2026] [:error] [pid 64198:tid 64208] [client 20.251.9.203:24359] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acHTSHVzJqf6OS_oSZ0L6QAAAUg"]
[Tue Mar 24 07:56:57.567116 2026] [:error] [pid 3032:tid 3128] [client 20.251.9.203:4466] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acHTSSa_-JXXD03-JNznkQAAAJg"]
[Tue Mar 24 07:57:00.268905 2026] [:error] [pid 38767:tid 38772] [client 20.251.9.203:8838] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acHTTPwkUqN4GJAI5oWozgAAAQI"]
[Tue Mar 24 07:57:01.096187 2026] [:error] [pid 3030:tid 3051] [client 20.251.9.203:15346] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acHTTQyOuILyynfcqfkMtwAAAAI"]
[Tue Mar 24 07:57:01.904757 2026] [:error] [pid 3031:tid 3100] [client 20.251.9.203:23872] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acHTTaJBKytnG47nuib31wAAAFg"]
[Tue Mar 24 07:57:02.639708 2026] [:error] [pid 38767:tid 38789] [client 20.251.9.203:9177] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acHTTvwkUqN4GJAI5oWo0QAAARM"]
[Tue Mar 24 07:57:04.358012 2026] [:error] [pid 3137:tid 3149] [client 20.251.9.203:23877] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acHTUJdZesutm6dfYM8p8wAAAMo"]
[Tue Mar 24 07:57:06.048448 2026] [:error] [pid 38767:tid 38784] [client 20.251.9.203:30172] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acHTUvwkUqN4GJAI5oWo1AAAAQ4"]
[Tue Mar 24 07:57:07.720743 2026] [:error] [pid 3137:tid 3156] [client 20.251.9.203:28552] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acHTU5dZesutm6dfYM8qAAAAANE"]
[Tue Mar 24 07:57:08.686674 2026] [:error] [pid 3137:tid 3155] [client 20.251.9.203:10360] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "acHTVJdZesutm6dfYM8qBAAAANA"]
[Tue Mar 24 07:57:10.403346 2026] [:error] [pid 3137:tid 3163] [client 20.251.9.203:28592] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "acHTVpdZesutm6dfYM8qDgAAANg"]
[Tue Mar 24 07:57:11.990249 2026] [:error] [pid 38767:tid 38774] [client 20.251.9.203:28606] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "acHTV_wkUqN4GJAI5oWo2wAAAQQ"]
[Tue Mar 24 07:57:13.433140 2026] [:error] [pid 38767:tid 38782] [client 20.251.9.203:13560] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "acHTWfwkUqN4GJAI5oWo3gAAAQw"]
[Tue Mar 24 07:57:14.911020 2026] [:error] [pid 38767:tid 38792] [client 20.251.9.203:20498] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "acHTWvwkUqN4GJAI5oWo5AAAARY"]
[Tue Mar 24 07:57:16.151991 2026] [:error] [pid 3031:tid 3083] [client 20.251.9.203:15569] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "acHTXKJBKytnG47nuib34QAAAEc"]
[Tue Mar 24 07:57:18.319515 2026] [:error] [pid 38767:tid 38774] [client 20.251.9.203:15552] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "acHTXvwkUqN4GJAI5oWo6QAAAQQ"]
[Tue Mar 24 07:57:19.663399 2026] [:error] [pid 3031:tid 3093] [client 20.251.9.203:15606] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "acHTX6JBKytnG47nuib37AAAAFE"]
[Tue Mar 24 07:57:20.431560 2026] [:error] [pid 3031:tid 3097] [client 20.251.9.203:38340] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acHTYKJBKytnG47nuib37gAAAFU"]
[Tue Mar 24 07:57:21.493912 2026] [:error] [pid 64198:tid 64209] [client 20.251.9.203:48429] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acHTYXVzJqf6OS_oSZ0MIwAAAUk"]
[Tue Mar 24 07:57:22.568536 2026] [:error] [pid 3032:tid 3108] [client 20.251.9.203:29082] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acHTYia_-JXXD03-JNznmwAAAIU"]
[Tue Mar 24 07:57:24.988719 2026] [:error] [pid 64198:tid 64204] [client 20.251.9.203:19283] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acHTZHVzJqf6OS_oSZ0MLQAAAUQ"]
[Tue Mar 24 07:57:26.674300 2026] [:error] [pid 38767:tid 38785] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Tue Mar 24 07:57:26.937148 2026] [:error] [pid 38767:tid 38793] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Tue Mar 24 07:57:27.199882 2026] [:error] [pid 38767:tid 38775] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Tue Mar 24 07:57:27.462476 2026] [:error] [pid 38767:tid 38784] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Tue Mar 24 07:57:27.727434 2026] [:error] [pid 38767:tid 38773] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Tue Mar 24 07:57:28.010280 2026] [:error] [pid 38767:tid 38771] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Tue Mar 24 07:57:28.380798 2026] [:error] [pid 38767:tid 38789] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-104.php
[Tue Mar 24 07:57:28.661405 2026] [:error] [pid 38767:tid 38776] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/rzki.php
[Tue Mar 24 07:57:28.924168 2026] [:error] [pid 38767:tid 38770] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Tue Mar 24 07:57:29.662931 2026] [:error] [pid 38767:tid 38787] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Tue Mar 24 07:57:29.927090 2026] [:error] [pid 38767:tid 38777] [client 20.251.9.203:49718] File does not exist: /usr/local/apache/htdocs/suspended-page/okxh.php
[Tue Mar 24 07:57:30.234195 2026] [:error] [pid 38767:tid 38781] [client 20.251.9.203:49718] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "acHTavwkUqN4GJAI5oWpDAAAAQs"]
[Tue Mar 24 07:57:32.763666 2026] [:error] [pid 38767:tid 38775] [client 20.251.9.203:13467] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "acHTbPwkUqN4GJAI5oWpEwAAAQU"]
[Tue Mar 24 07:57:35.014434 2026] [:error] [pid 3032:tid 3117] [client 20.251.9.203:34759] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "acHTbya_-JXXD03-JNznuwAAAI4"]
[Tue Mar 24 07:57:36.438191 2026] [:error] [pid 3030:tid 3049] [client 20.251.9.203:19242] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "acHTcAyOuILyynfcqfkM2QAAAAA"]
[Tue Mar 24 07:57:40.666765 2026] [:error] [pid 3030:tid 3060] [client 20.251.9.203:8261] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "acHTdAyOuILyynfcqfkM4QAAAAs"]
[Tue Mar 24 07:57:41.583347 2026] [:error] [pid 64198:tid 64204] [client 20.251.9.203:32863] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "acHTdXVzJqf6OS_oSZ0MYAAAAUQ"]
[Tue Mar 24 07:57:44.884170 2026] [:error] [pid 64198:tid 64203] [client 20.251.9.203:4908] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "acHTeHVzJqf6OS_oSZ0MZwAAAUM"]
[Tue Mar 24 07:58:00.320545 2026] [:error] [pid 3137:tid 3154] [client 20.251.9.203:21995] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acHTiJdZesutm6dfYM8qbAAAAM8"]
[Tue Mar 24 07:58:04.934353 2026] [:error] [pid 3137:tid 3159] [client 20.251.9.203:4921] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acHTjJdZesutm6dfYM8qeAAAANQ"]
[Tue Mar 24 07:58:06.784782 2026] [:error] [pid 64198:tid 64201] [client 20.251.9.203:33735] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acHTjnVzJqf6OS_oSZ0MfQAAAUE"]
[Tue Mar 24 07:58:08.636697 2026] [:error] [pid 38767:tid 38773] [client 20.251.9.203:47655] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acHTkPwkUqN4GJAI5oWpjQAAAQM"]
[Tue Mar 24 07:58:11.085095 2026] [:error] [pid 3137:tid 3141] [client 20.251.9.203:14246] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acHTk5dZesutm6dfYM8qiAAAAMI"]
[Tue Mar 24 07:58:11.834756 2026] [:error] [pid 64198:tid 64205] [client 20.251.9.203:12791] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acHTk3VzJqf6OS_oSZ0MjAAAAUU"]
[Tue Mar 24 07:58:12.661162 2026] [:error] [pid 3030:tid 3052] [client 20.251.9.203:14261] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acHTlAyOuILyynfcqfkM8wAAAAM"]
[Tue Mar 24 07:58:16.725671 2026] [:error] [pid 3030:tid 3050] [client 20.251.9.203:34263] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acHTmAyOuILyynfcqfkM-gAAAAE"]
[Tue Mar 24 07:58:18.561057 2026] [:error] [pid 64198:tid 64213] [client 20.251.9.203:12469] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "acHTmnVzJqf6OS_oSZ0MoAAAAU0"]
[Tue Mar 24 07:58:22.313838 2026] [:error] [pid 3137:tid 3161] [client 20.251.9.203:8496] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "acHTnpdZesutm6dfYM8qoAAAANY"]
[Tue Mar 24 07:58:23.771799 2026] [:error] [pid 38767:tid 38792] [client 20.251.9.203:14574] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "acHTn_wkUqN4GJAI5oWpnQAAARY"]
[Tue Mar 24 07:58:24.581214 2026] [:error] [pid 3030:tid 3058] [client 20.251.9.203:31306] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "acHToAyOuILyynfcqfkNCQAAAAk"]
[Tue Mar 24 07:58:25.367204 2026] [:error] [pid 64198:tid 64209] [client 20.251.9.203:9825] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acHToXVzJqf6OS_oSZ0MowAAAUk"]
[Tue Mar 24 07:58:28.374828 2026] [:error] [pid 3137:tid 3151] [client 20.251.9.203:33779] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acHTpJdZesutm6dfYM8qtAAAAMw"]
[Tue Mar 24 07:58:30.316051 2026] [:error] [pid 3030:tid 3051] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/6kDPjgFTmvS.php
[Tue Mar 24 07:58:30.579319 2026] [:error] [pid 3030:tid 3053] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/varb.php
[Tue Mar 24 07:58:30.867035 2026] [:error] [pid 3030:tid 3060] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/lm15.php
[Tue Mar 24 07:58:31.197196 2026] [:error] [pid 3030:tid 3059] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Tue Mar 24 07:58:31.522864 2026] [:error] [pid 3030:tid 3072] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/44.php
[Tue Mar 24 07:58:31.891640 2026] [:error] [pid 3030:tid 3070] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/a5e0a.php
[Tue Mar 24 07:58:32.158851 2026] [:error] [pid 3030:tid 3063] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Tue Mar 24 07:58:32.436965 2026] [:error] [pid 3030:tid 3052] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/56c53.php
[Tue Mar 24 07:58:32.788166 2026] [:error] [pid 3030:tid 3062] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Tue Mar 24 07:58:33.054817 2026] [:error] [pid 3030:tid 3049] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Tue Mar 24 07:58:33.351078 2026] [:error] [pid 3030:tid 3071] [client 20.251.9.203:11668] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Mar 24 07:58:33.639339 2026] [:error] [pid 3030:tid 3065] [client 20.251.9.203:11668] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "acHTqQyOuILyynfcqfkNFgAAABA"]
[Tue Mar 24 07:58:35.045459 2026] [:error] [pid 64198:tid 64223] [client 20.251.9.203:10274] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "acHTq3VzJqf6OS_oSZ0MsQAAAVc"]
[Tue Mar 24 07:58:35.925958 2026] [:error] [pid 38767:tid 38773] [client 20.251.9.203:14550] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "acHTq_wkUqN4GJAI5oWppQAAAQM"]
[Tue Mar 24 07:58:37.089106 2026] [:error] [pid 3032:tid 3111] [client 20.251.9.203:31281] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "acHTrSa_-JXXD03-JNzn9wAAAIg"]
[Tue Mar 24 07:58:38.080474 2026] [:error] [pid 38767:tid 38772] [client 20.251.9.203:9807] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acHTrvwkUqN4GJAI5oWpqQAAAQI"]
[Tue Mar 24 07:58:39.977170 2026] [:error] [pid 64198:tid 64204] [client 20.251.9.203:25281] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acHTr3VzJqf6OS_oSZ0MsgAAAUQ"]
[Tue Mar 24 07:58:41.344854 2026] [:error] [pid 3137:tid 3141] [client 20.251.9.203:5088] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acHTsZdZesutm6dfYM8q0wAAAMI"]
[Tue Mar 24 07:58:43.096976 2026] [:error] [pid 3031:tid 3087] [client 20.251.9.203:15359] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acHTs6JBKytnG47nuib4RQAAAEs"]
[Tue Mar 24 07:58:46.453738 2026] [:error] [pid 3031:tid 3096] [client 20.251.9.203:10442] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "acHTtqJBKytnG47nuib4RwAAAFQ"]
[Tue Mar 24 07:58:47.502275 2026] [:error] [pid 64198:tid 64200] [client 20.251.9.203:4816] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "acHTt3VzJqf6OS_oSZ0MtwAAAUA"]
[Tue Mar 24 07:58:48.580219 2026] [:error] [pid 38767:tid 38784] [client 20.251.9.203:4843] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "acHTuPwkUqN4GJAI5oWpxwAAAQ4"]
[Tue Mar 24 07:58:49.325293 2026] [:error] [pid 64198:tid 64221] [client 20.251.9.203:4769] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "acHTuXVzJqf6OS_oSZ0MvAAAAVU"]
[Tue Mar 24 07:58:50.758378 2026] [:error] [pid 3137:tid 3151] [client 20.251.9.203:34734] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws49.php"] [unique_id "acHTupdZesutm6dfYM8q4QAAAMw"]
[Tue Mar 24 07:58:52.616672 2026] [:error] [pid 64198:tid 64202] [client 20.251.9.203:5057] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws49.php"] [unique_id "acHTvHVzJqf6OS_oSZ0MwAAAAUI"]
[Tue Mar 24 07:58:53.430452 2026] [:error] [pid 38767:tid 38786] [client 20.251.9.203:14548] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws49.php"] [unique_id "acHTvfwkUqN4GJAI5oWpyAAAARA"]
[Tue Mar 24 07:58:54.729112 2026] [:error] [pid 38767:tid 38780] [client 20.251.9.203:34706] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws49.php"] [unique_id "acHTvvwkUqN4GJAI5oWpzAAAAQo"]
[Tue Mar 24 07:58:55.917299 2026] [:error] [pid 3137:tid 3146] [client 20.251.9.203:13747] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "acHTv5dZesutm6dfYM8q7wAAAMc"]
[Tue Mar 24 07:58:57.276260 2026] [:error] [pid 38767:tid 38773] [client 20.251.9.203:38871] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "acHTwfwkUqN4GJAI5oWpzgAAAQM"]
[Tue Mar 24 07:58:58.857758 2026] [:error] [pid 3030:tid 3057] [client 20.251.9.203:49641] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "acHTwgyOuILyynfcqfkNKAAAAAg"]
[Tue Mar 24 07:58:59.661526 2026] [:error] [pid 64198:tid 64207] [client 20.251.9.203:10458] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "acHTw3VzJqf6OS_oSZ0MyQAAAUc"]
[Tue Mar 24 07:59:02.167041 2026] [:error] [pid 3137:tid 3147] [client 20.251.9.203:10466] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "acHTxpdZesutm6dfYM8q-wAAAMg"]
[Tue Mar 24 07:59:03.479245 2026] [:error] [pid 3137:tid 3162] [client 20.251.9.203:49632] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "acHTx5dZesutm6dfYM8rAgAAANc"]
[Tue Mar 24 07:59:04.213698 2026] [:error] [pid 3137:tid 3150] [client 20.251.9.203:13705] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "acHTyJdZesutm6dfYM8rCAAAAMs"]
[Tue Mar 24 07:59:05.441083 2026] [:error] [pid 38767:tid 38789] [client 20.251.9.203:13745] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "acHTyfwkUqN4GJAI5oWp4AAAARM"]
[Tue Mar 24 07:59:06.490063 2026] [:error] [pid 3137:tid 3154] [client 20.251.9.203:16027] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acHTypdZesutm6dfYM8rFQAAAM8"]
[Tue Mar 24 07:59:08.192362 2026] [:error] [pid 3032:tid 3114] [client 20.251.9.203:12267] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acHTzCa_-JXXD03-JNzoBwAAAIs"]
[Tue Mar 24 07:59:10.582600 2026] [:error] [pid 38767:tid 38780] [client 20.251.9.203:10491] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acHTzvwkUqN4GJAI5oWp8AAAAQo"]
[Tue Mar 24 07:59:12.255463 2026] [:error] [pid 64198:tid 64204] [client 20.251.9.203:12204] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acHT0HVzJqf6OS_oSZ0M2AAAAUQ"]
[Tue Mar 24 07:59:13.637062 2026] [:error] [pid 64198:tid 64203] [client 20.251.9.203:10881] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/callback.php"] [unique_id "acHT0XVzJqf6OS_oSZ0M2QAAAUM"]
[Tue Mar 24 07:59:14.803958 2026] [:error] [pid 3137:tid 3145] [client 20.251.9.203:18747] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/callback.php"] [unique_id "acHT0pdZesutm6dfYM8rIQAAAMY"]
[Tue Mar 24 07:59:17.280970 2026] [:error] [pid 3137:tid 3147] [client 20.251.9.203:10351] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/callback.php"] [unique_id "acHT1ZdZesutm6dfYM8rKgAAAMg"]
[Tue Mar 24 07:59:18.309381 2026] [:error] [pid 3030:tid 3061] [client 20.251.9.203:15526] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/callback.php"] [unique_id "acHT1gyOuILyynfcqfkNMAAAAAw"]
[Tue Mar 24 07:59:19.978464 2026] [:error] [pid 3030:tid 3050] [client 20.251.9.203:17206] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acHT1wyOuILyynfcqfkNMwAAAAE"]
[Tue Mar 24 07:59:21.202983 2026] [:error] [pid 3137:tid 3156] [client 20.251.9.203:4823] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acHT2ZdZesutm6dfYM8rNAAAANE"]
[Tue Mar 24 07:59:22.417410 2026] [:error] [pid 3137:tid 3142] [client 20.251.9.203:18719] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acHT2pdZesutm6dfYM8rOQAAAMM"]
[Tue Mar 24 07:59:23.596408 2026] [:error] [pid 3137:tid 3158] [client 20.251.9.203:15089] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acHT25dZesutm6dfYM8rQAAAANM"]
[Tue Mar 24 07:59:25.541701 2026] [:error] [pid 64198:tid 64203] [client 20.251.9.203:12220] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acHT3XVzJqf6OS_oSZ0M6AAAAUM"]
[Tue Mar 24 07:59:27.091848 2026] [:error] [pid 3032:tid 3127] [client 20.251.9.203:10339] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acHT3ya_-JXXD03-JNzoIQAAAJc"]
[Tue Mar 24 07:59:29.961498 2026] [:error] [pid 3031:tid 3086] [client 20.251.9.203:49612] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acHT4aJBKytnG47nuib4XQAAAEo"]
[Tue Mar 24 07:59:31.828104 2026] [:error] [pid 3030:tid 3051] [client 20.251.9.203:12509] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acHT4wyOuILyynfcqfkNNwAAAAI"]
[Tue Mar 24 07:59:32.582186 2026] [:error] [pid 3030:tid 3053] [client 20.251.9.203:29654] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acHT5AyOuILyynfcqfkNOQAAAAQ"]
[Tue Mar 24 07:59:34.275375 2026] [:error] [pid 38767:tid 38780] [client 20.251.9.203:10895] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Wed Mar 25 00:54:16.832387 2026] [:error] [pid 58154:tid 58173] [client 34.145.164.214:62686] [client 34.145.164.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.145.164.214, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "acLBuA0pGUh6bwD3ouKGVgAAANA"]
[Wed Mar 25 00:54:16.835960 2026] [:error] [pid 58154:tid 58173] [client 34.145.164.214:62686] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Mar 25 00:54:17.298501 2026] [:error] [pid 58154:tid 58172] [client 34.145.164.214:62686] [client 34.145.164.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "acLBuQ0pGUh6bwD3ouKGYAAAAM8"]
[Wed Mar 25 00:54:17.894047 2026] [:error] [pid 58154:tid 58176] [client 34.145.164.214:49401] [client 34.145.164.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "acLBuQ0pGUh6bwD3ouKGZgAAANM"]
[Wed Mar 25 00:54:18.549356 2026] [:error] [pid 20371:tid 20394] [client 34.145.164.214:63877] [client 34.145.164.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "acLBuub25OL4yTv2fF9tSwAAARU"]
[Wed Mar 25 00:54:19.266163 2026] [:error] [pid 20371:tid 20388] [client 34.145.164.214:56776] [client 34.145.164.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "acLBu-b25OL4yTv2fF9tVgAAAQ8"]
[Wed Mar 25 00:54:20.257044 2026] [:error] [pid 20371:tid 20389] [client 34.145.164.214:61213] [client 34.145.164.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "acLBvOb25OL4yTv2fF9tWgAAARA"]
[Wed Mar 25 00:54:20.944191 2026] [:error] [pid 20371:tid 20383] [client 34.145.164.214:51922] [client 34.145.164.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "acLBvOb25OL4yTv2fF9tXAAAAQo"]
[Wed Mar 25 00:54:21.622097 2026] [:error] [pid 58154:tid 58162] [client 34.145.164.214:50550] [client 34.145.164.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "acLBvQ0pGUh6bwD3ouKGeAAAAMU"]
[Wed Mar 25 00:54:22.263912 2026] [:error] [pid 57702:tid 57916] [client 34.145.164.214:53315] [client 34.145.164.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "acLBvqS8TU_xcQFvlnb70QAAAA0"]
[Wed Mar 25 05:47:22.758426 2026] [:error] [pid 47989:tid 48002] [client 68.183.151.56:59600] [client 68.183.151.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "acMGaiWKdJMhIccROjlo8QAAAUs"]
[Wed Mar 25 18:01:42.970731 2026] [:error] [pid 47989:tid 48002] [client 20.220.197.73:57371] [client 20.220.197.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acOyhiWKdJMhIccROjmgDQAAAUs"]
[Wed Mar 25 18:01:43.800151 2026] [:error] [pid 26269:tid 26297] [client 20.220.197.73:57406] [client 20.220.197.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acOyh0n7e-ZQbaIs7qyxOQAAAZU"]
[Wed Mar 25 18:01:44.631684 2026] [:error] [pid 26449:tid 26456] [client 20.220.197.73:15294] [client 20.220.197.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acOyiNpZ2T15NDqzAjFq2QAAAkM"]
[Wed Mar 25 18:01:45.477571 2026] [:error] [pid 47989:tid 48004] [client 20.220.197.73:59558] [client 20.220.197.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acOyiSWKdJMhIccROjmgDgAAAU0"]
[Wed Mar 25 19:08:55.505494 2026] [:error] [pid 25969:tid 26044] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/classgoto24.php
[Wed Mar 25 19:08:55.776339 2026] [:error] [pid 25969:tid 26034] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Wed Mar 25 19:08:56.032024 2026] [:error] [pid 25969:tid 26028] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Mar 25 19:08:56.275355 2026] [:error] [pid 25969:tid 26049] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Wed Mar 25 19:08:56.541429 2026] [:error] [pid 25969:tid 26038] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Mar 25 19:08:56.850055 2026] [:error] [pid 25969:tid 26045] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/h02ugyh.php
[Wed Mar 25 19:08:57.093846 2026] [:error] [pid 25969:tid 26039] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Wed Mar 25 19:08:57.348082 2026] [:error] [pid 25969:tid 26035] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/ws47.php
[Wed Mar 25 19:08:57.608810 2026] [:error] [pid 25969:tid 26030] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/vvvb.php
[Wed Mar 25 19:08:57.888126 2026] [:error] [pid 25969:tid 26043] [client 158.158.96.10:41207] File does not exist: /usr/local/apache/htdocs/suspended-page/x12.php
[Wed Mar 25 19:08:58.141664 2026] [:error] [pid 25969:tid 26026] [client 158.158.96.10:41207] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zcsu.php"] [unique_id "acPCShd3aEUmOfdKja8GwgAAA8A"]
[Wed Mar 25 19:08:58.743289 2026] [:error] [pid 25967:tid 25995] [client 158.158.96.10:62196] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zcsu.php"] [unique_id "acPCSvg8Qtq7ZM4mSFlORAAAA1c"]
[Wed Mar 25 19:08:59.642287 2026] [:error] [pid 892:tid 920] [client 158.158.96.10:49598] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zcsu.php"] [unique_id "acPCSyT_G8WMU3T3yxrO3AAAANU"]
[Wed Mar 25 19:09:00.286882 2026] [:error] [pid 26449:tid 26466] [client 158.158.96.10:5500] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zcsu.php"] [unique_id "acPCTNpZ2T15NDqzAjF29AAAAk0"]
[Wed Mar 25 19:09:00.848961 2026] [:error] [pid 47989:tid 48010] [client 158.158.96.10:49593] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "acPCTCWKdJMhIccROjnNlAAAAVM"]
[Wed Mar 25 19:09:01.395103 2026] [:error] [pid 47989:tid 48013] [client 158.158.96.10:54890] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "acPCTSWKdJMhIccROjnNlwAAAVY"]
[Wed Mar 25 19:09:01.929804 2026] [:error] [pid 47989:tid 48012] [client 158.158.96.10:38089] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "acPCTSWKdJMhIccROjnNnAAAAVU"]
[Wed Mar 25 19:09:02.510184 2026] [:error] [pid 47989:tid 48015] [client 158.158.96.10:49567] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "acPCTiWKdJMhIccROjnNpQAAAVg"]
[Wed Mar 25 19:09:03.021173 2026] [:error] [pid 47989:tid 47999] [client 158.158.96.10:61106] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cxs.php"] [unique_id "acPCTyWKdJMhIccROjnNrQAAAUg"]
[Wed Mar 25 19:09:03.508647 2026] [:error] [pid 47989:tid 48008] [client 158.158.96.10:57534] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cxs.php"] [unique_id "acPCTyWKdJMhIccROjnNsgAAAVE"]
[Wed Mar 25 19:09:04.017374 2026] [:error] [pid 25875:tid 25897] [client 158.158.96.10:42202] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cxs.php"] [unique_id "acPCUBJ38QkS3NyfshztvQAAApA"]
[Wed Mar 25 19:09:04.528445 2026] [:error] [pid 25875:tid 25884] [client 158.158.96.10:5353] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cxs.php"] [unique_id "acPCUBJ38QkS3NyfshztvgAAAoM"]
[Wed Mar 25 19:09:05.159898 2026] [:error] [pid 26321:tid 26339] [client 158.158.96.10:41205] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-scanner.php"] [unique_id "acPCUfKO65qqGZCSPZpCFQAAAgA"]
[Wed Mar 25 19:09:05.714166 2026] [:error] [pid 47989:tid 47991] [client 158.158.96.10:61063] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-scanner.php"] [unique_id "acPCUSWKdJMhIccROjnNxQAAAUA"]
[Wed Mar 25 19:09:06.240157 2026] [:error] [pid 25967:tid 25991] [client 158.158.96.10:38125] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-scanner.php"] [unique_id "acPCUvg8Qtq7ZM4mSFlOdgAAA1M"]
[Wed Mar 25 19:09:06.777577 2026] [:error] [pid 25875:tid 25889] [client 158.158.96.10:49556] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-scanner.php"] [unique_id "acPCUhJ38QkS3NyfshztxAAAAog"]
[Wed Mar 25 19:09:07.555409 2026] [:error] [pid 26321:tid 26362] [client 158.158.96.10:58377] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "acPCU_KO65qqGZCSPZpCIwAAAhU"]
[Wed Mar 25 19:09:08.488389 2026] [:error] [pid 25875:tid 25882] [client 158.158.96.10:61073] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "acPCVBJ38QkS3NyfshztygAAAoE"]
[Wed Mar 25 19:09:09.154606 2026] [:error] [pid 26321:tid 26350] [client 158.158.96.10:61119] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "acPCVfKO65qqGZCSPZpCJgAAAgk"]
[Wed Mar 25 19:09:09.824856 2026] [:error] [pid 47946:tid 47952] [client 158.158.96.10:41156] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "acPCVTipQTqBMSeKYheCFQAAAQQ"]
[Wed Mar 25 19:09:11.053994 2026] [:error] [pid 25875:tid 25883] [client 158.158.96.10:38098] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acPCVxJ38QkS3Nyfshzt2gAAAoI"]
[Wed Mar 25 19:09:13.499122 2026] [:error] [pid 47989:tid 47997] [client 158.158.96.10:5372] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acPCWSWKdJMhIccROjnN9AAAAUY"]
[Wed Mar 25 19:09:15.188421 2026] [:error] [pid 25875:tid 25893] [client 158.158.96.10:61621] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acPCWxJ38QkS3Nyfshzt5gAAAow"]
[Wed Mar 25 19:09:17.064276 2026] [:error] [pid 47989:tid 48005] [client 158.158.96.10:41152] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acPCXSWKdJMhIccROjnOBQAAAU4"]
[Wed Mar 25 19:09:19.060184 2026] [:error] [pid 47989:tid 48010] [client 158.158.96.10:42177] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acPCXyWKdJMhIccROjnOEwAAAVM"]
[Wed Mar 25 19:09:20.786316 2026] [:error] [pid 25967:tid 25972] [client 158.158.96.10:57495] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acPCYPg8Qtq7ZM4mSFlOlwAAA0A"]
[Wed Mar 25 19:09:22.531450 2026] [:error] [pid 47989:tid 47999] [client 158.158.96.10:49553] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acPCYiWKdJMhIccROjnOGQAAAUg"]
[Wed Mar 25 19:09:23.364624 2026] [:error] [pid 47989:tid 47993] [client 158.158.96.10:57499] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acPCYyWKdJMhIccROjnOHgAAAUI"]
[Wed Mar 25 19:09:24.490442 2026] [:error] [pid 47989:tid 48006] [client 158.158.96.10:58417] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "acPCZCWKdJMhIccROjnOIAAAAU8"]
[Wed Mar 25 19:09:25.198995 2026] [:error] [pid 47989:tid 48013] [client 158.158.96.10:61610] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "acPCZSWKdJMhIccROjnOIQAAAVY"]
[Wed Mar 25 19:09:26.029380 2026] [:error] [pid 47946:tid 47953] [client 158.158.96.10:61085] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "acPCZjipQTqBMSeKYheCGgAAAQU"]
[Wed Mar 25 19:09:26.887292 2026] [:error] [pid 26321:tid 26352] [client 158.158.96.10:5560] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "acPCZvKO65qqGZCSPZpCQAAAAgs"]
[Wed Mar 25 19:09:27.495541 2026] [:error] [pid 25875:tid 25892] [client 158.158.96.10:40497] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "acPCZxJ38QkS3Nyfshzt8QAAAos"]
[Wed Mar 25 19:09:28.006045 2026] [:error] [pid 25875:tid 25903] [client 158.158.96.10:41179] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "acPCaBJ38QkS3Nyfshzt9AAAApY"]
[Wed Mar 25 19:09:28.592434 2026] [:error] [pid 25967:tid 25979] [client 158.158.96.10:49583] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "acPCaPg8Qtq7ZM4mSFlOnQAAA0c"]
[Wed Mar 25 19:09:29.125955 2026] [:error] [pid 47989:tid 47994] [client 158.158.96.10:61088] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "acPCaSWKdJMhIccROjnOKQAAAUM"]
[Wed Mar 25 19:09:29.658023 2026] [:error] [pid 47989:tid 47998] [client 158.158.96.10:38109] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "acPCaSWKdJMhIccROjnOKwAAAUc"]
[Wed Mar 25 19:09:30.227137 2026] [:error] [pid 47989:tid 48013] [client 158.158.96.10:37329] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "acPCaiWKdJMhIccROjnOLQAAAVY"]
[Wed Mar 25 19:09:30.762391 2026] [:error] [pid 47989:tid 48004] [client 158.158.96.10:37358] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "acPCaiWKdJMhIccROjnOMgAAAU0"]
[Wed Mar 25 19:09:31.337644 2026] [:error] [pid 25967:tid 25996] [client 158.158.96.10:61057] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "acPCa_g8Qtq7ZM4mSFlOoQAAA1g"]
[Wed Mar 25 19:09:31.971410 2026] [:error] [pid 25967:tid 25972] [client 158.158.96.10:40470] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xvs.php"] [unique_id "acPCa_g8Qtq7ZM4mSFlOpAAAA0A"]
[Wed Mar 25 19:09:32.505200 2026] [:error] [pid 25967:tid 25992] [client 158.158.96.10:49537] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xvs.php"] [unique_id "acPCbPg8Qtq7ZM4mSFlOpQAAA1Q"]
[Wed Mar 25 19:09:33.360786 2026] [:error] [pid 47989:tid 48008] [client 158.158.96.10:49536] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xvs.php"] [unique_id "acPCbSWKdJMhIccROjnOdwAAAVE"]
[Wed Mar 25 19:09:33.870958 2026] [:error] [pid 47989:tid 48013] [client 158.158.96.10:61097] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xvs.php"] [unique_id "acPCbSWKdJMhIccROjnOewAAAVY"]
[Wed Mar 25 19:09:34.562659 2026] [:error] [pid 47989:tid 48008] [client 158.158.96.10:41171] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acPCbiWKdJMhIccROjnOgQAAAVE"]
[Wed Mar 25 19:09:35.177105 2026] [:error] [pid 26321:tid 26354] [client 158.158.96.10:38107] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acPCb_KO65qqGZCSPZpCRAAAAg0"]
[Wed Mar 25 19:09:35.778389 2026] [:error] [pid 25967:tid 25982] [client 158.158.96.10:41184] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acPCb_g8Qtq7ZM4mSFlOpwAAA0o"]
[Wed Mar 25 19:09:36.509621 2026] [:error] [pid 892:tid 894] [client 158.158.96.10:58411] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acPCcCT_G8WMU3T3yxrO9wAAAMA"]
[Wed Mar 25 19:09:37.347776 2026] [:error] [pid 25967:tid 25975] [client 158.158.96.10:61585] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "acPCcfg8Qtq7ZM4mSFlOqQAAA0M"]
[Wed Mar 25 19:09:37.926441 2026] [:error] [pid 25967:tid 25981] [client 158.158.96.10:57480] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "acPCcfg8Qtq7ZM4mSFlOrAAAA0k"]
[Wed Mar 25 19:09:38.487296 2026] [:error] [pid 25967:tid 25988] [client 158.158.96.10:46351] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "acPCcvg8Qtq7ZM4mSFlOrgAAA1A"]
[Wed Mar 25 19:09:39.098384 2026] [:error] [pid 25967:tid 25976] [client 158.158.96.10:40455] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "acPCc_g8Qtq7ZM4mSFlOsgAAA0Q"]
[Wed Mar 25 19:09:39.661552 2026] [:error] [pid 25875:tid 25904] [client 158.158.96.10:42207] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acPCcxJ38QkS3NyfshzuCwAAApc"]
[Wed Mar 25 19:09:40.302516 2026] [:error] [pid 892:tid 914] [client 158.158.96.10:57511] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acPCdCT_G8WMU3T3yxrO-wAAANA"]
[Wed Mar 25 19:09:41.018493 2026] [:error] [pid 25875:tid 25890] [client 158.158.96.10:42178] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acPCdRJ38QkS3NyfshzuEAAAAok"]
[Wed Mar 25 19:09:41.675720 2026] [:error] [pid 47989:tid 47999] [client 158.158.96.10:57522] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acPCdSWKdJMhIccROjnOkgAAAUg"]
[Wed Mar 25 19:09:42.381050 2026] [:error] [pid 47989:tid 48013] [client 158.158.96.10:62147] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acPCdiWKdJMhIccROjnOlwAAAVY"]
[Wed Mar 25 19:09:42.937519 2026] [:error] [pid 892:tid 911] [client 158.158.96.10:5531] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acPCdiT_G8WMU3T3yxrO_wAAAM0"]
[Wed Mar 25 19:09:43.603912 2026] [:error] [pid 25875:tid 25887] [client 158.158.96.10:5779] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acPCdxJ38QkS3NyfshzuFQAAAoY"]
[Wed Mar 25 19:09:44.139373 2026] [:error] [pid 25875:tid 25894] [client 158.158.96.10:54905] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acPCeBJ38QkS3NyfshzuGAAAAo0"]
[Wed Mar 25 19:09:45.062047 2026] [:error] [pid 26449:tid 26477] [client 158.158.96.10:57494] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acPCedpZ2T15NDqzAjF3GwAAAlg"]
[Wed Mar 25 19:09:45.651694 2026] [:error] [pid 47989:tid 48013] [client 158.158.96.10:5777] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acPCeSWKdJMhIccROjnOogAAAVY"]
[Wed Mar 25 19:09:46.251072 2026] [:error] [pid 26449:tid 26456] [client 158.158.96.10:41168] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acPCetpZ2T15NDqzAjF3HAAAAkM"]
[Wed Mar 25 19:09:46.787517 2026] [:error] [pid 47989:tid 48004] [client 158.158.96.10:37322] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acPCeiWKdJMhIccROjnOsgAAAU0"]
[Wed Mar 25 19:09:47.338672 2026] [:error] [pid 892:tid 922] [client 158.158.96.10:5814] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feokc.php"] [unique_id "acPCeyT_G8WMU3T3yxrPAgAAANc"]
[Wed Mar 25 19:09:47.946835 2026] [:error] [pid 25875:tid 25897] [client 158.158.96.10:63506] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feokc.php"] [unique_id "acPCexJ38QkS3NyfshzuHAAAApA"]
[Wed Mar 25 19:09:48.501641 2026] [:error] [pid 756:tid 850] [client 158.158.96.10:5765] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feokc.php"] [unique_id "acPCfDOaW6oylMIDBCQdiAAAAIA"]
[Wed Mar 25 19:09:49.038546 2026] [:error] [pid 25875:tid 25890] [client 158.158.96.10:58058] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feokc.php"] [unique_id "acPCfRJ38QkS3NyfshzuIAAAAok"]
[Wed Mar 25 19:09:49.565651 2026] [:error] [pid 26449:tid 26464] [client 158.158.96.10:5535] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "acPCfdpZ2T15NDqzAjF3HQAAAks"]
[Wed Mar 25 19:09:50.177145 2026] [:error] [pid 25967:tid 25977] [client 158.158.96.10:63742] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "acPCfvg8Qtq7ZM4mSFlOuQAAA0U"]
[Wed Mar 25 19:09:50.758203 2026] [:error] [pid 25967:tid 25986] [client 158.158.96.10:58082] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "acPCfvg8Qtq7ZM4mSFlOugAAA04"]
[Wed Mar 25 19:09:51.304146 2026] [:error] [pid 25967:tid 25972] [client 158.158.96.10:35439] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "acPCf_g8Qtq7ZM4mSFlOvQAAA0A"]
[Wed Mar 25 19:09:51.868460 2026] [:error] [pid 47989:tid 48005] [client 158.158.96.10:63734] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acPCfyWKdJMhIccROjnOwAAAAU4"]
[Wed Mar 25 19:09:52.467894 2026] [:error] [pid 26449:tid 26469] [client 158.158.96.10:58090] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acPCgNpZ2T15NDqzAjF3HwAAAlA"]
[Wed Mar 25 19:09:53.028603 2026] [:error] [pid 25967:tid 25995] [client 158.158.96.10:47925] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acPCgfg8Qtq7ZM4mSFlOxAAAA1c"]
[Wed Mar 25 19:09:53.532852 2026] [:error] [pid 25875:tid 25895] [client 158.158.96.10:5770] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acPCgRJ38QkS3NyfshzuJAAAAo4"]
[Wed Mar 25 19:09:54.228827 2026] [:error] [pid 25875:tid 25894] [client 158.158.96.10:58389] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lp6.php"] [unique_id "acPCghJ38QkS3NyfshzuJgAAAo0"]
[Wed Mar 25 19:09:54.954299 2026] [:error] [pid 25967:tid 25989] [client 158.158.96.10:5567] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lp6.php"] [unique_id "acPCgvg8Qtq7ZM4mSFlOygAAA1E"]
[Wed Mar 25 19:09:55.482080 2026] [:error] [pid 26269:tid 26293] [client 158.158.96.10:57484] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lp6.php"] [unique_id "acPCg0n7e-ZQbaIs7qy35QAAAZE"]
[Wed Mar 25 19:09:56.038433 2026] [:error] [pid 25967:tid 25982] [client 158.158.96.10:47907] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lp6.php"] [unique_id "acPChPg8Qtq7ZM4mSFlOzQAAA0o"]
[Wed Mar 25 19:09:56.642540 2026] [:error] [pid 47989:tid 48010] [client 158.158.96.10:58080] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acPChCWKdJMhIccROjnOxgAAAVM"]
[Wed Mar 25 19:09:57.491534 2026] [:error] [pid 25967:tid 25995] [client 158.158.96.10:58083] File does not exist: /usr/local/apache/htdocs/suspended-page/24.php
[Wed Mar 25 19:09:57.734570 2026] [:error] [pid 25967:tid 25993] [client 158.158.96.10:58083] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Wed Mar 25 19:09:57.998805 2026] [:error] [pid 25967:tid 25987] [client 158.158.96.10:58083] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Wed Mar 25 19:09:58.243779 2026] [:error] [pid 25967:tid 25984] [client 158.158.96.10:58083] File does not exist: /usr/local/apache/htdocs/suspended-page/aifa.php
[Wed Mar 25 19:09:58.486497 2026] [:error] [pid 25967:tid 25979] [client 158.158.96.10:58083] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Wed Mar 25 19:09:58.790873 2026] [:error] [pid 25967:tid 25977] [client 158.158.96.10:58083] [client 158.158.96.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/app.php"] [unique_id "acPChvg8Qtq7ZM4mSFlO1QAAA0U"]
[Wed Mar 25 19:09:59.637150 2026] [:error] [pid 25875:tid 25890] [client 158.158.96.10:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/aee.php
[Wed Mar 25 19:09:59.880164 2026] [:error] [pid 25875:tid 25898] [client 158.158.96.10:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/zogy1.php
[Wed Mar 25 19:10:00.132961 2026] [:error] [pid 25875:tid 25887] [client 158.158.96.10:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Wed Mar 25 19:10:00.379089 2026] [:error] [pid 25875:tid 25901] [client 158.158.96.10:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Wed Mar 25 19:10:00.635128 2026] [:error] [pid 25875:tid 25903] [client 158.158.96.10:65444] File does not exist: /usr/local/apache/htdocs/suspended-page/aapig.php
[Wed Mar 25 19:10:00.884284 2026] [:error] [pid 25875:tid 25894] [client 158.158.96.10:65444] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/com.php"] [unique_id "acPCiBJ38QkS3NyfshzuNgAAAo0"]
[Wed Mar 25 19:10:01.773479 2026] [:error] [pid 25967:tid 25983] [client 158.158.96.10:5778] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/com.php"] [unique_id "acPCifg8Qtq7ZM4mSFlO1wAAA0s"]
[Wed Mar 25 19:10:02.466026 2026] [:error] [pid 26321:tid 26351] [client 158.158.96.10:35431] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/com.php"] [unique_id "acPCivKO65qqGZCSPZpCWwAAAgo"]
[Wed Mar 25 19:10:03.386170 2026] [:error] [pid 26449:tid 26469] [client 158.158.96.10:35421] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/com.php"] [unique_id "acPCi9pZ2T15NDqzAjF3LQAAAlA"]
[Wed Mar 25 19:10:04.100582 2026] [:error] [pid 47946:tid 47960] [client 158.158.96.10:47921] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ta0ol.php"] [unique_id "acPCjDipQTqBMSeKYheCHQAAAQw"]
[Wed Mar 25 19:10:04.957004 2026] [:error] [pid 25875:tid 25887] [client 158.158.96.10:5801] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ta0ol.php"] [unique_id "acPCjBJ38QkS3NyfshzuPQAAAoY"]
[Wed Mar 25 19:10:05.953251 2026] [:error] [pid 26449:tid 26465] [client 158.158.96.10:47909] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ta0ol.php"] [unique_id "acPCjdpZ2T15NDqzAjF3MgAAAkw"]
[Wed Mar 25 19:10:06.578758 2026] [:error] [pid 25875:tid 25883] [client 158.158.96.10:35405] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ta0ol.php"] [unique_id "acPCjhJ38QkS3NyfshzuQwAAAoI"]
[Wed Mar 25 19:10:07.412730 2026] [:error] [pid 26269:tid 26290] [client 158.158.96.10:59098] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acPCj0n7e-ZQbaIs7qy38wAAAY4"]
[Wed Mar 25 19:10:08.481090 2026] [:error] [pid 25875:tid 25882] [client 158.158.96.10:65412] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acPCkBJ38QkS3NyfshzuRgAAAoE"]
[Wed Mar 25 19:10:09.597878 2026] [:error] [pid 25875:tid 25898] [client 158.158.96.10:47885] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acPCkRJ38QkS3NyfshzuSAAAApE"]
[Wed Mar 25 19:10:10.647440 2026] [:error] [pid 25967:tid 25987] [client 158.158.96.10:32839] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acPCkvg8Qtq7ZM4mSFlO3wAAA08"]
[Wed Mar 25 19:10:11.999838 2026] [:error] [pid 756:tid 852] [client 158.158.96.10:62496] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "acPCkzOaW6oylMIDBCQdjQAAAII"]
[Wed Mar 25 19:10:12.718424 2026] [:error] [pid 25969:tid 26039] [client 158.158.96.10:54198] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "acPClBd3aEUmOfdKja8G1QAAA80"]
[Wed Mar 25 19:10:15.415406 2026] [:error] [pid 47946:tid 47972] [client 158.158.96.10:65460] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "acPClzipQTqBMSeKYheCJAAAARg"]
[Wed Mar 25 19:10:16.221391 2026] [:error] [pid 25967:tid 25984] [client 158.158.96.10:45854] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "acPCmPg8Qtq7ZM4mSFlO7gAAA0w"]
[Wed Mar 25 19:10:17.244605 2026] [:error] [pid 25875:tid 25902] [client 158.158.96.10:60529] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wander.php"] [unique_id "acPCmRJ38QkS3NyfshzuSwAAApU"]
[Wed Mar 25 19:10:18.408224 2026] [:error] [pid 25967:tid 25974] [client 158.158.96.10:46878] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wander.php"] [unique_id "acPCmvg8Qtq7ZM4mSFlO-gAAA0I"]
[Wed Mar 25 19:10:19.267152 2026] [:error] [pid 26449:tid 26458] [client 158.158.96.10:41623] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wander.php"] [unique_id "acPCm9pZ2T15NDqzAjF3OgAAAkU"]
[Wed Mar 25 19:10:20.524244 2026] [:error] [pid 25967:tid 25994] [client 158.158.96.10:43804] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wander.php"] [unique_id "acPCnPg8Qtq7ZM4mSFlPAAAAA1Y"]
[Wed Mar 25 19:10:21.323867 2026] [:error] [pid 25967:tid 25979] [client 158.158.96.10:5718] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "acPCnfg8Qtq7ZM4mSFlPBgAAA0c"]
[Wed Mar 25 19:10:22.261428 2026] [:error] [pid 25875:tid 25881] [client 158.158.96.10:33527] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "acPCnhJ38QkS3NyfshzuUAAAAoA"]
[Wed Mar 25 19:10:23.528425 2026] [:error] [pid 26321:tid 26350] [client 158.158.96.10:43821] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "acPCn_KO65qqGZCSPZpCcgAAAgk"]
[Wed Mar 25 19:10:24.274744 2026] [:error] [pid 47989:tid 48012] [client 158.158.96.10:58018] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "acPCoCWKdJMhIccROjnO8AAAAVU"]
[Wed Mar 25 19:10:25.029344 2026] [:error] [pid 47989:tid 47993] [client 158.158.96.10:54162] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acPCoSWKdJMhIccROjnO9AAAAUI"]
[Wed Mar 25 19:10:26.069783 2026] [:error] [pid 47989:tid 47992] [client 158.158.96.10:43818] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acPCoiWKdJMhIccROjnO_QAAAUE"]
[Wed Mar 25 19:10:27.171506 2026] [:error] [pid 26321:tid 26353] [client 158.158.96.10:43255] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acPCo_KO65qqGZCSPZpCcwAAAgw"]
[Wed Mar 25 19:10:28.194187 2026] [:error] [pid 756:tid 857] [client 158.158.96.10:5634] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acPCpDOaW6oylMIDBCQdkwAAAIU"]
[Wed Mar 25 19:10:28.884816 2026] [:error] [pid 26321:tid 26340] [client 158.158.96.10:62878] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "acPCpPKO65qqGZCSPZpCdQAAAgE"]
[Wed Mar 25 19:10:29.973923 2026] [:error] [pid 26321:tid 26360] [client 158.158.96.10:43249] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "acPCpfKO65qqGZCSPZpCegAAAhM"]
[Wed Mar 25 19:10:30.966599 2026] [:error] [pid 26321:tid 26364] [client 158.158.96.10:43796] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "acPCpvKO65qqGZCSPZpCfwAAAhc"]
[Wed Mar 25 19:10:32.198988 2026] [:error] [pid 25967:tid 25988] [client 158.158.96.10:5694] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "acPCqPg8Qtq7ZM4mSFlPFQAAA1A"]
[Wed Mar 25 19:10:35.421320 2026] [:error] [pid 26449:tid 26462] [client 158.158.96.10:44800] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acPCq9pZ2T15NDqzAjF3QAAAAkk"]
[Wed Mar 25 19:10:37.054185 2026] [:error] [pid 892:tid 921] [client 158.158.96.10:62855] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acPCrST_G8WMU3T3yxrPDwAAANY"]
[Wed Mar 25 19:10:38.002052 2026] [:error] [pid 47989:tid 47996] [client 158.158.96.10:5244] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acPCriWKdJMhIccROjnPAAAAAUU"]
[Wed Mar 25 19:10:39.028430 2026] [:error] [pid 25969:tid 26026] [client 158.158.96.10:62892] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acPCrxd3aEUmOfdKja8G4wAAA8A"]
[Wed Mar 25 19:10:41.162546 2026] [:error] [pid 47989:tid 48002] [client 158.158.96.10:63998] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "acPCsSWKdJMhIccROjnPAwAAAUs"]
[Wed Mar 25 19:10:42.130710 2026] [:error] [pid 47989:tid 47999] [client 158.158.96.10:57062] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "acPCsiWKdJMhIccROjnPBgAAAUg"]
[Wed Mar 25 19:10:42.898880 2026] [:error] [pid 47989:tid 48010] [client 158.158.96.10:5174] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "acPCsiWKdJMhIccROjnPCgAAAVM"]
[Wed Mar 25 19:10:43.843938 2026] [:error] [pid 25875:tid 25896] [client 158.158.96.10:6112] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "acPCsxJ38QkS3NyfshzuVAAAAo8"]
[Wed Mar 25 19:10:45.065772 2026] [:error] [pid 25967:tid 25990] [client 158.158.96.10:5196] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web.php"] [unique_id "acPCtfg8Qtq7ZM4mSFlPMwAAA1I"]
[Wed Mar 25 19:10:46.126929 2026] [:error] [pid 25967:tid 25995] [client 158.158.96.10:63991] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web.php"] [unique_id "acPCtvg8Qtq7ZM4mSFlPNAAAA1c"]
[Wed Mar 25 19:10:46.832645 2026] [:error] [pid 47989:tid 47993] [client 158.158.96.10:44819] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web.php"] [unique_id "acPCtiWKdJMhIccROjnPEgAAAUI"]
[Wed Mar 25 19:10:47.766865 2026] [:error] [pid 25875:tid 25888] [client 158.158.96.10:63218] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web.php"] [unique_id "acPCtxJ38QkS3NyfshzuXgAAAoc"]
[Wed Mar 25 19:10:48.456515 2026] [:error] [pid 25875:tid 25900] [client 158.158.96.10:5290] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acPCuBJ38QkS3NyfshzuZwAAApM"]
[Wed Mar 25 19:10:49.369120 2026] [:error] [pid 25875:tid 25884] [client 158.158.96.10:45375] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acPCuRJ38QkS3NyfshzuawAAAoM"]
[Wed Mar 25 19:10:50.158146 2026] [:error] [pid 25967:tid 25989] [client 158.158.96.10:5149] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acPCuvg8Qtq7ZM4mSFlPNgAAA1E"]
[Wed Mar 25 19:10:51.429420 2026] [:error] [pid 26321:tid 26340] [client 158.158.96.10:63202] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acPCu_KO65qqGZCSPZpCjgAAAgE"]
[Wed Mar 25 19:10:53.437552 2026] [:error] [pid 47989:tid 47994] [client 158.158.96.10:63217] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "acPCvSWKdJMhIccROjnPGAAAAUM"]
[Wed Mar 25 19:10:56.179841 2026] [:error] [pid 25875:tid 25891] [client 158.158.96.10:39340] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "acPCwBJ38QkS3Nyfshzu8gAAAoo"]
[Wed Mar 25 19:10:57.553446 2026] [:error] [pid 47989:tid 48014] [client 158.158.96.10:57056] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "acPCwSWKdJMhIccROjnPHQAAAVc"]
[Wed Mar 25 19:10:58.599020 2026] [:error] [pid 47989:tid 48003] [client 158.158.96.10:6080] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "acPCwiWKdJMhIccROjnPIwAAAUw"]
[Wed Mar 25 19:11:00.748165 2026] [:error] [pid 892:tid 908] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/awh.php
[Wed Mar 25 19:11:01.016418 2026] [:error] [pid 892:tid 906] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Wed Mar 25 19:11:01.263623 2026] [:error] [pid 892:tid 910] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Wed Mar 25 19:11:01.511121 2026] [:error] [pid 892:tid 911] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Wed Mar 25 19:11:01.815623 2026] [:error] [pid 892:tid 923] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Mar 25 19:11:02.302323 2026] [:error] [pid 892:tid 921] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/ng.php
[Wed Mar 25 19:11:02.613369 2026] [:error] [pid 892:tid 918] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Wed Mar 25 19:11:02.859069 2026] [:error] [pid 892:tid 907] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Mar 25 19:11:03.180343 2026] [:error] [pid 892:tid 901] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/x1.php
[Wed Mar 25 19:11:03.424619 2026] [:error] [pid 892:tid 904] [client 158.158.96.10:60223] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Wed Mar 25 19:11:03.664702 2026] [:error] [pid 892:tid 896] [client 158.158.96.10:60223] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acPCxyT_G8WMU3T3yxrPJQAAAMI"]
[Wed Mar 25 19:11:04.461356 2026] [:error] [pid 25967:tid 25996] [client 158.158.96.10:45907] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acPCyPg8Qtq7ZM4mSFlPPwAAA1g"]
[Wed Mar 25 19:11:05.218580 2026] [:error] [pid 26321:tid 26360] [client 158.158.96.10:45942] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acPCyfKO65qqGZCSPZpCmgAAAhM"]
[Wed Mar 25 19:11:06.082828 2026] [:error] [pid 47989:tid 48010] [client 158.158.96.10:39398] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acPCyiWKdJMhIccROjnPNwAAAVM"]
[Wed Mar 25 19:11:07.162503 2026] [:error] [pid 26321:tid 26344] [client 158.158.96.10:48415] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "acPCy_KO65qqGZCSPZpCmwAAAgU"]
[Wed Mar 25 19:11:07.846960 2026] [:error] [pid 25967:tid 25993] [client 158.158.96.10:51264] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "acPCy_g8Qtq7ZM4mSFlPQwAAA1U"]
[Wed Mar 25 19:11:09.003514 2026] [:error] [pid 47989:tid 47994] [client 158.158.96.10:60182] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "acPCzSWKdJMhIccROjnPOgAAAUM"]
[Wed Mar 25 19:11:10.941112 2026] [:error] [pid 26449:tid 26462] [client 158.158.96.10:60176] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "acPCztpZ2T15NDqzAjF3VgAAAkk"]
[Wed Mar 25 19:11:12.876799 2026] [:error] [pid 25967:tid 25990] [client 158.158.96.10:39316] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "acPC0Pg8Qtq7ZM4mSFlPSQAAA1I"]
[Wed Mar 25 19:11:14.665744 2026] [:error] [pid 26449:tid 26464] [client 158.158.96.10:62582] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "acPC0tpZ2T15NDqzAjF3WQAAAks"]
[Wed Mar 25 19:11:17.242119 2026] [:error] [pid 47989:tid 48009] [client 158.158.96.10:51248] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "acPC1SWKdJMhIccROjnPTQAAAVI"]
[Wed Mar 25 19:11:17.965849 2026] [:error] [pid 47989:tid 47995] [client 158.158.96.10:34767] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "acPC1SWKdJMhIccROjnPUwAAAUQ"]
[Wed Mar 25 19:11:19.812646 2026] [:error] [pid 26321:tid 26354] [client 158.158.96.10:48425] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwq13.php"] [unique_id "acPC1_KO65qqGZCSPZpCpAAAAg0"]
[Wed Mar 25 19:11:20.953206 2026] [:error] [pid 25967:tid 25985] [client 158.158.96.10:60162] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwq13.php"] [unique_id "acPC2Pg8Qtq7ZM4mSFlPUQAAA00"]
[Wed Mar 25 19:11:21.994769 2026] [:error] [pid 47989:tid 48000] [client 158.158.96.10:34762] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwq13.php"] [unique_id "acPC2SWKdJMhIccROjnPXAAAAUk"]
[Wed Mar 25 19:11:22.733487 2026] [:error] [pid 26321:tid 26344] [client 158.158.96.10:51302] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwq13.php"] [unique_id "acPC2vKO65qqGZCSPZpCqAAAAgU"]
[Wed Mar 25 19:11:23.520252 2026] [:error] [pid 25967:tid 25984] [client 158.158.96.10:60690] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acPC2_g8Qtq7ZM4mSFlPWAAAA0w"]
[Wed Mar 25 19:11:24.466970 2026] [:error] [pid 25875:tid 25900] [client 158.158.96.10:51311] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acPC3BJ38QkS3NyfshzvDQAAApM"]
[Wed Mar 25 19:11:25.387679 2026] [:error] [pid 25967:tid 25985] [client 158.158.96.10:51315] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acPC3fg8Qtq7ZM4mSFlPXgAAA00"]
[Wed Mar 25 19:11:26.357449 2026] [:error] [pid 892:tid 910] [client 158.158.96.10:36658] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acPC3iT_G8WMU3T3yxrPJwAAAMw"]
[Wed Mar 25 19:11:27.090206 2026] [:error] [pid 26449:tid 26469] [client 158.158.96.10:39419] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sc.php"] [unique_id "acPC39pZ2T15NDqzAjF3WwAAAlA"]
[Wed Mar 25 19:11:27.691993 2026] [:error] [pid 892:tid 921] [client 158.158.96.10:51299] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sc.php"] [unique_id "acPC3yT_G8WMU3T3yxrPMAAAANY"]
[Wed Mar 25 19:11:28.420152 2026] [:error] [pid 25875:tid 25883] [client 158.158.96.10:47443] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sc.php"] [unique_id "acPC4BJ38QkS3NyfshzvFQAAAoI"]
[Wed Mar 25 19:11:29.192969 2026] [:error] [pid 25875:tid 25885] [client 158.158.96.10:48423] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sc.php"] [unique_id "acPC4RJ38QkS3NyfshzvHwAAAoQ"]
[Wed Mar 25 19:11:30.049111 2026] [:error] [pid 25967:tid 25983] [client 158.158.96.10:51321] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "acPC4vg8Qtq7ZM4mSFlPYgAAA0s"]
[Wed Mar 25 19:11:30.754086 2026] [:error] [pid 25967:tid 25989] [client 158.158.96.10:34769] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "acPC4vg8Qtq7ZM4mSFlPZQAAA1E"]
[Wed Mar 25 19:11:32.181407 2026] [:error] [pid 25967:tid 25993] [client 158.158.96.10:36648] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "acPC5Pg8Qtq7ZM4mSFlPaQAAA1U"]
[Wed Mar 25 19:11:32.803158 2026] [:error] [pid 892:tid 901] [client 158.158.96.10:47434] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "acPC5CT_G8WMU3T3yxrPQwAAAMQ"]
[Wed Mar 25 19:11:33.660036 2026] [:error] [pid 26321:tid 26354] [client 158.158.96.10:51241] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fyiiz.php"] [unique_id "acPC5fKO65qqGZCSPZpCugAAAg0"]
[Wed Mar 25 19:11:34.357875 2026] [:error] [pid 47989:tid 48002] [client 158.158.96.10:47430] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fyiiz.php"] [unique_id "acPC5iWKdJMhIccROjnPZgAAAUs"]
[Wed Mar 25 19:11:35.062581 2026] [:error] [pid 25967:tid 25975] [client 158.158.96.10:62530] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fyiiz.php"] [unique_id "acPC5_g8Qtq7ZM4mSFlPcQAAA0M"]
[Wed Mar 25 19:11:35.960591 2026] [:error] [pid 25967:tid 25986] [client 158.158.96.10:53133] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fyiiz.php"] [unique_id "acPC5_g8Qtq7ZM4mSFlPdQAAA04"]
[Wed Mar 25 19:11:37.127920 2026] [:error] [pid 26269:tid 26299] [client 158.158.96.10:61730] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "acPC6Un7e-ZQbaIs7qy4AAAAAZc"]
[Wed Mar 25 19:11:38.255293 2026] [:error] [pid 26449:tid 26455] [client 158.158.96.10:53141] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "acPC6tpZ2T15NDqzAjF3XQAAAkI"]
[Wed Mar 25 19:11:39.799958 2026] [:error] [pid 26321:tid 26346] [client 158.158.96.10:60213] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "acPC6_KO65qqGZCSPZpCvwAAAgY"]
[Wed Mar 25 19:11:40.980084 2026] [:error] [pid 26321:tid 26354] [client 158.158.96.10:47474] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "acPC7PKO65qqGZCSPZpCxAAAAg0"]
[Wed Mar 25 19:11:42.857186 2026] [:error] [pid 26321:tid 26361] [client 158.158.96.10:40455] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gk.php"] [unique_id "acPC7vKO65qqGZCSPZpCyAAAAhQ"]
[Wed Mar 25 19:11:43.520841 2026] [:error] [pid 26269:tid 26291] [client 158.158.96.10:60713] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gk.php"] [unique_id "acPC70n7e-ZQbaIs7qy4CgAAAY8"]
[Wed Mar 25 19:11:44.441836 2026] [:error] [pid 25875:tid 25890] [client 158.158.96.10:61710] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gk.php"] [unique_id "acPC8BJ38QkS3NyfshzvKwAAAok"]
[Wed Mar 25 19:11:45.262513 2026] [:error] [pid 26321:tid 26340] [client 158.158.96.10:51239] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gk.php"] [unique_id "acPC8fKO65qqGZCSPZpCzQAAAgE"]
[Wed Mar 25 19:11:45.981416 2026] [:error] [pid 47946:tid 47960] [client 158.158.96.10:51208] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shellerr.php"] [unique_id "acPC8TipQTqBMSeKYheCNQAAAQw"]
[Wed Mar 25 19:11:46.983328 2026] [:error] [pid 25875:tid 25902] [client 158.158.96.10:51261] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shellerr.php"] [unique_id "acPC8hJ38QkS3NyfshzvMgAAApU"]
[Wed Mar 25 19:11:48.309622 2026] [:error] [pid 25875:tid 25889] [client 158.158.96.10:62577] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shellerr.php"] [unique_id "acPC9BJ38QkS3NyfshzvOgAAAog"]
[Wed Mar 25 19:11:49.392978 2026] [:error] [pid 47989:tid 47998] [client 158.158.96.10:60735] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shellerr.php"] [unique_id "acPC9SWKdJMhIccROjnPbgAAAUc"]
[Wed Mar 25 19:11:49.986782 2026] [:error] [pid 47989:tid 48009] [client 158.158.96.10:34785] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acPC9SWKdJMhIccROjnPcwAAAVI"]
[Wed Mar 25 19:11:50.814697 2026] [:error] [pid 26321:tid 26354] [client 158.158.96.10:38738] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acPC9vKO65qqGZCSPZpCzgAAAg0"]
[Wed Mar 25 19:11:51.437888 2026] [:error] [pid 47989:tid 47996] [client 158.158.96.10:51293] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acPC9yWKdJMhIccROjnPeQAAAUU"]
[Wed Mar 25 19:11:52.617342 2026] [:error] [pid 47989:tid 48005] [client 158.158.96.10:45348] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acPC-CWKdJMhIccROjnPfgAAAU4"]
[Wed Mar 25 19:11:53.373039 2026] [:error] [pid 47989:tid 48007] [client 158.158.96.10:53160] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acPC-SWKdJMhIccROjnPgAAAAVA"]
[Wed Mar 25 19:11:53.993148 2026] [:error] [pid 26449:tid 26465] [client 158.158.96.10:62944] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acPC-dpZ2T15NDqzAjF3YwAAAkw"]
[Wed Mar 25 19:11:54.620372 2026] [:error] [pid 26449:tid 26460] [client 158.158.96.10:51233] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acPC-tpZ2T15NDqzAjF3ZAAAAkc"]
[Wed Mar 25 19:11:55.384972 2026] [:error] [pid 25967:tid 25983] [client 158.158.96.10:53132] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acPC-_g8Qtq7ZM4mSFlPkAAAA0s"]
[Wed Mar 25 19:11:56.095921 2026] [:error] [pid 756:tid 874] [client 158.158.96.10:38751] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/to.php"] [unique_id "acPC_DOaW6oylMIDBCQdmwAAAJY"]
[Wed Mar 25 19:11:56.590408 2026] [:error] [pid 47989:tid 48015] [client 158.158.96.10:61736] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/to.php"] [unique_id "acPC_CWKdJMhIccROjnPjAAAAVg"]
[Wed Mar 25 19:11:57.208854 2026] [:error] [pid 892:tid 896] [client 158.158.96.10:45897] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/to.php"] [unique_id "acPC_ST_G8WMU3T3yxrPRAAAAMI"]
[Wed Mar 25 19:11:57.824823 2026] [:error] [pid 892:tid 907] [client 158.158.96.10:36651] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/to.php"] [unique_id "acPC_ST_G8WMU3T3yxrPRgAAAMk"]
[Wed Mar 25 19:11:58.872034 2026] [:error] [pid 26449:tid 26477] [client 158.158.96.10:53158] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acPC_tpZ2T15NDqzAjF3ZgAAAlg"]
[Wed Mar 25 19:11:59.424516 2026] [:error] [pid 25875:tid 25881] [client 158.158.96.10:51243] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acPC_xJ38QkS3NyfshzvRQAAAoA"]
[Wed Mar 25 19:12:00.073082 2026] [:error] [pid 26269:tid 26295] [client 158.158.96.10:36654] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acPDAEn7e-ZQbaIs7qy4HAAAAZM"]
[Wed Mar 25 19:12:00.664657 2026] [:error] [pid 47989:tid 48013] [client 158.158.96.10:64290] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acPDACWKdJMhIccROjnPmwAAAVY"]
[Wed Mar 25 19:12:01.461312 2026] [:error] [pid 47989:tid 48007] [client 158.158.96.10:62583] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acPDASWKdJMhIccROjnPnQAAAVA"]
[Wed Mar 25 19:12:02.113033 2026] [:error] [pid 25875:tid 25882] [client 158.158.96.10:39306] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acPDAhJ38QkS3NyfshzvRwAAAoE"]
[Wed Mar 25 19:12:02.772600 2026] [:error] [pid 26269:tid 26291] [client 158.158.96.10:62578] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acPDAkn7e-ZQbaIs7qy4HwAAAY8"]
[Wed Mar 25 19:12:03.499879 2026] [:error] [pid 756:tid 857] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Wed Mar 25 19:12:03.743446 2026] [:error] [pid 756:tid 866] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/filesss.php
[Wed Mar 25 19:12:03.985950 2026] [:error] [pid 756:tid 870] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aaa.php
[Wed Mar 25 19:12:04.245499 2026] [:error] [pid 756:tid 858] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Wed Mar 25 19:12:04.487194 2026] [:error] [pid 756:tid 875] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Wed Mar 25 19:12:04.729926 2026] [:error] [pid 756:tid 867] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Wed Mar 25 19:12:04.975825 2026] [:error] [pid 756:tid 876] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/filer.php
[Wed Mar 25 19:12:05.249452 2026] [:error] [pid 756:tid 852] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/lites.php
[Wed Mar 25 19:12:05.491248 2026] [:error] [pid 756:tid 851] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/cord.php
[Wed Mar 25 19:12:05.735011 2026] [:error] [pid 756:tid 874] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/shlo.php
[Wed Mar 25 19:12:06.059844 2026] [:error] [pid 756:tid 869] [client 158.158.96.10:64281] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Wed Mar 25 19:12:06.299032 2026] [:error] [pid 756:tid 865] [client 158.158.96.10:64281] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we2.php"] [unique_id "acPDBjOaW6oylMIDBCQdrgAAAI0"]
[Wed Mar 25 19:12:07.927511 2026] [:error] [pid 47946:tid 47970] [client 158.158.96.10:5989] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we2.php"] [unique_id "acPDBzipQTqBMSeKYheCNgAAARY"]
[Wed Mar 25 19:12:09.164861 2026] [:error] [pid 25967:tid 25994] [client 158.158.96.10:60166] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we2.php"] [unique_id "acPDCfg8Qtq7ZM4mSFlPmwAAA1Y"]
[Wed Mar 25 19:12:10.299695 2026] [:error] [pid 26269:tid 26277] [client 158.158.96.10:60682] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we2.php"] [unique_id "acPDCkn7e-ZQbaIs7qy4KAAAAYE"]
[Wed Mar 25 19:12:11.344767 2026] [:error] [pid 47989:tid 47992] [client 158.158.96.10:62549] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/juuuu.php"] [unique_id "acPDCyWKdJMhIccROjnPqwAAAUE"]
[Wed Mar 25 19:12:12.146156 2026] [:error] [pid 25967:tid 25975] [client 158.158.96.10:5958] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/juuuu.php"] [unique_id "acPDDPg8Qtq7ZM4mSFlPoAAAA0M"]
[Wed Mar 25 19:12:12.836017 2026] [:error] [pid 25967:tid 25988] [client 158.158.96.10:62564] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/juuuu.php"] [unique_id "acPDDPg8Qtq7ZM4mSFlPogAAA1A"]
[Wed Mar 25 19:12:13.877783 2026] [:error] [pid 25967:tid 25989] [client 158.158.96.10:58447] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/juuuu.php"] [unique_id "acPDDfg8Qtq7ZM4mSFlPqgAAA1E"]
[Wed Mar 25 19:12:14.438574 2026] [:error] [pid 756:tid 871] [client 158.158.96.10:53170] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nox.php"] [unique_id "acPDDjOaW6oylMIDBCQdrwAAAJM"]
[Wed Mar 25 19:12:15.167905 2026] [:error] [pid 25875:tid 25887] [client 158.158.96.10:53135] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nox.php"] [unique_id "acPDDxJ38QkS3NyfshzvUgAAAoY"]
[Wed Mar 25 19:12:15.827982 2026] [:error] [pid 892:tid 905] [client 158.158.96.10:64305] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nox.php"] [unique_id "acPDDyT_G8WMU3T3yxrPTwAAAMc"]
[Wed Mar 25 19:12:16.459289 2026] [:error] [pid 47989:tid 48005] [client 158.158.96.10:36667] [client 158.158.96.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nox.php"] [unique_id "acPDECWKdJMhIccROjnPswAAAU4"]
[Thu Mar 26 02:19:10.999977 2026] [:error] [pid 55735:tid 55861] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Mar 26 02:19:11.285635 2026] [:error] [pid 55735:tid 55855] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Thu Mar 26 02:19:11.620050 2026] [:error] [pid 55735:tid 55859] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Thu Mar 26 02:19:11.974976 2026] [:error] [pid 55735:tid 55867] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Thu Mar 26 02:19:12.330482 2026] [:error] [pid 55735:tid 55855] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Mar 26 02:19:12.596288 2026] [:error] [pid 55735:tid 55880] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Thu Mar 26 02:19:12.868820 2026] [:error] [pid 55735:tid 55870] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Thu Mar 26 02:19:13.187054 2026] [:error] [pid 55735:tid 55856] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Mar 26 02:19:13.475197 2026] [:error] [pid 55735:tid 55858] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Thu Mar 26 02:19:13.738448 2026] [:error] [pid 55735:tid 55867] [client 20.251.41.44:27863] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Thu Mar 26 02:19:14.011878 2026] [:error] [pid 55735:tid 55877] [client 20.251.41.44:27863] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acQnIkhXsYCMQZKUd5O2UgAAARU"]
[Thu Mar 26 02:19:15.404738 2026] [:error] [pid 56131:tid 56148] [client 20.251.41.44:12878] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acQnI0g5t1V4ZYPCUhw5sQAAAAk"]
[Thu Mar 26 02:19:16.846278 2026] [:error] [pid 32829:tid 32839] [client 20.251.41.44:28290] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acQnJHFEeazI9mYaKsz3IwAAAEg"]
[Thu Mar 26 02:19:18.058126 2026] [:error] [pid 55734:tid 55850] [client 20.251.41.44:28330] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acQnJs_x4fL7PCmNzkCJxwAAANg"]
[Thu Mar 26 02:19:18.887340 2026] [:error] [pid 55734:tid 55829] [client 20.251.41.44:43307] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acQnJs_x4fL7PCmNzkCJyQAAAMM"]
[Thu Mar 26 02:19:20.074717 2026] [:error] [pid 56131:tid 56151] [client 20.251.41.44:24270] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acQnKEg5t1V4ZYPCUhw5tgAAAAw"]
[Thu Mar 26 02:19:21.127074 2026] [:error] [pid 56131:tid 56146] [client 20.251.41.44:47788] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acQnKUg5t1V4ZYPCUhw5uAAAAAc"]
[Thu Mar 26 02:19:22.077305 2026] [:error] [pid 56131:tid 56158] [client 20.251.41.44:41352] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acQnKkg5t1V4ZYPCUhw5uwAAABM"]
[Thu Mar 26 02:19:26.607091 2026] [:error] [pid 32829:tid 32849] [client 20.251.41.44:47540] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acQnLnFEeazI9mYaKsz3QAAAAFI"]
[Thu Mar 26 02:19:28.138598 2026] [:error] [pid 32829:tid 32831] [client 20.251.41.44:48979] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acQnMHFEeazI9mYaKsz3RgAAAEA"]
[Thu Mar 26 02:19:29.919925 2026] [:error] [pid 56131:tid 56145] [client 20.251.41.44:9888] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acQnMUg5t1V4ZYPCUhw5xQAAAAY"]
[Thu Mar 26 02:19:32.596857 2026] [:error] [pid 55734:tid 55850] [client 20.251.41.44:16255] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acQnNM_x4fL7PCmNzkCJ0wAAANg"]
[Thu Mar 26 02:19:33.743611 2026] [:error] [pid 55733:tid 55755] [client 20.251.41.44:5356] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "acQnNaMzUauzYCgMHcnn5QAAAIg"]
[Thu Mar 26 02:19:34.353852 2026] [:error] [pid 55735:tid 55855] [client 20.251.41.44:45537] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "acQnNkhXsYCMQZKUd5O2XAAAAQE"]
[Thu Mar 26 02:19:35.290976 2026] [:error] [pid 56131:tid 56144] [client 20.251.41.44:24266] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "acQnN0g5t1V4ZYPCUhw5ygAAAAU"]
[Thu Mar 26 02:19:36.131454 2026] [:error] [pid 56131:tid 56161] [client 20.251.41.44:58242] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "acQnOEg5t1V4ZYPCUhw5zAAAABY"]
[Thu Mar 26 02:19:37.339472 2026] [:error] [pid 56131:tid 56152] [client 20.251.41.44:5277] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acQnOUg5t1V4ZYPCUhw5zgAAAA0"]
[Thu Mar 26 02:19:38.886008 2026] [:error] [pid 55733:tid 55762] [client 20.251.41.44:45018] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acQnOqMzUauzYCgMHcnn7gAAAI8"]
[Thu Mar 26 02:19:40.306404 2026] [:error] [pid 55735:tid 55875] [client 20.251.41.44:45519] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acQnPEhXsYCMQZKUd5O2ZAAAARM"]
[Thu Mar 26 02:19:42.798024 2026] [:error] [pid 56131:tid 56162] [client 20.251.41.44:10208] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acQnPkg5t1V4ZYPCUhw51AAAABc"]
[Thu Mar 26 02:19:44.469708 2026] [:error] [pid 55735:tid 55854] [client 20.251.41.44:58918] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acQnQEhXsYCMQZKUd5O2ZQAAAQA"]
[Thu Mar 26 02:19:45.894511 2026] [:error] [pid 32829:tid 32832] [client 20.251.41.44:44126] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acQnQXFEeazI9mYaKsz3dQAAAEE"]
[Thu Mar 26 02:19:48.192370 2026] [:error] [pid 32829:tid 32848] [client 20.251.41.44:45029] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acQnRHFEeazI9mYaKsz3fwAAAFE"]
[Thu Mar 26 02:19:50.458894 2026] [:error] [pid 32829:tid 32854] [client 20.251.41.44:29328] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acQnRnFEeazI9mYaKsz3hQAAAFc"]
[Thu Mar 26 02:19:51.444223 2026] [:error] [pid 32829:tid 32838] [client 20.251.41.44:17432] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "acQnR3FEeazI9mYaKsz3jAAAAEc"]
[Thu Mar 26 02:19:52.622073 2026] [:error] [pid 32829:tid 32844] [client 20.251.41.44:8549] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "acQnSHFEeazI9mYaKsz3lgAAAE0"]
[Thu Mar 26 02:19:53.585088 2026] [:error] [pid 32829:tid 32853] [client 20.251.41.44:16918] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "acQnSXFEeazI9mYaKsz3mgAAAFY"]
[Thu Mar 26 02:19:55.048324 2026] [:error] [pid 32829:tid 32852] [client 20.251.41.44:27294] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "acQnS3FEeazI9mYaKsz3nwAAAFU"]
[Thu Mar 26 02:19:55.754994 2026] [:error] [pid 32829:tid 32847] [client 20.251.41.44:17442] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "acQnS3FEeazI9mYaKsz3pAAAAFA"]
[Thu Mar 26 02:19:56.921732 2026] [:error] [pid 55733:tid 55754] [client 20.251.41.44:44107] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "acQnTKMzUauzYCgMHcnoAAAAAIc"]
[Thu Mar 26 02:19:57.862406 2026] [:error] [pid 32829:tid 32852] [client 20.251.41.44:45051] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "acQnTXFEeazI9mYaKsz32wAAAFU"]
[Thu Mar 26 02:19:58.587974 2026] [:error] [pid 55735:tid 55865] [client 20.251.41.44:29352] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "acQnTkhXsYCMQZKUd5O2bQAAAQo"]
[Thu Mar 26 02:19:59.381114 2026] [:error] [pid 55733:tid 55749] [client 20.251.41.44:11795] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acQnT6MzUauzYCgMHcnoAQAAAIM"]
[Thu Mar 26 02:20:00.209036 2026] [:error] [pid 56131:tid 56147] [client 20.251.41.44:23836] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acQnUEg5t1V4ZYPCUhw55wAAAAg"]
[Thu Mar 26 02:20:00.993739 2026] [:error] [pid 55734:tid 55830] [client 20.251.41.44:27291] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acQnUM_x4fL7PCmNzkCJ1gAAAMQ"]
[Thu Mar 26 02:20:01.818072 2026] [:error] [pid 55733:tid 55750] [client 20.251.41.44:23851] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acQnUaMzUauzYCgMHcnoBwAAAIQ"]
[Thu Mar 26 02:20:03.697022 2026] [:error] [pid 32829:tid 32850] [client 20.251.41.44:16938] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acQnU3FEeazI9mYaKsz35AAAAFM"]
[Thu Mar 26 02:20:04.501694 2026] [:error] [pid 55733:tid 55761] [client 20.251.41.44:8469] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acQnVKMzUauzYCgMHcnoDQAAAI4"]
[Thu Mar 26 02:20:05.935329 2026] [:error] [pid 32829:tid 32842] [client 20.251.41.44:37471] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acQnVXFEeazI9mYaKsz36AAAAEs"]
[Thu Mar 26 02:20:09.214457 2026] [:error] [pid 55734:tid 55834] [client 20.251.41.44:17922] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acQnWc_x4fL7PCmNzkCJ3gAAAMg"]
[Thu Mar 26 02:20:11.735632 2026] [:error] [pid 55734:tid 55847] [client 20.251.41.44:57337] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acQnW8_x4fL7PCmNzkCJ5AAAANU"]
[Thu Mar 26 02:20:15.138446 2026] [:error] [pid 56131:tid 56140] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Mar 26 02:20:15.402222 2026] [:error] [pid 56131:tid 56160] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Mar 26 02:20:15.679373 2026] [:error] [pid 56131:tid 56139] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Mar 26 02:20:15.968434 2026] [:error] [pid 56131:tid 56149] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Thu Mar 26 02:20:16.233818 2026] [:error] [pid 56131:tid 56146] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu Mar 26 02:20:16.510428 2026] [:error] [pid 56131:tid 56163] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Thu Mar 26 02:20:16.810904 2026] [:error] [pid 56131:tid 56159] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Thu Mar 26 02:20:17.093493 2026] [:error] [pid 56131:tid 56158] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/ws83.php
[Thu Mar 26 02:20:17.562918 2026] [:error] [pid 56131:tid 56154] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Thu Mar 26 02:20:17.826136 2026] [:error] [pid 56131:tid 56141] [client 20.251.41.44:51930] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Thu Mar 26 02:20:18.106776 2026] [:error] [pid 56131:tid 56162] [client 20.251.41.44:51930] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "acQnYkg5t1V4ZYPCUhw6FAAAABc"]
[Thu Mar 26 02:20:19.430761 2026] [:error] [pid 32829:tid 32854] [client 20.251.41.44:17959] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "acQnY3FEeazI9mYaKsz39AAAAFc"]
[Thu Mar 26 02:20:21.365567 2026] [:error] [pid 55735:tid 55871] [client 20.251.41.44:13792] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "acQnZUhXsYCMQZKUd5O2ggAAAQ8"]
[Thu Mar 26 02:20:22.369311 2026] [:error] [pid 55735:tid 55876] [client 20.251.41.44:21384] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "acQnZkhXsYCMQZKUd5O2gwAAARQ"]
[Thu Mar 26 02:20:24.700783 2026] [:error] [pid 32829:tid 32850] [client 20.251.41.44:8455] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "acQnaHFEeazI9mYaKsz3-wAAAFM"]
[Thu Mar 26 02:20:25.455491 2026] [:error] [pid 55733:tid 55752] [client 20.251.41.44:20963] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "acQnaaMzUauzYCgMHcnoNAAAAIU"]
[Thu Mar 26 02:20:26.566323 2026] [:error] [pid 32829:tid 32831] [client 20.251.41.44:41412] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "acQnanFEeazI9mYaKsz3_gAAAEA"]
[Thu Mar 26 02:20:27.264878 2026] [:error] [pid 56131:tid 56158] [client 20.251.41.44:57326] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "acQna0g5t1V4ZYPCUhw6KQAAABM"]
[Thu Mar 26 02:20:28.156795 2026] [:error] [pid 32829:tid 32847] [client 20.251.41.44:8505] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bjfl.php"] [unique_id "acQnbHFEeazI9mYaKsz4AwAAAFA"]
[Thu Mar 26 02:20:29.539838 2026] [:error] [pid 55735:tid 55856] [client 20.251.41.44:41459] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bjfl.php"] [unique_id "acQnbUhXsYCMQZKUd5O2hwAAAQI"]
[Thu Mar 26 02:20:30.296873 2026] [:error] [pid 55734:tid 55847] [client 20.251.41.44:58711] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bjfl.php"] [unique_id "acQnbs_x4fL7PCmNzkCJ7gAAANU"]
[Thu Mar 26 02:20:32.168873 2026] [:error] [pid 55734:tid 55840] [client 20.251.41.44:5419] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bjfl.php"] [unique_id "acQncM_x4fL7PCmNzkCJ8wAAAM4"]
[Thu Mar 26 02:20:35.362179 2026] [:error] [pid 32829:tid 32851] [client 20.251.41.44:44980] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acQnc3FEeazI9mYaKsz4CgAAAFQ"]
[Thu Mar 26 02:20:40.657871 2026] [:error] [pid 32829:tid 32846] [client 20.251.41.44:20886] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acQneHFEeazI9mYaKsz4GwAAAE8"]
[Thu Mar 26 02:20:45.370064 2026] [:error] [pid 55733:tid 55749] [client 20.251.41.44:21458] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acQnfaMzUauzYCgMHcnoSQAAAIM"]
[Thu Mar 26 02:20:48.192859 2026] [:error] [pid 56131:tid 56158] [client 20.251.41.44:9191] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acQngEg5t1V4ZYPCUhw6RQAAABM"]
[Thu Mar 26 02:20:51.071199 2026] [:error] [pid 32829:tid 32850] [client 20.251.41.44:10168] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acQng3FEeazI9mYaKsz4MgAAAFM"]
[Thu Mar 26 02:20:52.464707 2026] [:error] [pid 32829:tid 32849] [client 20.251.41.44:30448] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acQnhHFEeazI9mYaKsz4NwAAAFI"]
[Thu Mar 26 02:20:53.569657 2026] [:error] [pid 55733:tid 55775] [client 20.251.41.44:39291] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acQnhaMzUauzYCgMHcnoVQAAAJg"]
[Thu Mar 26 02:20:56.171844 2026] [:error] [pid 32829:tid 32847] [client 20.251.41.44:24762] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acQniHFEeazI9mYaKsz4RQAAAFA"]
[Thu Mar 26 02:20:57.031096 2026] [:error] [pid 32829:tid 32836] [client 20.251.41.44:8630] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acQniXFEeazI9mYaKsz4SQAAAEU"]
[Thu Mar 26 02:20:58.345655 2026] [:error] [pid 55733:tid 55769] [client 20.251.41.44:24713] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acQniqMzUauzYCgMHcnoXQAAAJQ"]
[Thu Mar 26 02:20:59.684280 2026] [:error] [pid 56131:tid 56155] [client 20.251.41.44:29421] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acQni0g5t1V4ZYPCUhw6VQAAABA"]
[Thu Mar 26 02:21:00.701442 2026] [:error] [pid 55733:tid 55750] [client 20.251.41.44:10908] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acQnjKMzUauzYCgMHcnoXwAAAIQ"]
[Thu Mar 26 02:21:01.810949 2026] [:error] [pid 56131:tid 56160] [client 20.251.41.44:10524] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acQnjUg5t1V4ZYPCUhw6XAAAABU"]
[Thu Mar 26 02:21:02.802588 2026] [:error] [pid 56131:tid 56148] [client 20.251.41.44:34579] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acQnjkg5t1V4ZYPCUhw6YAAAAAk"]
[Thu Mar 26 02:21:03.833446 2026] [:error] [pid 55733:tid 55759] [client 20.251.41.44:23907] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acQnj6MzUauzYCgMHcnoYAAAAIw"]
[Thu Mar 26 02:21:04.437528 2026] [:error] [pid 32829:tid 32848] [client 20.251.41.44:22899] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acQnkHFEeazI9mYaKsz4WAAAAFE"]
[Thu Mar 26 02:21:05.339679 2026] [:error] [pid 32829:tid 32834] [client 20.251.41.44:8864] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acQnkXFEeazI9mYaKsz4WgAAAEM"]
[Thu Mar 26 02:21:07.101175 2026] [:error] [pid 55735:tid 55876] [client 20.251.41.44:22904] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acQnk0hXsYCMQZKUd5O2qAAAARQ"]
[Thu Mar 26 02:21:07.725985 2026] [:error] [pid 55735:tid 55874] [client 20.251.41.44:26815] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acQnk0hXsYCMQZKUd5O2qwAAARI"]
[Thu Mar 26 02:21:08.907038 2026] [:error] [pid 55734:tid 55835] [client 20.251.41.44:26788] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acQnlM_x4fL7PCmNzkCKCgAAAMk"]
[Thu Mar 26 02:21:11.181200 2026] [:error] [pid 55733:tid 55746] [client 20.251.41.44:23875] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acQnl6MzUauzYCgMHcnoaQAAAIA"]
[Thu Mar 26 02:21:11.806968 2026] [:error] [pid 55733:tid 55769] [client 20.251.41.44:22900] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acQnl6MzUauzYCgMHcnoawAAAJQ"]
[Thu Mar 26 02:21:12.671150 2026] [:error] [pid 32829:tid 32847] [client 20.251.41.44:8844] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acQnmHFEeazI9mYaKsz4XwAAAFA"]
[Thu Mar 26 02:21:13.560060 2026] [:error] [pid 56131:tid 56163] [client 20.251.41.44:22864] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "acQnmUg5t1V4ZYPCUhw6agAAABg"]
[Thu Mar 26 02:21:14.757975 2026] [:error] [pid 56131:tid 56162] [client 20.251.41.44:34591] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "acQnmkg5t1V4ZYPCUhw6bQAAABc"]
[Thu Mar 26 02:21:16.026566 2026] [:error] [pid 32829:tid 32843] [client 20.251.41.44:43765] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "acQnnHFEeazI9mYaKsz4ZwAAAEw"]
[Thu Mar 26 02:21:17.289643 2026] [:error] [pid 55734:tid 55841] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Thu Mar 26 02:21:17.556040 2026] [:error] [pid 55734:tid 55848] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Thu Mar 26 02:21:18.133994 2026] [:error] [pid 55734:tid 55832] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Thu Mar 26 02:21:18.398045 2026] [:error] [pid 55734:tid 55833] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Thu Mar 26 02:21:18.696382 2026] [:error] [pid 55734:tid 55838] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Thu Mar 26 02:21:18.967503 2026] [:error] [pid 55734:tid 55836] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Thu Mar 26 02:21:19.231060 2026] [:error] [pid 55734:tid 55830] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Thu Mar 26 02:21:19.496876 2026] [:error] [pid 55734:tid 55828] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Thu Mar 26 02:21:19.794063 2026] [:error] [pid 55734:tid 55844] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Mar 26 02:21:20.056841 2026] [:error] [pid 55734:tid 55839] [client 20.251.41.44:47588] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Thu Mar 26 02:21:20.361488 2026] [:error] [pid 55734:tid 55835] [client 20.251.41.44:47588] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acQnoM_x4fL7PCmNzkCKGwAAAMk"]
[Thu Mar 26 02:21:22.088816 2026] [:error] [pid 32829:tid 32849] [client 20.251.41.44:40010] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acQnonFEeazI9mYaKsz4aAAAAFI"]
[Thu Mar 26 02:21:25.095539 2026] [:error] [pid 55733:tid 55752] [client 20.251.41.44:8888] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acQnpaMzUauzYCgMHcnodwAAAIU"]
[Thu Mar 26 02:21:27.697181 2026] [:error] [pid 55733:tid 55748] [client 20.251.41.44:14819] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acQnp6MzUauzYCgMHcnogAAAAII"]
[Thu Mar 26 02:21:30.121120 2026] [:error] [pid 32829:tid 32834] [client 20.251.41.44:24270] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "acQnqnFEeazI9mYaKsz4cwAAAEM"]
[Thu Mar 26 02:21:31.023775 2026] [:error] [pid 32829:tid 32839] [client 20.251.41.44:5763] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "acQnq3FEeazI9mYaKsz4eAAAAEg"]
[Thu Mar 26 02:21:31.840776 2026] [:error] [pid 32829:tid 32855] [client 20.251.41.44:14820] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "acQnq3FEeazI9mYaKsz4ewAAAFg"]
[Thu Mar 26 02:21:33.605797 2026] [:error] [pid 32829:tid 32845] [client 20.251.41.44:31966] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "acQnrXFEeazI9mYaKsz4gAAAAE4"]
[Thu Mar 26 02:21:35.113244 2026] [:error] [pid 32829:tid 32841] [client 20.251.41.44:23331] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acQnr3FEeazI9mYaKsz4iAAAAEo"]
[Thu Mar 26 02:21:36.812360 2026] [:error] [pid 55734:tid 55828] [client 20.251.41.44:16143] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acQnsM_x4fL7PCmNzkCKJQAAAMI"]
[Thu Mar 26 02:21:37.477965 2026] [:error] [pid 55733:tid 55768] [client 20.251.41.44:46479] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acQnsaMzUauzYCgMHcnogwAAAJM"]
[Thu Mar 26 02:21:38.317864 2026] [:error] [pid 55734:tid 55835] [client 20.251.41.44:18844] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acQnss_x4fL7PCmNzkCKKAAAAMk"]
[Thu Mar 26 02:21:38.963771 2026] [:error] [pid 56131:tid 56150] [client 20.251.41.44:44041] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acQnskg5t1V4ZYPCUhw6owAAAAs"]
[Thu Mar 26 02:21:40.516711 2026] [:error] [pid 32829:tid 32847] [client 20.251.41.44:47580] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acQntHFEeazI9mYaKsz4lAAAAFA"]
[Thu Mar 26 02:21:41.683939 2026] [:error] [pid 32829:tid 32837] [client 20.251.41.44:18855] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acQntXFEeazI9mYaKsz4oQAAAEY"]
[Thu Mar 26 02:21:42.838641 2026] [:error] [pid 32829:tid 32854] [client 20.251.41.44:22397] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acQntnFEeazI9mYaKsz4rwAAAFc"]
[Thu Mar 26 02:21:44.424067 2026] [:error] [pid 56131:tid 56151] [client 20.251.41.44:30383] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "acQnuEg5t1V4ZYPCUhw6sQAAAAw"]
[Thu Mar 26 02:21:45.685676 2026] [:error] [pid 56131:tid 56155] [client 20.251.41.44:58060] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "acQnuUg5t1V4ZYPCUhw6tQAAABA"]
[Thu Mar 26 02:21:46.440717 2026] [:error] [pid 55733:tid 55752] [client 20.251.41.44:46526] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "acQnuqMzUauzYCgMHcnokAAAAIU"]
[Thu Mar 26 02:21:47.493804 2026] [:error] [pid 55735:tid 55858] [client 20.251.41.44:22361] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "acQnu0hXsYCMQZKUd5O20AAAAQM"]
[Thu Mar 26 02:21:48.925066 2026] [:error] [pid 32829:tid 32849] [client 20.251.41.44:5227] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "acQnvHFEeazI9mYaKsz4wAAAAFI"]
[Thu Mar 26 02:21:50.270729 2026] [:error] [pid 56131:tid 56146] [client 20.251.41.44:16151] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "acQnvkg5t1V4ZYPCUhw6vgAAAAc"]
[Thu Mar 26 02:21:51.053571 2026] [:error] [pid 56131:tid 56140] [client 20.251.41.44:30393] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "acQnv0g5t1V4ZYPCUhw6xAAAAAE"]
[Thu Mar 26 02:21:52.028332 2026] [:error] [pid 55733:tid 55766] [client 20.251.41.44:16183] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "acQnwKMzUauzYCgMHcnolgAAAJI"]
[Thu Mar 26 02:21:53.389628 2026] [:error] [pid 56131:tid 56142] [client 20.251.41.44:46504] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acQnwUg5t1V4ZYPCUhw6ygAAAAM"]
[Thu Mar 26 02:21:54.852039 2026] [:error] [pid 32829:tid 32851] [client 20.251.41.44:16188] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acQnwnFEeazI9mYaKsz4ygAAAFQ"]
[Thu Mar 26 02:22:00.621840 2026] [:error] [pid 56131:tid 56152] [client 20.251.41.44:5816] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acQnyEg5t1V4ZYPCUhw60wAAAA0"]
[Thu Mar 26 02:22:03.886046 2026] [:error] [pid 56131:tid 56150] [client 20.251.41.44:23357] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acQny0g5t1V4ZYPCUhw61wAAAAs"]
[Thu Mar 26 02:22:05.553879 2026] [:error] [pid 56131:tid 56147] [client 20.251.41.44:6112] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acQnzUg5t1V4ZYPCUhw62wAAAAg"]
[Thu Mar 26 02:22:06.213842 2026] [:error] [pid 56131:tid 56146] [client 20.251.41.44:44069] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acQnzkg5t1V4ZYPCUhw63wAAAAc"]
[Thu Mar 26 02:22:07.310916 2026] [:error] [pid 56131:tid 56155] [client 20.251.41.44:36910] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acQnz0g5t1V4ZYPCUhw64gAAABA"]
[Thu Mar 26 02:22:08.371256 2026] [:error] [pid 32829:tid 32852] [client 20.251.41.44:16189] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acQn0HFEeazI9mYaKsz44gAAAFU"]
[Thu Mar 26 02:22:09.405438 2026] [:error] [pid 55733:tid 55748] [client 20.251.41.44:5207] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acQn0aMzUauzYCgMHcnosAAAAII"]
[Thu Mar 26 02:22:10.601658 2026] [:error] [pid 32829:tid 32854] [client 20.251.41.44:30346] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acQn0nFEeazI9mYaKsz46wAAAFc"]
[Thu Mar 26 02:22:11.648912 2026] [:error] [pid 56131:tid 56146] [client 20.251.41.44:31995] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acQn00g5t1V4ZYPCUhw66gAAAAc"]
[Thu Mar 26 02:22:12.569842 2026] [:error] [pid 32829:tid 32833] [client 20.251.41.44:23356] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acQn1HFEeazI9mYaKsz48QAAAEI"]
[Thu Mar 26 02:22:13.258720 2026] [:error] [pid 56131:tid 56156] [client 20.251.41.44:36386] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acQn1Ug5t1V4ZYPCUhw67wAAABE"]
[Thu Mar 26 02:22:15.161409 2026] [:error] [pid 55733:tid 55749] [client 20.251.41.44:58063] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acQn16MzUauzYCgMHcnoswAAAIM"]
[Thu Mar 26 02:22:16.475703 2026] [:error] [pid 55735:tid 55860] [client 20.251.41.44:36378] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acQn2EhXsYCMQZKUd5O24QAAAQU"]
[Thu Mar 26 02:22:17.620905 2026] [:error] [pid 55735:tid 55858] [client 20.251.41.44:5211] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acQn2UhXsYCMQZKUd5O25gAAAQM"]
[Thu Mar 26 02:22:22.450877 2026] [:error] [pid 55735:tid 55880] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Thu Mar 26 02:22:22.749812 2026] [:error] [pid 55735:tid 55876] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Thu Mar 26 02:22:23.013968 2026] [:error] [pid 55735:tid 55879] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Thu Mar 26 02:22:23.381277 2026] [:error] [pid 55735:tid 55862] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/44.php
[Thu Mar 26 02:22:23.663483 2026] [:error] [pid 55735:tid 55873] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/ws49.php
[Thu Mar 26 02:22:24.133893 2026] [:error] [pid 55735:tid 55858] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/amp.php
[Thu Mar 26 02:22:24.398386 2026] [:error] [pid 55735:tid 55875] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Mar 26 02:22:24.665189 2026] [:error] [pid 55735:tid 55861] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Thu Mar 26 02:22:24.944170 2026] [:error] [pid 55735:tid 55854] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Thu Mar 26 02:22:25.208492 2026] [:error] [pid 55735:tid 55877] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Thu Mar 26 02:22:25.639039 2026] [:error] [pid 55735:tid 55867] [client 20.251.41.44:22355] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Thu Mar 26 02:22:25.900404 2026] [:error] [pid 55735:tid 55860] [client 20.251.41.44:22355] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acQn4UhXsYCMQZKUd5O3AAAAAQU"]
[Thu Mar 26 02:22:26.480329 2026] [:error] [pid 32829:tid 32846] [client 20.251.41.44:22299] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acQn4nFEeazI9mYaKsz5BwAAAE8"]
[Thu Mar 26 02:22:27.337277 2026] [:error] [pid 32829:tid 32848] [client 20.251.41.44:31945] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acQn43FEeazI9mYaKsz5CgAAAFE"]
[Thu Mar 26 02:22:28.042581 2026] [:error] [pid 55733:tid 55747] [client 20.251.41.44:16177] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acQn5KMzUauzYCgMHcnovgAAAIE"]
[Thu Mar 26 02:22:28.879120 2026] [:error] [pid 55733:tid 55769] [client 20.251.41.44:47000] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acQn5KMzUauzYCgMHcnowgAAAJQ"]
[Thu Mar 26 02:22:29.518557 2026] [:error] [pid 56131:tid 56149] [client 20.251.41.44:31972] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acQn5Ug5t1V4ZYPCUhw7EgAAAAo"]
[Thu Mar 26 02:22:30.778480 2026] [:error] [pid 55735:tid 55870] [client 20.251.41.44:30370] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acQn5khXsYCMQZKUd5O3AQAAAQ4"]
[Thu Mar 26 02:22:31.379260 2026] [:error] [pid 55735:tid 55865] [client 20.251.41.44:57690] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acQn50hXsYCMQZKUd5O3AwAAAQo"]
[Thu Mar 26 02:22:32.435310 2026] [:error] [pid 32829:tid 32845] [client 20.251.41.44:46471] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "acQn6HFEeazI9mYaKsz5FwAAAE4"]
[Thu Mar 26 02:22:33.190451 2026] [:error] [pid 32829:tid 32842] [client 20.251.41.44:47010] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "acQn6XFEeazI9mYaKsz5GwAAAEs"]
[Thu Mar 26 02:22:34.282391 2026] [:error] [pid 56131:tid 56158] [client 20.251.41.44:36412] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "acQn6kg5t1V4ZYPCUhw7GgAAABM"]
[Thu Mar 26 02:22:38.484473 2026] [:error] [pid 32829:tid 32834] [client 20.251.41.44:57700] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "acQn7nFEeazI9mYaKsz5KQAAAEM"]
[Thu Mar 26 02:22:46.716565 2026] [:error] [pid 32829:tid 32843] [client 20.251.41.44:22309] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acQn9nFEeazI9mYaKsz5QwAAAEw"]
[Thu Mar 26 02:22:51.201953 2026] [:error] [pid 56131:tid 56142] [client 20.251.41.44:23340] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "acQn-0g5t1V4ZYPCUhw7MAAAAAM"]
[Thu Mar 26 02:22:55.561349 2026] [:error] [pid 32829:tid 32833] [client 20.251.41.44:58064] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acQn_3FEeazI9mYaKsz5ZQAAAEI"]
[Thu Mar 26 02:22:57.687333 2026] [:error] [pid 32829:tid 32841] [client 20.251.41.44:57715] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acQoAXFEeazI9mYaKsz5agAAAEo"]
[Thu Mar 26 02:22:58.796602 2026] [:error] [pid 32829:tid 32855] [client 20.251.41.44:36912] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acQoAnFEeazI9mYaKsz5bQAAAFg"]
[Thu Mar 26 02:23:04.180035 2026] [:error] [pid 32829:tid 32839] [client 20.251.41.44:9717] [client 20.251.41.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acQoCHFEeazI9mYaKsz5dwAAAEg"]
[Thu Mar 26 21:02:13.732929 2026] [:error] [pid 31670:tid 31674] [client 4.206.17.96:42779] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Mar 26 21:02:14.150023 2026] [:error] [pid 31670:tid 31678] [client 4.206.17.96:42779] [client 4.206.17.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.206.17.96, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acUuVjXVthXxCnWjOTTIqgAAAUY"]
[Thu Mar 26 21:02:14.386730 2026] [:error] [pid 31670:tid 31683] [client 4.206.17.96:42779] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Thu Mar 26 21:02:15.225868 2026] [:error] [pid 31670:tid 31672] [client 4.206.17.96:42779] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Thu Mar 26 21:02:15.854762 2026] [:error] [pid 31670:tid 31688] [client 4.206.17.96:42779] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Mar 26 21:02:16.061088 2026] [:error] [pid 31670:tid 31692] [client 4.206.17.96:42779] [client 4.206.17.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acUuWDXVthXxCnWjOTTIswAAAVQ"]
[Thu Mar 26 21:02:16.886962 2026] [:error] [pid 60829:tid 60845] [client 4.206.17.96:42793] [client 4.206.17.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acUuWPTdjHKeZokybaTUHAAAAQ4"]
[Thu Mar 26 21:02:17.725477 2026] [:error] [pid 19712:tid 19797] [client 4.206.17.96:42206] [client 4.206.17.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acUuWdWhKhRNqm23vFMp0AAAAJU"]
[Thu Mar 26 21:02:18.575041 2026] [:error] [pid 19710:tid 19737] [client 4.206.17.96:42177] [client 4.206.17.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acUuWgVEWP8Ar68Njk4RNgAAAA8"]
[Fri Mar 27 07:33:15.922120 2026] [:error] [pid 27749:tid 27813] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Fri Mar 27 07:33:16.188202 2026] [:error] [pid 27749:tid 27799] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Mar 27 07:33:16.511079 2026] [:error] [pid 27749:tid 27809] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/lowpr.php
[Fri Mar 27 07:33:16.792076 2026] [:error] [pid 27749:tid 27792] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Fri Mar 27 07:33:17.056755 2026] [:error] [pid 27749:tid 27815] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Fri Mar 27 07:33:17.322179 2026] [:error] [pid 27749:tid 27793] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Fri Mar 27 07:33:17.654387 2026] [:error] [pid 27749:tid 27791] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/csv.php
[Fri Mar 27 07:33:17.951984 2026] [:error] [pid 27749:tid 27803] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/sale.php
[Fri Mar 27 07:33:18.251438 2026] [:error] [pid 27749:tid 27795] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/aa21.php
[Fri Mar 27 07:33:18.524947 2026] [:error] [pid 27749:tid 27814] [client 20.100.192.188:37708] File does not exist: /usr/local/apache/htdocs/suspended-page/ws73.php
[Fri Mar 27 07:33:18.827505 2026] [:error] [pid 27749:tid 27804] [client 20.100.192.188:37708] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bootstrap.php"] [unique_id "acXCPsEqyoMni2Q6_X5vggAAAE0"]
[Fri Mar 27 07:33:19.661286 2026] [:error] [pid 63897:tid 63913] [client 20.100.192.188:42645] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bootstrap.php"] [unique_id "acXCP2VSkmYmLu7ycYggqAAAAQ4"]
[Fri Mar 27 07:33:20.430322 2026] [:error] [pid 27743:tid 27786] [client 20.100.192.188:12999] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bootstrap.php"] [unique_id "acXCQCA46UYYLqzw99AMGgAAABY"]
[Fri Mar 27 07:33:21.160423 2026] [:error] [pid 27749:tid 27801] [client 20.100.192.188:42678] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bootstrap.php"] [unique_id "acXCQcEqyoMni2Q6_X5vhAAAAEo"]
[Fri Mar 27 07:33:21.738876 2026] [:error] [pid 27851:tid 27858] [client 20.100.192.188:19187] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acXCQXR2ccxe3RMCLborRAAAAMA"]
[Fri Mar 27 07:33:22.604094 2026] [:error] [pid 4293:tid 4301] [client 20.100.192.188:13052] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acXCQpLjeJUC3OKtEx-TKgAAAUY"]
[Fri Mar 27 07:33:23.151309 2026] [:error] [pid 4341:tid 4367] [client 20.100.192.188:13042] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acXCQ-KJWrNB5dMlEREwLgAAAZg"]
[Fri Mar 27 07:33:23.943488 2026] [:error] [pid 27851:tid 27876] [client 20.100.192.188:19165] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acXCQ3R2ccxe3RMCLborSAAAANI"]
[Fri Mar 27 07:33:25.034950 2026] [:error] [pid 4293:tid 4301] [client 20.100.192.188:12997] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "acXCRZLjeJUC3OKtEx-TNgAAAUY"]
[Fri Mar 27 07:33:25.611274 2026] [:error] [pid 4341:tid 4352] [client 20.100.192.188:42644] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "acXCReKJWrNB5dMlEREwMgAAAYk"]
[Fri Mar 27 07:33:26.409355 2026] [:error] [pid 27750:tid 27819] [client 20.100.192.188:42651] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "acXCRoaSil5rd17ieLxL_QAAAIE"]
[Fri Mar 27 07:33:26.972814 2026] [:error] [pid 4341:tid 4343] [client 20.100.192.188:19149] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "acXCRuKJWrNB5dMlEREwNAAAAYA"]
[Fri Mar 27 07:33:27.744719 2026] [:error] [pid 27749:tid 27815] [client 20.100.192.188:42641] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "acXCR8EqyoMni2Q6_X5vhQAAAFg"]
[Fri Mar 27 07:33:28.348087 2026] [:error] [pid 4293:tid 4304] [client 20.100.192.188:42642] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "acXCSJLjeJUC3OKtEx-TSwAAAUk"]
[Fri Mar 27 07:33:29.001938 2026] [:error] [pid 4341:tid 4358] [client 20.100.192.188:19198] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "acXCSeKJWrNB5dMlEREwNQAAAY8"]
[Fri Mar 27 07:33:29.689475 2026] [:error] [pid 27851:tid 27859] [client 20.100.192.188:19182] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "acXCSXR2ccxe3RMCLborSwAAAME"]
[Fri Mar 27 07:33:30.570564 2026] [:error] [pid 4293:tid 4314] [client 20.100.192.188:19146] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "acXCSpLjeJUC3OKtEx-TVgAAAVM"]
[Fri Mar 27 07:33:31.517449 2026] [:error] [pid 4293:tid 4312] [client 20.100.192.188:42652] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "acXCS5LjeJUC3OKtEx-TXQAAAVE"]
[Fri Mar 27 07:33:32.294507 2026] [:error] [pid 63897:tid 63921] [client 20.100.192.188:13047] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "acXCTGVSkmYmLu7ycYggtAAAARY"]
[Fri Mar 27 07:33:32.882058 2026] [:error] [pid 63897:tid 63923] [client 20.100.192.188:13013] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "acXCTGVSkmYmLu7ycYggtgAAARg"]
[Fri Mar 27 07:33:33.521271 2026] [:error] [pid 27851:tid 27858] [client 20.100.192.188:13016] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wxfyf.php"] [unique_id "acXCTXR2ccxe3RMCLborUwAAAMA"]
[Fri Mar 27 07:33:34.596926 2026] [:error] [pid 63897:tid 63919] [client 20.100.192.188:12998] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wxfyf.php"] [unique_id "acXCTmVSkmYmLu7ycYggvAAAARQ"]
[Fri Mar 27 07:33:35.238764 2026] [:error] [pid 63897:tid 63913] [client 20.100.192.188:19185] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wxfyf.php"] [unique_id "acXCT2VSkmYmLu7ycYggwAAAAQ4"]
[Fri Mar 27 07:33:36.185773 2026] [:error] [pid 63897:tid 63907] [client 20.100.192.188:42626] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wxfyf.php"] [unique_id "acXCUGVSkmYmLu7ycYggxwAAAQg"]
[Fri Mar 27 07:33:37.248359 2026] [:error] [pid 27851:tid 27882] [client 20.100.192.188:13024] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "acXCUXR2ccxe3RMCLborWgAAANg"]
[Fri Mar 27 07:33:37.915072 2026] [:error] [pid 4341:tid 4351] [client 20.100.192.188:13041] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "acXCUeKJWrNB5dMlEREwPwAAAYg"]
[Fri Mar 27 07:33:38.527691 2026] [:error] [pid 63897:tid 63908] [client 20.100.192.188:42664] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "acXCUmVSkmYmLu7ycYggzwAAAQk"]
[Fri Mar 27 07:33:39.142440 2026] [:error] [pid 4293:tid 4312] [client 20.100.192.188:37707] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "acXCU5LjeJUC3OKtEx-TfAAAAVE"]
[Fri Mar 27 07:33:40.816721 2026] [:error] [pid 27750:tid 27834] [client 20.100.192.188:19151] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gpt-sh.php"] [unique_id "acXCVIaSil5rd17ieLxMAgAAAJA"]
[Fri Mar 27 07:33:41.839448 2026] [:error] [pid 63897:tid 63903] [client 20.100.192.188:19190] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gpt-sh.php"] [unique_id "acXCVWVSkmYmLu7ycYgg0wAAAQQ"]
[Fri Mar 27 07:33:42.508034 2026] [:error] [pid 4293:tid 4310] [client 20.100.192.188:19173] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gpt-sh.php"] [unique_id "acXCVpLjeJUC3OKtEx-TmAAAAU8"]
[Fri Mar 27 07:33:43.148631 2026] [:error] [pid 4293:tid 4314] [client 20.100.192.188:37747] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gpt-sh.php"] [unique_id "acXCV5LjeJUC3OKtEx-TnQAAAVM"]
[Fri Mar 27 07:33:43.744252 2026] [:error] [pid 63897:tid 63909] [client 20.100.192.188:19171] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ne2026.php"] [unique_id "acXCV2VSkmYmLu7ycYgg1wAAAQo"]
[Fri Mar 27 07:33:44.501806 2026] [:error] [pid 4341:tid 4357] [client 20.100.192.188:42683] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ne2026.php"] [unique_id "acXCWOKJWrNB5dMlEREwSgAAAY4"]
[Fri Mar 27 07:33:45.339314 2026] [:error] [pid 27851:tid 27875] [client 20.100.192.188:12996] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ne2026.php"] [unique_id "acXCWXR2ccxe3RMCLborZAAAANE"]
[Fri Mar 27 07:33:46.709220 2026] [:error] [pid 4293:tid 4302] [client 20.100.192.188:37719] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ne2026.php"] [unique_id "acXCWpLjeJUC3OKtEx-TswAAAUc"]
[Fri Mar 27 07:33:47.711440 2026] [:error] [pid 27750:tid 27833] [client 20.100.192.188:19164] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2ksm17n.php"] [unique_id "acXCW4aSil5rd17ieLxMBQAAAI8"]
[Fri Mar 27 07:33:48.239279 2026] [:error] [pid 63897:tid 63916] [client 20.100.192.188:13025] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2ksm17n.php"] [unique_id "acXCXGVSkmYmLu7ycYgg2wAAARE"]
[Fri Mar 27 07:33:49.592491 2026] [:error] [pid 27851:tid 27862] [client 20.100.192.188:42656] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2ksm17n.php"] [unique_id "acXCXXR2ccxe3RMCLborZwAAAMQ"]
[Fri Mar 27 07:33:50.156948 2026] [:error] [pid 4293:tid 4300] [client 20.100.192.188:42666] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2ksm17n.php"] [unique_id "acXCXpLjeJUC3OKtEx-TzAAAAUU"]
[Fri Mar 27 07:33:51.013491 2026] [:error] [pid 63897:tid 63909] [client 20.100.192.188:13027] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "acXCX2VSkmYmLu7ycYgg3gAAAQo"]
[Fri Mar 27 07:33:51.880531 2026] [:error] [pid 4341:tid 4346] [client 20.100.192.188:13029] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "acXCX-KJWrNB5dMlEREwUwAAAYM"]
[Fri Mar 27 07:33:52.479671 2026] [:error] [pid 27851:tid 27874] [client 20.100.192.188:42677] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "acXCYHR2ccxe3RMCLboragAAANA"]
[Fri Mar 27 07:33:53.135404 2026] [:error] [pid 4293:tid 4310] [client 20.100.192.188:42676] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "acXCYZLjeJUC3OKtEx-T3AAAAU8"]
[Fri Mar 27 07:33:53.883004 2026] [:error] [pid 63897:tid 63916] [client 20.100.192.188:64981] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "acXCYWVSkmYmLu7ycYgg5gAAARE"]
[Fri Mar 27 07:33:54.411751 2026] [:error] [pid 4341:tid 4350] [client 20.100.192.188:13031] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "acXCYuKJWrNB5dMlEREwWAAAAYc"]
[Fri Mar 27 07:33:55.122853 2026] [:error] [pid 27749:tid 27803] [client 20.100.192.188:42682] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "acXCY8EqyoMni2Q6_X5vkwAAAEw"]
[Fri Mar 27 07:33:55.803379 2026] [:error] [pid 27750:tid 27830] [client 20.100.192.188:37699] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "acXCY4aSil5rd17ieLxMBwAAAIw"]
[Fri Mar 27 07:33:56.381126 2026] [:error] [pid 4293:tid 4296] [client 20.100.192.188:37729] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acXCZJLjeJUC3OKtEx-T5wAAAUE"]
[Fri Mar 27 07:33:56.977523 2026] [:error] [pid 27851:tid 27877] [client 20.100.192.188:19169] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acXCZHR2ccxe3RMCLborawAAANM"]
[Fri Mar 27 07:33:58.114934 2026] [:error] [pid 63897:tid 63921] [client 20.100.192.188:19153] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acXCZmVSkmYmLu7ycYgg6AAAARY"]
[Fri Mar 27 07:33:58.847130 2026] [:error] [pid 27750:tid 27820] [client 20.100.192.188:42635] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acXCZoaSil5rd17ieLxMFwAAAII"]
[Fri Mar 27 07:33:59.615183 2026] [:error] [pid 27851:tid 27872] [client 20.100.192.188:12994] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "acXCZ3R2ccxe3RMCLborbQAAAM4"]
[Fri Mar 27 07:34:00.171746 2026] [:error] [pid 27851:tid 27863] [client 20.100.192.188:19193] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "acXCaHR2ccxe3RMCLborbgAAAMU"]
[Fri Mar 27 07:34:01.088112 2026] [:error] [pid 27750:tid 27823] [client 20.100.192.188:64965] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "acXCaYaSil5rd17ieLxMGgAAAIU"]
[Fri Mar 27 07:34:01.679952 2026] [:error] [pid 27750:tid 27835] [client 20.100.192.188:42657] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "acXCaYaSil5rd17ieLxMHAAAAJE"]
[Fri Mar 27 07:34:02.471577 2026] [:error] [pid 4341:tid 4345] [client 20.100.192.188:42633] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "acXCauKJWrNB5dMlEREwZgAAAYI"]
[Fri Mar 27 07:34:03.281948 2026] [:error] [pid 4341:tid 4360] [client 20.100.192.188:42631] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "acXCa-KJWrNB5dMlEREwaQAAAZE"]
[Fri Mar 27 07:34:04.063304 2026] [:error] [pid 4293:tid 4311] [client 20.100.192.188:19142] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "acXCbJLjeJUC3OKtEx-T8wAAAVA"]
[Fri Mar 27 07:34:04.880185 2026] [:error] [pid 27750:tid 27841] [client 20.100.192.188:19189] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "acXCbIaSil5rd17ieLxMHwAAAJc"]
[Fri Mar 27 07:34:05.650950 2026] [:error] [pid 4293:tid 4312] [client 20.100.192.188:64962] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "acXCbZLjeJUC3OKtEx-T-gAAAVE"]
[Fri Mar 27 07:34:06.408116 2026] [:error] [pid 63897:tid 63902] [client 20.100.192.188:13006] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "acXCbmVSkmYmLu7ycYgg9wAAAQM"]
[Fri Mar 27 07:34:07.251596 2026] [:error] [pid 27750:tid 27825] [client 20.100.192.188:13038] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "acXCb4aSil5rd17ieLxMIwAAAIc"]
[Fri Mar 27 07:34:08.231424 2026] [:error] [pid 4293:tid 4300] [client 20.100.192.188:42624] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "acXCcJLjeJUC3OKtEx-UAAAAAUU"]
[Fri Mar 27 07:34:09.356615 2026] [:error] [pid 4293:tid 4314] [client 20.100.192.188:37715] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acXCcZLjeJUC3OKtEx-UCgAAAVM"]
[Fri Mar 27 07:34:10.112521 2026] [:error] [pid 4293:tid 4304] [client 20.100.192.188:42675] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acXCcpLjeJUC3OKtEx-UCwAAAUk"]
[Fri Mar 27 07:34:10.830716 2026] [:error] [pid 63897:tid 63909] [client 20.100.192.188:19147] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acXCcmVSkmYmLu7ycYghAwAAAQo"]
[Fri Mar 27 07:34:11.500666 2026] [:error] [pid 4341:tid 4355] [client 20.100.192.188:37718] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acXCc-KJWrNB5dMlEREwcwAAAYw"]
[Fri Mar 27 07:34:12.046867 2026] [:error] [pid 63897:tid 63919] [client 20.100.192.188:19152] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "acXCdGVSkmYmLu7ycYghCAAAARQ"]
[Fri Mar 27 07:34:12.869899 2026] [:error] [pid 4293:tid 4299] [client 20.100.192.188:42671] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "acXCdJLjeJUC3OKtEx-UEAAAAUQ"]
[Fri Mar 27 07:34:13.764449 2026] [:error] [pid 4293:tid 4311] [client 20.100.192.188:12992] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "acXCdZLjeJUC3OKtEx-UFQAAAVA"]
[Fri Mar 27 07:34:14.914029 2026] [:error] [pid 27851:tid 27877] [client 20.100.192.188:19170] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "acXCdnR2ccxe3RMCLbordgAAANM"]
[Fri Mar 27 07:34:15.473731 2026] [:error] [pid 4293:tid 4295] [client 20.100.192.188:13020] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acXCd5LjeJUC3OKtEx-UIQAAAUA"]
[Fri Mar 27 07:34:16.218552 2026] [:error] [pid 4341:tid 4360] [client 20.100.192.188:13023] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acXCeOKJWrNB5dMlEREwfQAAAZE"]
[Fri Mar 27 07:34:16.869645 2026] [:error] [pid 27750:tid 27840] [client 20.100.192.188:42685] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acXCeIaSil5rd17ieLxMKQAAAJY"]
[Fri Mar 27 07:34:17.683095 2026] [:error] [pid 4293:tid 4308] [client 20.100.192.188:42634] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acXCeZLjeJUC3OKtEx-UJgAAAU0"]
[Fri Mar 27 07:34:18.517884 2026] [:error] [pid 4293:tid 4304] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Fri Mar 27 07:34:18.818802 2026] [:error] [pid 4293:tid 4309] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/buc.php
[Fri Mar 27 07:34:19.085898 2026] [:error] [pid 4293:tid 4311] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Fri Mar 27 07:34:19.389049 2026] [:error] [pid 4293:tid 4313] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Fri Mar 27 07:34:19.678496 2026] [:error] [pid 4293:tid 4319] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Mar 27 07:34:19.980656 2026] [:error] [pid 4293:tid 4305] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/xfun.php
[Fri Mar 27 07:34:20.247050 2026] [:error] [pid 4293:tid 4315] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Fri Mar 27 07:34:20.579495 2026] [:error] [pid 4293:tid 4316] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Fri Mar 27 07:34:20.848134 2026] [:error] [pid 4293:tid 4301] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Fri Mar 27 07:34:21.238508 2026] [:error] [pid 4293:tid 4300] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Fri Mar 27 07:34:21.555071 2026] [:error] [pid 4293:tid 4303] [client 20.100.192.188:37709] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Fri Mar 27 07:34:21.818855 2026] [:error] [pid 4293:tid 4295] [client 20.100.192.188:37709] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "acXCfZLjeJUC3OKtEx-UOwAAAUA"]
[Fri Mar 27 07:34:22.423030 2026] [:error] [pid 63897:tid 63900] [client 20.100.192.188:65498] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "acXCfmVSkmYmLu7ycYghNAAAAQE"]
[Fri Mar 27 07:34:23.178469 2026] [:error] [pid 4293:tid 4312] [client 20.100.192.188:13035] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "acXCf5LjeJUC3OKtEx-UQgAAAVE"]
[Fri Mar 27 07:34:23.974422 2026] [:error] [pid 4293:tid 4310] [client 20.100.192.188:37727] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "acXCf5LjeJUC3OKtEx-USAAAAU8"]
[Fri Mar 27 07:34:24.691886 2026] [:error] [pid 63897:tid 63923] [client 20.100.192.188:37704] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s.php"] [unique_id "acXCgGVSkmYmLu7ycYghOwAAARg"]
[Fri Mar 27 07:34:25.350777 2026] [:error] [pid 27750:tid 27825] [client 20.100.192.188:19145] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s.php"] [unique_id "acXCgYaSil5rd17ieLxMMwAAAIc"]
[Fri Mar 27 07:34:26.384646 2026] [:error] [pid 63897:tid 63901] [client 20.100.192.188:37717] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s.php"] [unique_id "acXCgmVSkmYmLu7ycYghPwAAAQI"]
[Fri Mar 27 07:34:26.968045 2026] [:error] [pid 27851:tid 27877] [client 20.100.192.188:19174] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s.php"] [unique_id "acXCgnR2ccxe3RMCLboriAAAANM"]
[Fri Mar 27 07:34:27.722832 2026] [:error] [pid 4293:tid 4305] [client 20.100.192.188:42636] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "acXCg5LjeJUC3OKtEx-UVQAAAUo"]
[Fri Mar 27 07:34:28.658868 2026] [:error] [pid 27749:tid 27794] [client 20.100.192.188:37700] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "acXChMEqyoMni2Q6_X5vpAAAAEM"]
[Fri Mar 27 07:34:29.615369 2026] [:error] [pid 4293:tid 4303] [client 20.100.192.188:13040] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "acXChZLjeJUC3OKtEx-UXgAAAUg"]
[Fri Mar 27 07:34:30.238074 2026] [:error] [pid 63897:tid 63920] [client 20.100.192.188:37757] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "acXChmVSkmYmLu7ycYghRwAAARU"]
[Fri Mar 27 07:34:31.018732 2026] [:error] [pid 27851:tid 27863] [client 20.100.192.188:37733] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "acXCh3R2ccxe3RMCLboriwAAAMU"]
[Fri Mar 27 07:34:31.670656 2026] [:error] [pid 27750:tid 27838] [client 20.100.192.188:65008] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "acXCh4aSil5rd17ieLxMOAAAAJQ"]
[Fri Mar 27 07:34:32.520438 2026] [:error] [pid 4341:tid 4344] [client 20.100.192.188:13005] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "acXCiOKJWrNB5dMlEREwnQAAAYE"]
[Fri Mar 27 07:34:33.124470 2026] [:error] [pid 63897:tid 63907] [client 20.100.192.188:42684] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "acXCiWVSkmYmLu7ycYghSwAAAQg"]
[Fri Mar 27 07:34:33.920194 2026] [:error] [pid 4341:tid 4351] [client 20.100.192.188:42648] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws75.php"] [unique_id "acXCieKJWrNB5dMlEREwnwAAAYg"]
[Fri Mar 27 07:34:34.622920 2026] [:error] [pid 27749:tid 27791] [client 20.100.192.188:13007] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws75.php"] [unique_id "acXCisEqyoMni2Q6_X5vrgAAAEA"]
[Fri Mar 27 07:34:35.198801 2026] [:error] [pid 4341:tid 4343] [client 20.100.192.188:13014] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws75.php"] [unique_id "acXCi-KJWrNB5dMlEREwogAAAYA"]
[Fri Mar 27 07:34:35.989770 2026] [:error] [pid 4293:tid 4313] [client 20.100.192.188:19181] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws75.php"] [unique_id "acXCi5LjeJUC3OKtEx-UcAAAAVI"]
[Fri Mar 27 07:34:36.804885 2026] [:error] [pid 27750:tid 27823] [client 20.100.192.188:13000] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "acXCjIaSil5rd17ieLxMPgAAAIU"]
[Fri Mar 27 07:34:37.555500 2026] [:error] [pid 4341:tid 4350] [client 20.100.192.188:42655] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "acXCjeKJWrNB5dMlEREwqgAAAYc"]
[Fri Mar 27 07:34:38.166668 2026] [:error] [pid 4293:tid 4297] [client 20.100.192.188:37703] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "acXCjpLjeJUC3OKtEx-UdgAAAUI"]
[Fri Mar 27 07:34:39.101657 2026] [:error] [pid 4293:tid 4301] [client 20.100.192.188:13022] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "acXCj5LjeJUC3OKtEx-UeAAAAUY"]
[Fri Mar 27 07:34:49.727040 2026] [:error] [pid 4293:tid 4305] [client 20.100.192.188:13053] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "acXCmZLjeJUC3OKtEx-UlwAAAUo"]
[Fri Mar 27 07:35:03.708332 2026] [:error] [pid 4341:tid 4344] [client 20.100.192.188:64969] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acXCp-KJWrNB5dMlEREw-wAAAYE"]
[Fri Mar 27 07:35:04.697940 2026] [:error] [pid 4341:tid 4346] [client 20.100.192.188:19195] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acXCqOKJWrNB5dMlERExAAAAAYM"]
[Fri Mar 27 07:35:05.904187 2026] [:error] [pid 27851:tid 27874] [client 20.100.192.188:42625] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acXCqXR2ccxe3RMCLbor2AAAANA"]
[Fri Mar 27 07:35:07.225210 2026] [:error] [pid 63897:tid 63902] [client 20.100.192.188:13017] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acXCq2VSkmYmLu7ycYghigAAAQM"]
[Fri Mar 27 07:35:08.296408 2026] [:error] [pid 63897:tid 63913] [client 20.100.192.188:65501] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acXCrGVSkmYmLu7ycYghjwAAAQ4"]
[Fri Mar 27 07:35:09.324321 2026] [:error] [pid 63897:tid 63911] [client 20.100.192.188:19192] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acXCrWVSkmYmLu7ycYghkAAAAQw"]
[Fri Mar 27 07:35:10.039092 2026] [:error] [pid 27851:tid 27863] [client 20.100.192.188:37738] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acXCrnR2ccxe3RMCLbor6AAAAMU"]
[Fri Mar 27 07:35:11.827309 2026] [:error] [pid 27750:tid 27821] [client 20.100.192.188:19175] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acXCr4aSil5rd17ieLxMZAAAAIM"]
[Fri Mar 27 07:35:13.133425 2026] [:error] [pid 4293:tid 4306] [client 20.100.192.188:42632] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acXCsZLjeJUC3OKtEx-U_gAAAUs"]
[Fri Mar 27 07:35:13.755388 2026] [:error] [pid 63897:tid 63920] [client 20.100.192.188:19188] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acXCsWVSkmYmLu7ycYghtwAAARU"]
[Fri Mar 27 07:35:14.390913 2026] [:error] [pid 4293:tid 4319] [client 20.100.192.188:42679] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acXCspLjeJUC3OKtEx-VAAAAAVg"]
[Fri Mar 27 07:35:14.965543 2026] [:error] [pid 4293:tid 4304] [client 20.100.192.188:37758] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acXCspLjeJUC3OKtEx-VAQAAAUk"]
[Fri Mar 27 07:35:15.840861 2026] [:error] [pid 27851:tid 27875] [client 20.100.192.188:42661] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acXCs3R2ccxe3RMCLbor7QAAANE"]
[Fri Mar 27 07:35:20.352958 2026] [:error] [pid 4293:tid 4303] [client 20.100.192.188:42680] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acXCuJLjeJUC3OKtEx-VGwAAAUg"]
[Fri Mar 27 07:35:20.966552 2026] [:error] [pid 63897:tid 63908] [client 20.100.192.188:42647] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acXCuGVSkmYmLu7ycYgh0QAAAQk"]
[Fri Mar 27 07:35:22.315157 2026] [:error] [pid 4341:tid 4352] [client 20.100.192.188:37743] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Fri Mar 27 07:35:22.630422 2026] [:error] [pid 4341:tid 4354] [client 20.100.192.188:37743] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Fri Mar 27 07:35:23.028924 2026] [:error] [pid 4341:tid 4348] [client 20.100.192.188:37743] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Fri Mar 27 07:35:23.301152 2026] [:error] [pid 4341:tid 4363] [client 20.100.192.188:37743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Fri Mar 27 07:35:23.968387 2026] [:error] [pid 4341:tid 4361] [client 20.100.192.188:37743] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Mar 27 07:35:24.618639 2026] [:error] [pid 4341:tid 4349] [client 20.100.192.188:37743] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Mar 27 07:35:24.890060 2026] [:error] [pid 4341:tid 4365] [client 20.100.192.188:37743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Mar 27 07:35:25.466530 2026] [:error] [pid 4341:tid 4366] [client 20.100.192.188:37743] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Mar 27 07:35:25.853804 2026] [:error] [pid 4341:tid 4359] [client 20.100.192.188:37743] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amp.php"] [unique_id "acXCveKJWrNB5dMlERExIgAAAZA"]
[Fri Mar 27 07:35:26.904066 2026] [:error] [pid 4293:tid 4318] [client 20.100.192.188:19166] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amp.php"] [unique_id "acXCvpLjeJUC3OKtEx-VKwAAAVc"]
[Fri Mar 27 07:35:27.517494 2026] [:error] [pid 63897:tid 63910] [client 20.100.192.188:19141] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amp.php"] [unique_id "acXCv2VSkmYmLu7ycYgh6QAAAQs"]
[Fri Mar 27 07:35:28.434853 2026] [:error] [pid 63897:tid 63903] [client 20.100.192.188:42637] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amp.php"] [unique_id "acXCwGVSkmYmLu7ycYgh7QAAAQQ"]
[Fri Mar 27 07:35:30.650763 2026] [:error] [pid 4293:tid 4297] [client 20.100.192.188:42629] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "acXCwpLjeJUC3OKtEx-VMwAAAUI"]
[Fri Mar 27 07:35:31.566371 2026] [:error] [pid 4293:tid 4317] [client 20.100.192.188:37701] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "acXCw5LjeJUC3OKtEx-VOAAAAVY"]
[Fri Mar 27 07:35:32.091530 2026] [:error] [pid 27750:tid 27830] [client 20.100.192.188:19179] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "acXCxIaSil5rd17ieLxMdAAAAIw"]
[Fri Mar 27 07:35:32.709253 2026] [:error] [pid 4341:tid 4346] [client 20.100.192.188:42628] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "acXCxOKJWrNB5dMlERExKwAAAYM"]
[Fri Mar 27 07:35:33.383011 2026] [:error] [pid 4293:tid 4299] [client 20.100.192.188:37723] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acXCxZLjeJUC3OKtEx-VPwAAAUQ"]
[Fri Mar 27 07:35:34.001293 2026] [:error] [pid 4341:tid 4358] [client 20.100.192.188:37705] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acXCxeKJWrNB5dMlERExLgAAAY8"]
[Fri Mar 27 07:35:34.646421 2026] [:error] [pid 4341:tid 4364] [client 20.100.192.188:42681] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acXCxuKJWrNB5dMlERExMgAAAZU"]
[Fri Mar 27 07:35:35.472128 2026] [:error] [pid 27750:tid 27826] [client 20.100.192.188:37698] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acXCx4aSil5rd17ieLxMewAAAIg"]
[Fri Mar 27 07:35:36.137770 2026] [:error] [pid 27750:tid 27834] [client 20.100.192.188:42681] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acXCyIaSil5rd17ieLxMfgAAAJA"]
[Fri Mar 27 07:35:36.848761 2026] [:error] [pid 4293:tid 4315] [client 20.100.192.188:64976] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acXCyJLjeJUC3OKtEx-VRQAAAVQ"]
[Fri Mar 27 07:35:37.470569 2026] [:error] [pid 27851:tid 27878] [client 20.100.192.188:13049] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acXCyXR2ccxe3RMCLbor_QAAANQ"]
[Fri Mar 27 07:35:38.202945 2026] [:error] [pid 4341:tid 4359] [client 20.100.192.188:13026] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acXCyuKJWrNB5dMlERExNwAAAZA"]
[Fri Mar 27 07:35:38.757839 2026] [:error] [pid 4293:tid 4310] [client 20.100.192.188:65485] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acXCypLjeJUC3OKtEx-VUAAAAU8"]
[Fri Mar 27 07:35:39.488963 2026] [:error] [pid 4293:tid 4307] [client 20.100.192.188:42667] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acXCy5LjeJUC3OKtEx-VUwAAAUw"]
[Fri Mar 27 07:35:40.047788 2026] [:error] [pid 4341:tid 4348] [client 20.100.192.188:13004] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acXCzOKJWrNB5dMlERExOgAAAYU"]
[Fri Mar 27 07:35:40.766968 2026] [:error] [pid 4293:tid 4304] [client 20.100.192.188:19139] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "acXCzJLjeJUC3OKtEx-VWAAAAUk"]
[Fri Mar 27 07:35:41.878842 2026] [:error] [pid 27749:tid 27801] [client 20.100.192.188:64970] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "acXCzcEqyoMni2Q6_X5v1QAAAEo"]
[Fri Mar 27 07:35:42.711163 2026] [:error] [pid 63897:tid 63902] [client 20.100.192.188:13043] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "acXCzmVSkmYmLu7ycYgiCAAAAQM"]
[Fri Mar 27 07:35:43.433170 2026] [:error] [pid 4341:tid 4359] [client 20.100.192.188:19144] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "acXCz-KJWrNB5dMlERExQgAAAZA"]
[Fri Mar 27 07:35:44.056827 2026] [:error] [pid 63897:tid 63921] [client 20.100.192.188:37710] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "acXC0GVSkmYmLu7ycYgiEgAAARY"]
[Fri Mar 27 07:35:44.673085 2026] [:error] [pid 27851:tid 27877] [client 20.100.192.188:64979] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "acXC0HR2ccxe3RMCLbosAgAAANM"]
[Fri Mar 27 07:35:45.311889 2026] [:error] [pid 4341:tid 4358] [client 20.100.192.188:13050] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "acXC0eKJWrNB5dMlERExRQAAAY8"]
[Fri Mar 27 07:35:45.879100 2026] [:error] [pid 4293:tid 4298] [client 20.100.192.188:65524] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "acXC0ZLjeJUC3OKtEx-VZgAAAUM"]
[Fri Mar 27 07:35:46.731587 2026] [:error] [pid 27851:tid 27858] [client 20.100.192.188:65009] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "acXC0nR2ccxe3RMCLbosBQAAAMA"]
[Fri Mar 27 07:35:47.425971 2026] [:error] [pid 27851:tid 27863] [client 20.100.192.188:64975] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acXC03R2ccxe3RMCLbosBwAAAMU"]
[Fri Mar 27 07:35:48.042256 2026] [:error] [pid 27743:tid 27773] [client 20.100.192.188:42643] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acXC1CA46UYYLqzw99AMxwAAAAk"]
[Fri Mar 27 07:35:48.642934 2026] [:error] [pid 27851:tid 27859] [client 20.100.192.188:13012] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acXC1HR2ccxe3RMCLbosCgAAAME"]
[Fri Mar 27 07:35:49.477659 2026] [:error] [pid 27743:tid 27777] [client 20.100.192.188:65483] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "acXC1SA46UYYLqzw99AMygAAAA0"]
[Fri Mar 27 07:35:50.396426 2026] [:error] [pid 27750:tid 27836] [client 20.100.192.188:42687] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "acXC1oaSil5rd17ieLxMjgAAAJI"]
[Fri Mar 27 07:35:52.891981 2026] [:error] [pid 4293:tid 4305] [client 20.100.192.188:19161] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "acXC2JLjeJUC3OKtEx-VdQAAAUo"]
[Fri Mar 27 07:35:54.863669 2026] [:error] [pid 27749:tid 27807] [client 20.100.192.188:37724] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "acXC2sEqyoMni2Q6_X5v4gAAAFA"]
[Fri Mar 27 07:35:55.731812 2026] [:error] [pid 27851:tid 27880] [client 20.100.192.188:42627] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "acXC23R2ccxe3RMCLbosGwAAANY"]
[Fri Mar 27 07:35:57.785622 2026] [:error] [pid 27750:tid 27821] [client 20.100.192.188:64971] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acXC3YaSil5rd17ieLxMmAAAAIM"]
[Fri Mar 27 07:35:58.870912 2026] [:error] [pid 27750:tid 27842] [client 20.100.192.188:37730] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acXC3oaSil5rd17ieLxMmgAAAJg"]
[Fri Mar 27 07:35:59.850181 2026] [:error] [pid 63897:tid 63907] [client 20.100.192.188:65018] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acXC32VSkmYmLu7ycYgiIQAAAQg"]
[Fri Mar 27 07:36:00.886060 2026] [:error] [pid 27750:tid 27835] [client 20.100.192.188:19180] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "acXC4IaSil5rd17ieLxMnAAAAJE"]
[Fri Mar 27 07:36:01.633210 2026] [:error] [pid 4341:tid 4345] [client 20.100.192.188:37696] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acXC4eKJWrNB5dMlERExZQAAAYI"]
[Fri Mar 27 07:36:02.305740 2026] [:error] [pid 4293:tid 4312] [client 20.100.192.188:19138] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acXC4pLjeJUC3OKtEx-VewAAAVE"]
[Fri Mar 27 07:36:03.045612 2026] [:error] [pid 63897:tid 63900] [client 20.100.192.188:64991] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acXC42VSkmYmLu7ycYgiKAAAAQE"]
[Fri Mar 27 07:36:03.728713 2026] [:error] [pid 63897:tid 63912] [client 20.100.192.188:13008] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acXC42VSkmYmLu7ycYgiKwAAAQ0"]
[Fri Mar 27 07:36:04.571325 2026] [:error] [pid 63897:tid 63899] [client 20.100.192.188:37753] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acXC5GVSkmYmLu7ycYgiLgAAAQA"]
[Fri Mar 27 07:36:08.634696 2026] [:error] [pid 27750:tid 27831] [client 20.100.192.188:65431] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acXC6IaSil5rd17ieLxMogAAAI0"]
[Fri Mar 27 07:36:10.426130 2026] [:error] [pid 4293:tid 4302] [client 20.100.192.188:65481] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acXC6pLjeJUC3OKtEx-VjQAAAUc"]
[Fri Mar 27 07:36:11.571324 2026] [:error] [pid 63897:tid 63908] [client 20.100.192.188:37720] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acXC62VSkmYmLu7ycYgiQwAAAQk"]
[Fri Mar 27 07:36:12.647200 2026] [:error] [pid 27749:tid 27796] [client 20.100.192.188:64967] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acXC7MEqyoMni2Q6_X5v8gAAAEU"]
[Fri Mar 27 07:36:13.593939 2026] [:error] [pid 27749:tid 27806] [client 20.100.192.188:13003] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acXC7cEqyoMni2Q6_X5v9QAAAE8"]
[Fri Mar 27 07:36:14.932839 2026] [:error] [pid 4293:tid 4302] [client 20.100.192.188:19156] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acXC7pLjeJUC3OKtEx-VlgAAAUc"]
[Fri Mar 27 07:36:16.708662 2026] [:error] [pid 4293:tid 4314] [client 20.100.192.188:65495] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "acXC8JLjeJUC3OKtEx-VmAAAAVM"]
[Fri Mar 27 07:36:18.975036 2026] [:error] [pid 27749:tid 27813] [client 20.100.192.188:42640] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acXC8sEqyoMni2Q6_X5wAgAAAFY"]
[Fri Mar 27 07:36:19.873393 2026] [:error] [pid 27749:tid 27804] [client 20.100.192.188:42658] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acXC88EqyoMni2Q6_X5wBAAAAE0"]
[Fri Mar 27 07:36:21.006801 2026] [:error] [pid 4341:tid 4350] [client 20.100.192.188:37744] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acXC9eKJWrNB5dMlERExcgAAAYc"]
[Fri Mar 27 07:36:21.958112 2026] [:error] [pid 27851:tid 27875] [client 20.100.192.188:65490] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "acXC9XR2ccxe3RMCLbosNgAAANE"]
[Fri Mar 27 07:36:23.027515 2026] [:error] [pid 4293:tid 4310] [client 20.100.192.188:65497] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ajax.php"] [unique_id "acXC95LjeJUC3OKtEx-VpAAAAU8"]
[Fri Mar 27 07:36:23.927320 2026] [:error] [pid 63897:tid 63923] [client 20.100.192.188:64996] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ajax.php"] [unique_id "acXC92VSkmYmLu7ycYgiVgAAARg"]
[Fri Mar 27 07:36:24.905580 2026] [:error] [pid 4293:tid 4295] [client 20.100.192.188:64993] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ajax.php"] [unique_id "acXC-JLjeJUC3OKtEx-VqAAAAUA"]
[Fri Mar 27 07:36:25.837673 2026] [:error] [pid 4293:tid 4299] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax.php
[Fri Mar 27 07:36:26.111084 2026] [:error] [pid 4293:tid 4296] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Mar 27 07:36:26.667041 2026] [:error] [pid 4293:tid 4316] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Fri Mar 27 07:36:27.087699 2026] [:error] [pid 4293:tid 4298] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Fri Mar 27 07:36:27.352728 2026] [:error] [pid 4293:tid 4303] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/drhunthq.php
[Fri Mar 27 07:36:27.621140 2026] [:error] [pid 4293:tid 4311] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Fri Mar 27 07:36:27.913611 2026] [:error] [pid 4293:tid 4317] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Fri Mar 27 07:36:28.281638 2026] [:error] [pid 4293:tid 4314] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Fri Mar 27 07:36:28.584014 2026] [:error] [pid 4293:tid 4299] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Fri Mar 27 07:36:28.863708 2026] [:error] [pid 4293:tid 4315] [client 20.100.192.188:19143] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Fri Mar 27 07:36:29.210283 2026] [:error] [pid 4293:tid 4300] [client 20.100.192.188:19143] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acXC_ZLjeJUC3OKtEx-VwgAAAUU"]
[Fri Mar 27 07:36:30.315408 2026] [:error] [pid 63897:tid 63906] [client 20.100.192.188:65013] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acXC_mVSkmYmLu7ycYgiXwAAAQc"]
[Fri Mar 27 07:36:31.312434 2026] [:error] [pid 4341:tid 4354] [client 20.100.192.188:65416] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acXC_-KJWrNB5dMlERExhAAAAYs"]
[Fri Mar 27 07:36:32.600635 2026] [:error] [pid 63897:tid 63903] [client 20.100.192.188:65480] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acXDAGVSkmYmLu7ycYgiYwAAAQQ"]
[Fri Mar 27 07:36:33.336467 2026] [:error] [pid 27750:tid 27824] [client 20.100.192.188:64997] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acXDAYaSil5rd17ieLxMsAAAAIY"]
[Fri Mar 27 07:36:34.108846 2026] [:error] [pid 63897:tid 63902] [client 20.100.192.188:37714] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acXDAmVSkmYmLu7ycYgiZQAAAQM"]
[Fri Mar 27 07:36:34.761139 2026] [:error] [pid 4293:tid 4310] [client 20.100.192.188:42662] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acXDApLjeJUC3OKtEx-VwwAAAU8"]
[Fri Mar 27 07:36:35.506795 2026] [:error] [pid 27750:tid 27821] [client 20.100.192.188:13019] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acXDA4aSil5rd17ieLxMtQAAAIM"]
[Fri Mar 27 07:36:36.165902 2026] [:error] [pid 63897:tid 63909] [client 20.100.192.188:13033] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "acXDBGVSkmYmLu7ycYgiagAAAQo"]
[Fri Mar 27 07:36:36.812734 2026] [:error] [pid 4293:tid 4314] [client 20.100.192.188:37712] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "acXDBJLjeJUC3OKtEx-VygAAAVM"]
[Fri Mar 27 07:36:37.421396 2026] [:error] [pid 27750:tid 27826] [client 20.100.192.188:37728] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "acXDBYaSil5rd17ieLxMwwAAAIg"]
[Fri Mar 27 07:36:37.998943 2026] [:error] [pid 63897:tid 63904] [client 20.100.192.188:19197] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "acXDBWVSkmYmLu7ycYgibwAAAQU"]
[Fri Mar 27 07:36:38.606203 2026] [:error] [pid 4341:tid 4359] [client 20.100.192.188:42663] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "acXDBuKJWrNB5dMlERExlQAAAZA"]
[Fri Mar 27 07:36:39.332288 2026] [:error] [pid 63897:tid 63910] [client 20.100.192.188:64984] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "acXDB2VSkmYmLu7ycYgieQAAAQs"]
[Fri Mar 27 07:36:40.084909 2026] [:error] [pid 27749:tid 27806] [client 20.100.192.188:13051] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "acXDCMEqyoMni2Q6_X5wEQAAAE8"]
[Fri Mar 27 07:36:41.161547 2026] [:error] [pid 4293:tid 4301] [client 20.100.192.188:13011] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "acXDCZLjeJUC3OKtEx-V1wAAAUY"]
[Fri Mar 27 07:36:42.557607 2026] [:error] [pid 4293:tid 4303] [client 20.100.192.188:19168] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/155.php"] [unique_id "acXDCpLjeJUC3OKtEx-V2wAAAUg"]
[Fri Mar 27 07:36:43.621117 2026] [:error] [pid 27743:tid 27783] [client 20.100.192.188:65094] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/155.php"] [unique_id "acXDCyA46UYYLqzw99AM-gAAABM"]
[Fri Mar 27 07:36:44.394323 2026] [:error] [pid 27851:tid 27874] [client 20.100.192.188:42650] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/155.php"] [unique_id "acXDDHR2ccxe3RMCLbosRQAAANA"]
[Fri Mar 27 07:36:45.158876 2026] [:error] [pid 63897:tid 63909] [client 20.100.192.188:13054] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/155.php"] [unique_id "acXDDWVSkmYmLu7ycYgiiwAAAQo"]
[Fri Mar 27 07:36:46.006368 2026] [:error] [pid 4293:tid 4295] [client 20.100.192.188:37756] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acXDDpLjeJUC3OKtEx-V4gAAAUA"]
[Fri Mar 27 07:36:48.091681 2026] [:error] [pid 27749:tid 27807] [client 20.100.192.188:37746] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acXDEMEqyoMni2Q6_X5wGgAAAFA"]
[Fri Mar 27 07:36:52.870390 2026] [:error] [pid 27750:tid 27842] [client 20.100.192.188:19199] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acXDFIaSil5rd17ieLxM0gAAAJg"]
[Fri Mar 27 07:36:53.543425 2026] [:error] [pid 27750:tid 27830] [client 20.100.192.188:65450] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acXDFYaSil5rd17ieLxM1AAAAIw"]
[Fri Mar 27 07:36:54.295532 2026] [:error] [pid 4293:tid 4309] [client 20.100.192.188:65006] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "acXDFpLjeJUC3OKtEx-V_AAAAU4"]
[Fri Mar 27 07:36:55.873301 2026] [:error] [pid 63897:tid 63921] [client 20.100.192.188:65450] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "acXDF2VSkmYmLu7ycYgimAAAARY"]
[Fri Mar 27 07:36:56.610866 2026] [:error] [pid 4341:tid 4343] [client 20.100.192.188:37731] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "acXDGOKJWrNB5dMlERExoQAAAYA"]
[Fri Mar 27 07:36:57.470025 2026] [:error] [pid 4341:tid 4366] [client 20.100.192.188:19159] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "acXDGeKJWrNB5dMlERExpgAAAZc"]
[Fri Mar 27 07:36:58.149226 2026] [:error] [pid 4341:tid 4346] [client 20.100.192.188:13010] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "acXDGuKJWrNB5dMlERExqwAAAYM"]
[Fri Mar 27 07:36:58.800048 2026] [:error] [pid 27743:tid 27765] [client 20.100.192.188:65461] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "acXDGiA46UYYLqzw99ANBwAAAAE"]
[Fri Mar 27 07:36:59.479170 2026] [:error] [pid 4341:tid 4357] [client 20.100.192.188:13001] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "acXDG-KJWrNB5dMlERExrwAAAY4"]
[Fri Mar 27 07:37:00.174777 2026] [:error] [pid 63897:tid 63899] [client 20.100.192.188:64963] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "acXDHGVSkmYmLu7ycYginAAAAQA"]
[Fri Mar 27 07:37:01.624887 2026] [:error] [pid 63897:tid 63902] [client 20.100.192.188:65489] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hots.php"] [unique_id "acXDHWVSkmYmLu7ycYgiogAAAQM"]
[Fri Mar 27 07:37:02.195528 2026] [:error] [pid 27749:tid 27811] [client 20.100.192.188:65418] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hots.php"] [unique_id "acXDHsEqyoMni2Q6_X5wKgAAAFQ"]
[Fri Mar 27 07:37:02.722468 2026] [:error] [pid 4341:tid 4361] [client 20.100.192.188:42669] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hots.php"] [unique_id "acXDHuKJWrNB5dMlERExtQAAAZI"]
[Fri Mar 27 07:37:03.311838 2026] [:error] [pid 27743:tid 27788] [client 20.100.192.188:65510] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hots.php"] [unique_id "acXDHyA46UYYLqzw99ANCwAAABg"]
[Fri Mar 27 07:37:04.063093 2026] [:error] [pid 4341:tid 4343] [client 20.100.192.188:19196] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acXDIOKJWrNB5dMlERExwAAAAYA"]
[Fri Mar 27 07:37:04.835209 2026] [:error] [pid 63897:tid 63912] [client 20.100.192.188:37754] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acXDIGVSkmYmLu7ycYgisAAAAQ0"]
[Fri Mar 27 07:37:05.615047 2026] [:error] [pid 63897:tid 63917] [client 20.100.192.188:13018] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acXDIWVSkmYmLu7ycYgisQAAARI"]
[Fri Mar 27 07:37:06.346619 2026] [:error] [pid 4293:tid 4311] [client 20.100.192.188:19160] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acXDIpLjeJUC3OKtEx-WCAAAAVA"]
[Fri Mar 27 07:37:06.976421 2026] [:error] [pid 4293:tid 4301] [client 20.100.192.188:12993] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acXDIpLjeJUC3OKtEx-WCgAAAUY"]
[Fri Mar 27 07:37:07.611007 2026] [:error] [pid 27851:tid 27874] [client 20.100.192.188:37737] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acXDI3R2ccxe3RMCLbosVgAAANA"]
[Fri Mar 27 07:37:08.177940 2026] [:error] [pid 4293:tid 4313] [client 20.100.192.188:65464] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acXDJJLjeJUC3OKtEx-WDQAAAVI"]
[Fri Mar 27 07:37:08.788749 2026] [:error] [pid 4293:tid 4312] [client 20.100.192.188:37750] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acXDJJLjeJUC3OKtEx-WEAAAAVE"]
[Fri Mar 27 07:37:09.412650 2026] [:error] [pid 27851:tid 27866] [client 20.100.192.188:19140] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acXDJXR2ccxe3RMCLbosWQAAAMg"]
[Fri Mar 27 07:37:09.982651 2026] [:error] [pid 63897:tid 63908] [client 20.100.192.188:42658] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acXDJWVSkmYmLu7ycYgiuAAAAQk"]
[Fri Mar 27 07:37:10.728898 2026] [:error] [pid 4341:tid 4347] [client 20.100.192.188:13032] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acXDJuKJWrNB5dMlERExyAAAAYQ"]
[Fri Mar 27 07:37:11.294770 2026] [:error] [pid 27851:tid 27858] [client 20.100.192.188:19193] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acXDJ3R2ccxe3RMCLbosXAAAAMA"]
[Fri Mar 27 07:37:11.826284 2026] [:error] [pid 63897:tid 63911] [client 20.100.192.188:64985] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acXDJ2VSkmYmLu7ycYgiwgAAAQw"]
[Fri Mar 27 07:37:12.664694 2026] [:error] [pid 4293:tid 4296] [client 20.100.192.188:65020] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acXDKJLjeJUC3OKtEx-WGgAAAUE"]
[Fri Mar 27 07:37:13.528188 2026] [:error] [pid 4341:tid 4356] [client 20.100.192.188:37749] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acXDKeKJWrNB5dMlERExzAAAAY0"]
[Fri Mar 27 07:37:14.291740 2026] [:error] [pid 27851:tid 27881] [client 20.100.192.188:65441] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "acXDKnR2ccxe3RMCLbosYAAAANc"]
[Fri Mar 27 07:37:15.076395 2026] [:error] [pid 4293:tid 4316] [client 20.100.192.188:64988] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acXDK5LjeJUC3OKtEx-WHgAAAVU"]
[Fri Mar 27 07:37:15.828508 2026] [:error] [pid 27750:tid 27842] [client 20.100.192.188:37716] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acXDK4aSil5rd17ieLxM5AAAAJg"]
[Fri Mar 27 07:37:16.764420 2026] [:error] [pid 27750:tid 27837] [client 20.100.192.188:64999] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acXDLIaSil5rd17ieLxM5QAAAJM"]
[Fri Mar 27 07:37:18.210155 2026] [:error] [pid 27750:tid 27831] [client 20.100.192.188:65465] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acXDLoaSil5rd17ieLxM6wAAAI0"]
[Fri Mar 27 07:37:19.717376 2026] [:error] [pid 63897:tid 63915] [client 20.100.192.188:19177] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acXDL2VSkmYmLu7ycYgi0AAAARA"]
[Fri Mar 27 07:37:20.521038 2026] [:error] [pid 27749:tid 27796] [client 20.100.192.188:65435] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acXDMMEqyoMni2Q6_X5wOwAAAEU"]
[Fri Mar 27 07:37:21.619398 2026] [:error] [pid 27743:tid 27787] [client 20.100.192.188:37697] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acXDMSA46UYYLqzw99ANFwAAABc"]
[Fri Mar 27 07:37:22.794763 2026] [:error] [pid 27743:tid 27767] [client 20.100.192.188:13039] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "acXDMiA46UYYLqzw99ANHgAAAAM"]
[Fri Mar 27 07:37:23.768584 2026] [:error] [pid 27750:tid 27830] [client 20.100.192.188:42668] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acXDM4aSil5rd17ieLxM7wAAAIw"]
[Fri Mar 27 07:37:25.364801 2026] [:error] [pid 63897:tid 63921] [client 20.100.192.188:42630] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acXDNWVSkmYmLu7ycYgi3wAAARY"]
[Fri Mar 27 07:37:26.656064 2026] [:error] [pid 4293:tid 4310] [client 20.100.192.188:65475] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "acXDNpLjeJUC3OKtEx-WJAAAAU8"]
[Fri Mar 27 07:37:28.024935 2026] [:error] [pid 27750:tid 27820] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Fri Mar 27 07:37:28.293772 2026] [:error] [pid 27750:tid 27823] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/ws77.php
[Fri Mar 27 07:37:28.594361 2026] [:error] [pid 27750:tid 27840] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Fri Mar 27 07:37:28.863434 2026] [:error] [pid 27750:tid 27837] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Fri Mar 27 07:37:29.135604 2026] [:error] [pid 27750:tid 27832] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Fri Mar 27 07:37:29.469619 2026] [:error] [pid 27750:tid 27818] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Mar 27 07:37:29.793679 2026] [:error] [pid 27750:tid 27831] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Fri Mar 27 07:37:30.061422 2026] [:error] [pid 27750:tid 27836] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Fri Mar 27 07:37:30.333678 2026] [:error] [pid 27750:tid 27838] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Fri Mar 27 07:37:30.600959 2026] [:error] [pid 27750:tid 27840] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Fri Mar 27 07:37:30.918682 2026] [:error] [pid 27750:tid 27822] [client 20.100.192.188:37702] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Fri Mar 27 07:37:31.184332 2026] [:error] [pid 27750:tid 27834] [client 20.100.192.188:37702] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zc-104.php"] [unique_id "acXDO4aSil5rd17ieLxNCwAAAJA"]
[Fri Mar 27 07:37:32.022135 2026] [:error] [pid 4341:tid 4354] [client 20.100.192.188:37752] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zc-104.php"] [unique_id "acXDPOKJWrNB5dMlEREx2AAAAYs"]
[Fri Mar 27 07:37:32.734780 2026] [:error] [pid 4293:tid 4296] [client 20.100.192.188:64973] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zc-104.php"] [unique_id "acXDPJLjeJUC3OKtEx-WKwAAAUE"]
[Fri Mar 27 07:37:33.696187 2026] [:error] [pid 63897:tid 63921] [client 20.100.192.188:65492] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zc-104.php"] [unique_id "acXDPWVSkmYmLu7ycYgi6gAAARY"]
[Fri Mar 27 07:37:34.229540 2026] [:error] [pid 4293:tid 4312] [client 20.100.192.188:42660] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rzki.php"] [unique_id "acXDPpLjeJUC3OKtEx-WLgAAAVE"]
[Fri Mar 27 07:37:34.761035 2026] [:error] [pid 4293:tid 4309] [client 20.100.192.188:65515] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rzki.php"] [unique_id "acXDPpLjeJUC3OKtEx-WLwAAAU4"]
[Fri Mar 27 07:37:35.462853 2026] [:error] [pid 4293:tid 4305] [client 20.100.192.188:65518] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rzki.php"] [unique_id "acXDP5LjeJUC3OKtEx-WMwAAAUo"]
[Fri Mar 27 07:37:36.151129 2026] [:error] [pid 63897:tid 63916] [client 20.100.192.188:42665] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rzki.php"] [unique_id "acXDQGVSkmYmLu7ycYgi7gAAARE"]
[Fri Mar 27 07:37:37.937388 2026] [:error] [pid 4293:tid 4299] [client 20.100.192.188:64961] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "acXDQZLjeJUC3OKtEx-WPAAAAUQ"]
[Fri Mar 27 07:37:40.057444 2026] [:error] [pid 4341:tid 4358] [client 20.100.192.188:13016] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "acXDROKJWrNB5dMlEREx4gAAAY8"]
[Fri Mar 27 07:37:41.077028 2026] [:error] [pid 4341:tid 4364] [client 20.100.192.188:65459] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "acXDReKJWrNB5dMlEREx6QAAAZU"]
[Fri Mar 27 07:37:41.715307 2026] [:error] [pid 63897:tid 63918] [client 20.100.192.188:19137] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "acXDRWVSkmYmLu7ycYgi9gAAARM"]
[Fri Mar 27 07:37:43.547981 2026] [:error] [pid 4341:tid 4345] [client 20.100.192.188:19154] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d12.php"] [unique_id "acXDR-KJWrNB5dMlEREx7gAAAYI"]
[Fri Mar 27 07:37:46.082562 2026] [:error] [pid 4293:tid 4306] [client 20.100.192.188:65011] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d12.php"] [unique_id "acXDSpLjeJUC3OKtEx-WTwAAAUs"]
[Fri Mar 27 07:37:48.130440 2026] [:error] [pid 63897:tid 63921] [client 20.100.192.188:42651] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d12.php"] [unique_id "acXDTGVSkmYmLu7ycYgjBQAAARY"]
[Fri Mar 27 07:37:49.662980 2026] [:error] [pid 27743:tid 27777] [client 20.100.192.188:13015] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d12.php"] [unique_id "acXDTSA46UYYLqzw99ANMAAAAA0"]
[Fri Mar 27 07:37:50.377089 2026] [:error] [pid 27749:tid 27804] [client 20.100.192.188:65519] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "acXDTsEqyoMni2Q6_X5wTAAAAE0"]
[Fri Mar 27 07:37:51.361462 2026] [:error] [pid 27749:tid 27798] [client 20.100.192.188:65472] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "acXDT8EqyoMni2Q6_X5wTgAAAEc"]
[Fri Mar 27 07:37:52.105496 2026] [:error] [pid 4293:tid 4300] [client 20.100.192.188:19190] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "acXDUJLjeJUC3OKtEx-WXgAAAUU"]
[Fri Mar 27 07:37:52.806672 2026] [:error] [pid 27851:tid 27872] [client 20.100.192.188:65507] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "acXDUHR2ccxe3RMCLbosdAAAAM4"]
[Fri Mar 27 07:37:53.693568 2026] [:error] [pid 27851:tid 27860] [client 20.100.192.188:13024] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "acXDUXR2ccxe3RMCLbosdQAAAMI"]
[Fri Mar 27 07:37:54.255746 2026] [:error] [pid 27743:tid 27787] [client 20.100.192.188:37739] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "acXDUiA46UYYLqzw99ANMwAAABc"]
[Fri Mar 27 07:37:55.080983 2026] [:error] [pid 4341:tid 4351] [client 20.100.192.188:19186] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "acXDU-KJWrNB5dMlEREx_AAAAYg"]
[Fri Mar 27 07:37:55.725286 2026] [:error] [pid 27851:tid 27866] [client 20.100.192.188:65409] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "acXDU3R2ccxe3RMCLbosdwAAAMg"]
[Fri Mar 27 07:37:56.394519 2026] [:error] [pid 27749:tid 27797] [client 20.100.192.188:64990] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "acXDVMEqyoMni2Q6_X5wUAAAAEY"]
[Fri Mar 27 07:37:57.239532 2026] [:error] [pid 27749:tid 27801] [client 20.100.192.188:65014] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "acXDVcEqyoMni2Q6_X5wVgAAAEo"]
[Fri Mar 27 07:37:57.893900 2026] [:error] [pid 4341:tid 4357] [client 20.100.192.188:64733] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "acXDVeKJWrNB5dMlEREyBAAAAY4"]
[Fri Mar 27 07:37:58.717113 2026] [:error] [pid 27743:tid 27766] [client 20.100.192.188:37708] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "acXDViA46UYYLqzw99ANOAAAAAI"]
[Fri Mar 27 07:37:59.296945 2026] [:error] [pid 4293:tid 4299] [client 20.100.192.188:65016] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acXDV5LjeJUC3OKtEx-WZgAAAUQ"]
[Fri Mar 27 07:38:00.052432 2026] [:error] [pid 4293:tid 4305] [client 20.100.192.188:65408] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acXDWJLjeJUC3OKtEx-WaAAAAUo"]
[Fri Mar 27 07:38:01.080549 2026] [:error] [pid 27851:tid 27882] [client 20.100.192.188:19187] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acXDWXR2ccxe3RMCLbosfQAAANg"]
[Fri Mar 27 07:38:02.357226 2026] [:error] [pid 4293:tid 4306] [client 20.100.192.188:13047] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acXDWpLjeJUC3OKtEx-WaQAAAUs"]
[Fri Mar 27 07:38:03.567379 2026] [:error] [pid 27750:tid 27827] [client 20.100.192.188:65438] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acXDW4aSil5rd17ieLxNGwAAAIk"]
[Fri Mar 27 07:38:04.711143 2026] [:error] [pid 27749:tid 27796] [client 20.100.192.188:19167] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acXDXMEqyoMni2Q6_X5wYwAAAEU"]
[Fri Mar 27 07:38:05.594371 2026] [:error] [pid 27749:tid 27805] [client 20.100.192.188:42645] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acXDXcEqyoMni2Q6_X5wZAAAAE4"]
[Fri Mar 27 07:38:06.247002 2026] [:error] [pid 27750:tid 27825] [client 20.100.192.188:37748] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acXDXoaSil5rd17ieLxNHQAAAIc"]
[Fri Mar 27 07:38:06.834873 2026] [:error] [pid 27743:tid 27765] [client 20.100.192.188:65131] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "acXDXiA46UYYLqzw99ANQAAAAAE"]
[Fri Mar 27 07:38:07.410854 2026] [:error] [pid 27749:tid 27814] [client 20.100.192.188:12997] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "acXDX8EqyoMni2Q6_X5waAAAAFc"]
[Fri Mar 27 07:38:08.478073 2026] [:error] [pid 27851:tid 27873] [client 20.100.192.188:13025] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "acXDYHR2ccxe3RMCLbosiwAAAM8"]
[Fri Mar 27 07:38:09.351836 2026] [:error] [pid 27851:tid 27860] [client 20.100.192.188:37741] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "acXDYXR2ccxe3RMCLbosjgAAAMI"]
[Fri Mar 27 07:38:11.498924 2026] [:error] [pid 27851:tid 27866] [client 20.100.192.188:65521] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acXDY3R2ccxe3RMCLboskAAAAMg"]
[Fri Mar 27 07:38:12.794148 2026] [:error] [pid 27851:tid 27878] [client 20.100.192.188:19142] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acXDZHR2ccxe3RMCLboslAAAANQ"]
[Fri Mar 27 07:38:13.682111 2026] [:error] [pid 63897:tid 63909] [client 20.100.192.188:64753] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acXDZWVSkmYmLu7ycYgjIwAAAQo"]
[Fri Mar 27 07:38:14.259746 2026] [:error] [pid 4341:tid 4361] [client 20.100.192.188:42635] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acXDZuKJWrNB5dMlEREyEQAAAZI"]
[Fri Mar 27 07:38:15.873074 2026] [:error] [pid 4293:tid 4317] [client 20.100.192.188:42686] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/varb.php"] [unique_id "acXDZ5LjeJUC3OKtEx-WgwAAAVY"]
[Fri Mar 27 07:38:16.861684 2026] [:error] [pid 63897:tid 63920] [client 20.100.192.188:65066] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/varb.php"] [unique_id "acXDaGVSkmYmLu7ycYgjLwAAARU"]
[Fri Mar 27 07:38:17.438362 2026] [:error] [pid 63897:tid 63922] [client 20.100.192.188:42677] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/varb.php"] [unique_id "acXDaWVSkmYmLu7ycYgjMgAAARc"]
[Fri Mar 27 07:38:18.476992 2026] [:error] [pid 27851:tid 27867] [client 20.100.192.188:65411] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/varb.php"] [unique_id "acXDanR2ccxe3RMCLbosoQAAAMk"]
[Fri Mar 27 07:38:19.236200 2026] [:error] [pid 27743:tid 27775] [client 20.100.192.188:65426] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "acXDayA46UYYLqzw99ANRgAAAAs"]
[Fri Mar 27 07:38:20.115356 2026] [:error] [pid 27750:tid 27827] [client 20.100.192.188:65526] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "acXDbIaSil5rd17ieLxNJQAAAIk"]
[Fri Mar 27 07:38:20.945518 2026] [:error] [pid 63897:tid 63919] [client 20.100.192.188:42639] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "acXDbGVSkmYmLu7ycYgjNgAAARQ"]
[Fri Mar 27 07:38:22.337227 2026] [:error] [pid 27750:tid 27821] [client 20.100.192.188:65123] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "acXDboaSil5rd17ieLxNJwAAAIM"]
[Fri Mar 27 07:38:22.973923 2026] [:error] [pid 27851:tid 27875] [client 20.100.192.188:37706] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clss.php"] [unique_id "acXDbnR2ccxe3RMCLbosrwAAANE"]
[Fri Mar 27 07:38:23.604075 2026] [:error] [pid 4341:tid 4364] [client 20.100.192.188:13013] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clss.php"] [unique_id "acXDb-KJWrNB5dMlEREyGQAAAZU"]
[Fri Mar 27 07:38:25.024113 2026] [:error] [pid 4341:tid 4365] [client 20.100.192.188:13045] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clss.php"] [unique_id "acXDceKJWrNB5dMlEREyIAAAAZY"]
[Fri Mar 27 07:38:26.055575 2026] [:error] [pid 4341:tid 4356] [client 20.100.192.188:19183] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clss.php"] [unique_id "acXDcuKJWrNB5dMlEREyJgAAAY0"]
[Fri Mar 27 07:38:26.945286 2026] [:error] [pid 4341:tid 4348] [client 20.100.192.188:65424] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/44.php"] [unique_id "acXDcuKJWrNB5dMlEREyLAAAAYU"]
[Fri Mar 27 07:38:27.743768 2026] [:error] [pid 4341:tid 4347] [client 20.100.192.188:37735] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/44.php"] [unique_id "acXDc-KJWrNB5dMlEREyLwAAAYQ"]
[Fri Mar 27 07:38:28.966454 2026] [:error] [pid 27749:tid 27815] [client 20.100.192.188:37747] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/44.php"] [unique_id "acXDdMEqyoMni2Q6_X5weQAAAFg"]
[Fri Mar 27 07:38:29.864332 2026] [:error] [pid 27851:tid 27881] [client 20.100.192.188:64960] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/44.php"] [unique_id "acXDdXR2ccxe3RMCLbostQAAANc"]
[Fri Mar 27 07:38:31.566505 2026] [:error] [pid 27749:tid 27805] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/a5e0a.php
[Fri Mar 27 07:38:31.897259 2026] [:error] [pid 27749:tid 27794] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Fri Mar 27 07:38:32.261501 2026] [:error] [pid 27749:tid 27812] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/56c53.php
[Fri Mar 27 07:38:32.667032 2026] [:error] [pid 27749:tid 27806] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Fri Mar 27 07:38:32.932813 2026] [:error] [pid 27749:tid 27808] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Fri Mar 27 07:38:33.231183 2026] [:error] [pid 27749:tid 27802] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Fri Mar 27 07:38:33.503859 2026] [:error] [pid 27749:tid 27797] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Fri Mar 27 07:38:33.776986 2026] [:error] [pid 27749:tid 27814] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Fri Mar 27 07:38:34.097013 2026] [:error] [pid 27749:tid 27800] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Fri Mar 27 07:38:34.363618 2026] [:error] [pid 27749:tid 27791] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/ws49.php
[Fri Mar 27 07:38:34.629519 2026] [:error] [pid 27749:tid 27810] [client 20.100.192.188:42675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Fri Mar 27 07:38:34.891529 2026] [:error] [pid 27749:tid 27803] [client 20.100.192.188:42675] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "acXDesEqyoMni2Q6_X5wiQAAAEw"]
[Fri Mar 27 07:38:36.185528 2026] [:error] [pid 63897:tid 63906] [client 20.100.192.188:19148] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "acXDfGVSkmYmLu7ycYgjSQAAAQc"]
[Fri Mar 27 07:38:37.848536 2026] [:error] [pid 4293:tid 4302] [client 20.100.192.188:13028] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "acXDfZLjeJUC3OKtEx-WmAAAAUc"]
[Fri Mar 27 07:38:38.978790 2026] [:error] [pid 27743:tid 27778] [client 20.100.192.188:65420] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "acXDfiA46UYYLqzw99ANUAAAAA4"]
[Fri Mar 27 07:38:40.391861 2026] [:error] [pid 27750:tid 27822] [client 20.100.192.188:65514] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acXDgIaSil5rd17ieLxNMwAAAIQ"]
[Fri Mar 27 07:38:41.935868 2026] [:error] [pid 4293:tid 4308] [client 20.100.192.188:64980] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acXDgZLjeJUC3OKtEx-WogAAAU0"]
[Fri Mar 27 07:38:42.759420 2026] [:error] [pid 63897:tid 63921] [client 20.100.192.188:42664] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acXDgmVSkmYmLu7ycYgjVgAAARY"]
[Fri Mar 27 07:38:43.980788 2026] [:error] [pid 4293:tid 4299] [client 20.100.192.188:65511] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acXDg5LjeJUC3OKtEx-WpgAAAUQ"]
[Fri Mar 27 07:38:45.419960 2026] [:error] [pid 4341:tid 4355] [client 20.100.192.188:12998] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/callback.php"] [unique_id "acXDheKJWrNB5dMlEREyPwAAAYw"]
[Fri Mar 27 07:38:46.190832 2026] [:error] [pid 27851:tid 27876] [client 20.100.192.188:19150] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/callback.php"] [unique_id "acXDhnR2ccxe3RMCLbosyAAAANI"]
[Fri Mar 27 07:38:46.839889 2026] [:error] [pid 4293:tid 4307] [client 20.100.192.188:13021] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/callback.php"] [unique_id "acXDhpLjeJUC3OKtEx-WrwAAAUw"]
[Fri Mar 27 07:38:47.944805 2026] [:error] [pid 27749:tid 27793] [client 20.100.192.188:12996] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/callback.php"] [unique_id "acXDh8EqyoMni2Q6_X5wlAAAAEI"]
[Fri Mar 27 07:38:49.296869 2026] [:error] [pid 4341:tid 4362] [client 20.100.192.188:13005] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acXDieKJWrNB5dMlEREyQQAAAZM"]
[Fri Mar 27 07:38:50.327450 2026] [:error] [pid 27743:tid 27779] [client 20.100.192.188:19146] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acXDiiA46UYYLqzw99ANVwAAAA8"]
[Fri Mar 27 07:38:51.970487 2026] [:error] [pid 63897:tid 63916] [client 20.100.192.188:19184] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acXDi2VSkmYmLu7ycYgjYQAAARE"]
[Fri Mar 27 07:38:52.802630 2026] [:error] [pid 27851:tid 27879] [client 20.100.192.188:37759] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acXDjHR2ccxe3RMCLboszgAAANU"]
[Fri Mar 27 07:38:53.662176 2026] [:error] [pid 4341:tid 4344] [client 20.100.192.188:19151] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acXDjeKJWrNB5dMlEREySAAAAYE"]
[Fri Mar 27 07:38:54.256910 2026] [:error] [pid 63897:tid 63911] [client 20.100.192.188:42672] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acXDjmVSkmYmLu7ycYgjaQAAAQw"]
[Fri Mar 27 07:38:55.010292 2026] [:error] [pid 4341:tid 4367] [client 20.100.192.188:64716] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acXDj-KJWrNB5dMlEREySwAAAZg"]
[Fri Mar 27 07:38:55.607197 2026] [:error] [pid 4293:tid 4304] [client 20.100.192.188:13022] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acXDj5LjeJUC3OKtEx-WwwAAAUk"]
[Fri Mar 27 07:38:56.539816 2026] [:error] [pid 27749:tid 27804] [client 20.100.192.188:13038] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acXDkMEqyoMni2Q6_X5wmQAAAE0"]
[Fri Mar 27 07:38:57.671597 2026] [:error] [pid 63897:tid 63903] [client 20.100.192.188:42636] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acXDkWVSkmYmLu7ycYgjcQAAAQQ"]
[Fri Mar 27 07:38:58.637082 2026] [:error] [pid 27750:tid 27842] [client 20.100.192.188:65486] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acXDkoaSil5rd17ieLxNSgAAAJg"]
[Fri Mar 27 07:38:59.411595 2026] [:error] [pid 27851:tid 27875] [client 20.100.192.188:65468] [client 20.100.192.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "acXDk3R2ccxe3RMCLbos0QAAANE"]
[Sat Mar 28 11:01:48.789660 2026] [:error] [pid 34631:tid 34676] [client 206.189.37.118:54698] [client 206.189.37.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.37.118, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "acdEnDtzjMMS6kojpeR5LQAAAdA"]
[Sat Mar 28 11:01:48.793491 2026] [:error] [pid 34631:tid 34676] [client 206.189.37.118:54698] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Mar 28 13:16:12.381673 2026] [:error] [pid 64861:tid 64937] [client 52.231.64.83:14783] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Mar 28 13:16:12.674660 2026] [:error] [pid 64861:tid 64949] [client 52.231.64.83:14783] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Mar 28 13:16:13.250057 2026] [:error] [pid 64861:tid 64943] [client 52.231.64.83:14783] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Mar 28 13:16:13.392343 2026] [:error] [pid 64861:tid 64938] [client 52.231.64.83:14783] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php
[Sat Mar 28 13:16:13.567367 2026] [:error] [pid 64861:tid 64936] [client 52.231.64.83:14783] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Sat Mar 28 13:16:13.708585 2026] [:error] [pid 64861:tid 64937] [client 52.231.64.83:14783] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Mar 28 13:16:13.851092 2026] [:error] [pid 64861:tid 64948] [client 52.231.64.83:14783] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Mar 28 13:16:14.019065 2026] [:error] [pid 64861:tid 64945] [client 52.231.64.83:14783] [client 52.231.64.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acdkHuxK22_lUN2kvnXJ4gAAAIo"]
[Sat Mar 28 13:16:14.658029 2026] [:error] [pid 64966:tid 64992] [client 52.231.64.83:8994] [client 52.231.64.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acdkHtfSvF5AFfSuKxUUQAAAANM"]
[Sat Mar 28 13:16:15.245445 2026] [:error] [pid 64860:tid 64916] [client 52.231.64.83:14731] [client 52.231.64.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acdkHxkU3N0pg_4aEL9XHAAAAEg"]
[Sat Mar 28 13:16:15.819572 2026] [:error] [pid 64861:tid 64948] [client 52.231.64.83:8984] [client 52.231.64.83] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acdkH-xK22_lUN2kvnXJ6wAAAI0"]
[Sun Mar 29 02:55:04.223779 2026] [:error] [pid 60346:tid 60362] [client 217.216.37.56:61581] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "acgkCHVrXSgLxlxLi9BUgwAAAQs"]
[Sun Mar 29 02:55:04.434749 2026] [:error] [pid 60346:tid 60351] [client 217.216.37.56:62854] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acgkCHVrXSgLxlxLi9BUhwAAAQA"]
[Sun Mar 29 02:55:04.644763 2026] [:error] [pid 60346:tid 60366] [client 217.216.37.56:59318] [client 217.216.37.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/system/js/core.js"] [unique_id "acgkCHVrXSgLxlxLi9BUjAAAAQ8"]
[Sun Mar 29 05:21:48.308639 2026] [:error] [pid 12910:tid 12934] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sun Mar 29 05:21:48.498832 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Sun Mar 29 05:21:48.690609 2026] [:error] [pid 12910:tid 12932] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Sun Mar 29 05:21:48.881369 2026] [:error] [pid 12910:tid 12919] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sun Mar 29 05:21:49.077329 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/wxfyf.php
[Sun Mar 29 05:21:49.268616 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/callback.php
[Sun Mar 29 05:21:49.458957 2026] [:error] [pid 12910:tid 12922] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Sun Mar 29 05:21:49.650357 2026] [:error] [pid 12910:tid 12927] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Sun Mar 29 05:21:49.866554 2026] [:error] [pid 12910:tid 12917] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Sun Mar 29 05:21:50.065557 2026] [:error] [pid 12910:tid 12924] [client 130.131.193.97:12239] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Sun Mar 29 05:21:50.252886 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12239] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "achGbinoNBcZwnBvsMNJKQAAAVg"]
[Sun Mar 29 05:21:50.629483 2026] [:error] [pid 12910:tid 12919] [client 130.131.193.97:12286] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "achGbinoNBcZwnBvsMNJLAAAAUc"]
[Sun Mar 29 05:21:51.010550 2026] [:error] [pid 32257:tid 32328] [client 130.131.193.97:12242] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "achGbyE3TArOFrUtgWowwgAAAIo"]
[Sun Mar 29 05:21:51.386836 2026] [:error] [pid 32255:tid 32295] [client 130.131.193.97:12259] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "achGb2nfn-AtRoMbquxJPwAAAEQ"]
[Sun Mar 29 05:21:51.763134 2026] [:error] [pid 32255:tid 32301] [client 130.131.193.97:12172] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "achGb2nfn-AtRoMbquxJQQAAAEo"]
[Sun Mar 29 05:21:52.161980 2026] [:error] [pid 32359:tid 32371] [client 130.131.193.97:12277] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "achGcAMb8G3UzfQP3WjP0QAAAMo"]
[Sun Mar 29 05:21:52.550574 2026] [:error] [pid 12910:tid 12914] [client 130.131.193.97:12268] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "achGcCnoNBcZwnBvsMNJMwAAAUI"]
[Sun Mar 29 05:21:52.943772 2026] [:error] [pid 12910:tid 12935] [client 130.131.193.97:12178] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "achGcCnoNBcZwnBvsMNJNQAAAVc"]
[Sun Mar 29 05:21:53.335905 2026] [:error] [pid 1524:tid 1542] [client 130.131.193.97:12160] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "achGcVoaWSl2asqQCh8VOwAAAQs"]
[Sun Mar 29 05:21:53.736524 2026] [:error] [pid 32255:tid 32297] [client 130.131.193.97:12232] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "achGcWnfn-AtRoMbquxJRQAAAEY"]
[Sun Mar 29 05:21:54.119917 2026] [:error] [pid 1524:tid 1551] [client 130.131.193.97:12225] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "achGcloaWSl2asqQCh8VPgAAARM"]
[Sun Mar 29 05:21:54.494253 2026] [:error] [pid 32257:tid 32335] [client 130.131.193.97:12180] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "achGciE3TArOFrUtgWowxQAAAJE"]
[Sun Mar 29 05:21:54.879900 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12247] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "achGcinoNBcZwnBvsMNJOgAAAVg"]
[Sun Mar 29 05:21:55.261587 2026] [:error] [pid 32257:tid 32331] [client 130.131.193.97:12168] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "achGcyE3TArOFrUtgWowzQAAAI0"]
[Sun Mar 29 05:21:55.640770 2026] [:error] [pid 12910:tid 12919] [client 130.131.193.97:12282] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "achGcynoNBcZwnBvsMNJOwAAAUc"]
[Sun Mar 29 05:21:56.033557 2026] [:error] [pid 1524:tid 1554] [client 130.131.193.97:12216] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "achGdFoaWSl2asqQCh8VQgAAARY"]
[Sun Mar 29 05:21:56.414149 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:12283] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "achGdCnoNBcZwnBvsMNJRQAAAUY"]
[Sun Mar 29 05:21:56.790354 2026] [:error] [pid 12910:tid 12927] [client 130.131.193.97:12176] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "achGdCnoNBcZwnBvsMNJSgAAAU8"]
[Sun Mar 29 05:21:57.168839 2026] [:error] [pid 12910:tid 12921] [client 130.131.193.97:12284] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "achGdSnoNBcZwnBvsMNJTwAAAUk"]
[Sun Mar 29 05:21:57.542531 2026] [:error] [pid 12910:tid 12935] [client 130.131.193.97:12177] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "achGdSnoNBcZwnBvsMNJVAAAAVc"]
[Sun Mar 29 05:21:57.919923 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:12280] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "achGdSnoNBcZwnBvsMNJVwAAAVM"]
[Sun Mar 29 05:21:58.353568 2026] [:error] [pid 12910:tid 12927] [client 130.131.193.97:12257] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "achGdinoNBcZwnBvsMNJWQAAAU8"]
[Sun Mar 29 05:21:58.751819 2026] [:error] [pid 32255:tid 32304] [client 130.131.193.97:12234] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "achGdmnfn-AtRoMbquxJTQAAAE0"]
[Sun Mar 29 05:21:59.133303 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12275] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "achGdynoNBcZwnBvsMNJXQAAAUs"]
[Sun Mar 29 05:21:59.527075 2026] [:error] [pid 1524:tid 1545] [client 130.131.193.97:12245] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sale.php"] [unique_id "achGd1oaWSl2asqQCh8VRQAAAQ4"]
[Sun Mar 29 05:21:59.934871 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12273] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sale.php"] [unique_id "achGdynoNBcZwnBvsMNJXwAAAVg"]
[Sun Mar 29 05:22:00.371453 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:12164] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sale.php"] [unique_id "achGeCnoNBcZwnBvsMNJYgAAAVA"]
[Sun Mar 29 05:22:00.751662 2026] [:error] [pid 1524:tid 1538] [client 130.131.193.97:12253] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sale.php"] [unique_id "achGeFoaWSl2asqQCh8VSgAAAQk"]
[Sun Mar 29 05:22:01.158624 2026] [:error] [pid 32255:tid 32293] [client 130.131.193.97:12175] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "achGeWnfn-AtRoMbquxJUQAAAEI"]
[Sun Mar 29 05:22:01.542128 2026] [:error] [pid 32255:tid 32292] [client 130.131.193.97:12111] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "achGeWnfn-AtRoMbquxJUwAAAEE"]
[Sun Mar 29 05:22:01.918760 2026] [:error] [pid 32257:tid 32337] [client 130.131.193.97:12174] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "achGeSE3TArOFrUtgWow0QAAAJM"]
[Sun Mar 29 05:22:02.297364 2026] [:error] [pid 32255:tid 32311] [client 130.131.193.97:12170] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "achGemnfn-AtRoMbquxJVQAAAFQ"]
[Sun Mar 29 05:22:02.674548 2026] [:error] [pid 1524:tid 1551] [client 130.131.193.97:12235] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2ksm17n.php"] [unique_id "achGeloaWSl2asqQCh8VTQAAARM"]
[Sun Mar 29 05:22:03.056863 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12262] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2ksm17n.php"] [unique_id "achGeynoNBcZwnBvsMNJbgAAAUs"]
[Sun Mar 29 05:22:03.447943 2026] [:error] [pid 1524:tid 1553] [client 130.131.193.97:12161] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2ksm17n.php"] [unique_id "achGe1oaWSl2asqQCh8VTwAAARU"]
[Sun Mar 29 05:22:03.822471 2026] [:error] [pid 32257:tid 32340] [client 130.131.193.97:12255] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2ksm17n.php"] [unique_id "achGeyE3TArOFrUtgWow1wAAAJY"]
[Sun Mar 29 05:22:04.214389 2026] [:error] [pid 32257:tid 32326] [client 130.131.193.97:12269] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "achGfCE3TArOFrUtgWow2gAAAIg"]
[Sun Mar 29 05:22:04.590947 2026] [:error] [pid 32359:tid 32375] [client 130.131.193.97:12098] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "achGfAMb8G3UzfQP3WjP2AAAAM4"]
[Sun Mar 29 05:22:04.979480 2026] [:error] [pid 12910:tid 12912] [client 130.131.193.97:12227] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "achGfCnoNBcZwnBvsMNJcQAAAUA"]
[Sun Mar 29 05:22:05.356191 2026] [:error] [pid 12910:tid 12932] [client 130.131.193.97:12263] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "achGfSnoNBcZwnBvsMNJdAAAAVQ"]
[Sun Mar 29 05:22:05.749077 2026] [:error] [pid 32359:tid 32366] [client 130.131.193.97:12129] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hots.php"] [unique_id "achGfQMb8G3UzfQP3WjP3QAAAMU"]
[Sun Mar 29 05:22:06.133863 2026] [:error] [pid 1524:tid 1552] [client 130.131.193.97:12237] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hots.php"] [unique_id "achGfloaWSl2asqQCh8VVgAAARQ"]
[Sun Mar 29 05:22:06.526685 2026] [:error] [pid 1524:tid 1547] [client 130.131.193.97:12229] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hots.php"] [unique_id "achGfloaWSl2asqQCh8VWAAAARA"]
[Sun Mar 29 05:22:06.926307 2026] [:error] [pid 32254:tid 32268] [client 130.131.193.97:12201] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hots.php"] [unique_id "achGfqug2IHuyGgCTn8P-gAAAAQ"]
[Sun Mar 29 05:22:07.309012 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12252] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "achGfynoNBcZwnBvsMNJfgAAAUs"]
[Sun Mar 29 05:22:07.788622 2026] [:error] [pid 12910:tid 12925] [client 130.131.193.97:12278] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "achGfynoNBcZwnBvsMNJgQAAAU0"]
[Sun Mar 29 05:22:08.164768 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:12171] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "achGgCnoNBcZwnBvsMNJhAAAAVA"]
[Sun Mar 29 05:22:08.555511 2026] [:error] [pid 32255:tid 32291] [client 130.131.193.97:12173] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "achGgGnfn-AtRoMbquxJXAAAAEA"]
[Sun Mar 29 05:22:08.949062 2026] [:error] [pid 32257:tid 32341] [client 130.131.193.97:12287] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "achGgCE3TArOFrUtgWow6AAAAJc"]
[Sun Mar 29 05:22:09.363626 2026] [:error] [pid 32257:tid 32337] [client 130.131.193.97:12169] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "achGgSE3TArOFrUtgWow7AAAAJM"]
[Sun Mar 29 05:22:09.770343 2026] [:error] [pid 32257:tid 32339] [client 130.131.193.97:12200] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "achGgSE3TArOFrUtgWow7gAAAJU"]
[Sun Mar 29 05:22:10.151537 2026] [:error] [pid 32257:tid 32329] [client 130.131.193.97:12113] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "achGgiE3TArOFrUtgWow7wAAAIs"]
[Sun Mar 29 05:22:10.561015 2026] [:error] [pid 32257:tid 32319] [client 130.131.193.97:12165] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "achGgiE3TArOFrUtgWow8wAAAIE"]
[Sun Mar 29 05:22:10.939794 2026] [:error] [pid 1524:tid 1551] [client 130.131.193.97:12167] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "achGgloaWSl2asqQCh8VXgAAARM"]
[Sun Mar 29 05:22:11.325549 2026] [:error] [pid 12910:tid 12913] [client 130.131.193.97:12162] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "achGgynoNBcZwnBvsMNJigAAAUE"]
[Sun Mar 29 05:22:11.790387 2026] [:error] [pid 1524:tid 1554] [client 130.131.193.97:12222] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "achGg1oaWSl2asqQCh8VYgAAARY"]
[Sun Mar 29 05:22:12.173954 2026] [:error] [pid 1524:tid 1544] [client 130.131.193.97:12266] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "achGhFoaWSl2asqQCh8VZQAAAQ0"]
[Sun Mar 29 05:22:12.583946 2026] [:error] [pid 1524:tid 1547] [client 130.131.193.97:12212] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "achGhFoaWSl2asqQCh8VZwAAARA"]
[Sun Mar 29 05:22:12.965705 2026] [:error] [pid 32254:tid 32287] [client 130.131.193.97:12184] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "achGhKug2IHuyGgCTn8P-wAAABc"]
[Sun Mar 29 05:22:13.384614 2026] [:error] [pid 1524:tid 1555] [client 130.131.193.97:12249] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "achGhVoaWSl2asqQCh8VaQAAARc"]
[Sun Mar 29 05:22:13.820395 2026] [:error] [pid 32254:tid 32267] [client 130.131.193.97:12135] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "achGhaug2IHuyGgCTn8P_gAAAAM"]
[Sun Mar 29 05:22:14.289545 2026] [:error] [pid 32255:tid 32293] [client 130.131.193.97:12189] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "achGhmnfn-AtRoMbquxJYgAAAEI"]
[Sun Mar 29 05:22:14.741338 2026] [:error] [pid 32255:tid 32292] [client 130.131.193.97:12102] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "achGhmnfn-AtRoMbquxJZQAAAEE"]
[Sun Mar 29 05:22:15.151799 2026] [:error] [pid 32359:tid 32366] [client 130.131.193.97:12182] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "achGhwMb8G3UzfQP3WjP5QAAAMU"]
[Sun Mar 29 05:22:15.651072 2026] [:error] [pid 32254:tid 32271] [client 130.131.193.97:12159] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "achGh6ug2IHuyGgCTn8QAQAAAAc"]
[Sun Mar 29 05:22:16.029748 2026] [:error] [pid 1524:tid 1527] [client 130.131.193.97:12190] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "achGiFoaWSl2asqQCh8VbwAAAQA"]
[Sun Mar 29 05:22:16.411880 2026] [:error] [pid 12910:tid 12922] [client 130.131.193.97:12187] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "achGiCnoNBcZwnBvsMNJjwAAAUo"]
[Sun Mar 29 05:22:16.841397 2026] [:error] [pid 32254:tid 32264] [client 130.131.193.97:12199] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "achGiKug2IHuyGgCTn8QAwAAAAA"]
[Sun Mar 29 05:22:17.269577 2026] [:error] [pid 1524:tid 1533] [client 130.131.193.97:12230] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "achGiVoaWSl2asqQCh8VcgAAAQU"]
[Sun Mar 29 05:22:17.664382 2026] [:error] [pid 32257:tid 32325] [client 130.131.193.97:12127] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "achGiSE3TArOFrUtgWoxAgAAAIc"]
[Sun Mar 29 05:22:18.106555 2026] [:error] [pid 32257:tid 32333] [client 130.131.193.97:12209] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "achGiiE3TArOFrUtgWoxBQAAAI8"]
[Sun Mar 29 05:22:18.538824 2026] [:error] [pid 1524:tid 1545] [client 130.131.193.97:12179] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "achGiloaWSl2asqQCh8VdQAAAQ4"]
[Sun Mar 29 05:22:19.028516 2026] [:error] [pid 32257:tid 32336] [client 130.131.193.97:12198] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "achGiyE3TArOFrUtgWoxDgAAAJI"]
[Sun Mar 29 05:22:19.554136 2026] [:error] [pid 32359:tid 32361] [client 130.131.193.97:12045] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "achGiwMb8G3UzfQP3WjP7AAAAMA"]
[Sun Mar 29 05:22:20.065314 2026] [:error] [pid 32254:tid 32284] [client 130.131.193.97:12254] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "achGjKug2IHuyGgCTn8QCAAAABQ"]
[Sun Mar 29 05:22:20.451936 2026] [:error] [pid 32257:tid 32321] [client 130.131.193.97:12048] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "achGjCE3TArOFrUtgWoxFwAAAIM"]
[Sun Mar 29 05:22:20.857097 2026] [:error] [pid 32255:tid 32313] [client 130.131.193.97:12136] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/56c53.php"] [unique_id "achGjGnfn-AtRoMbquxJagAAAFY"]
[Sun Mar 29 05:22:21.246354 2026] [:error] [pid 32257:tid 32322] [client 130.131.193.97:12186] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/56c53.php"] [unique_id "achGjSE3TArOFrUtgWoxHAAAAIQ"]
[Sun Mar 29 05:22:21.644175 2026] [:error] [pid 32255:tid 32291] [client 130.131.193.97:12281] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/56c53.php"] [unique_id "achGjWnfn-AtRoMbquxJbQAAAEA"]
[Sun Mar 29 05:22:22.040375 2026] [:error] [pid 32257:tid 32337] [client 130.131.193.97:12112] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/56c53.php"] [unique_id "achGjiE3TArOFrUtgWoxIQAAAJM"]
[Sun Mar 29 05:22:22.449123 2026] [:error] [pid 32255:tid 32309] [client 130.131.193.97:12211] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "achGjmnfn-AtRoMbquxJbwAAAFI"]
[Sun Mar 29 05:22:22.832130 2026] [:error] [pid 32254:tid 32275] [client 130.131.193.97:12166] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "achGjqug2IHuyGgCTn8QEgAAAAs"]
[Sun Mar 29 05:22:23.223100 2026] [:error] [pid 12910:tid 12929] [client 130.131.193.97:12100] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "achGjynoNBcZwnBvsMNJmQAAAVE"]
[Sun Mar 29 05:22:23.648216 2026] [:error] [pid 32257:tid 32319] [client 130.131.193.97:12122] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "achGjyE3TArOFrUtgWoxJgAAAIE"]
[Sun Mar 29 05:22:24.172397 2026] [:error] [pid 12910:tid 12926] [client 130.131.193.97:12119] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "achGkCnoNBcZwnBvsMNJmwAAAU4"]
[Sun Mar 29 05:22:24.557198 2026] [:error] [pid 32254:tid 32269] [client 130.131.193.97:12285] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "achGkKug2IHuyGgCTn8QFQAAAAU"]
[Sun Mar 29 05:22:24.930879 2026] [:error] [pid 32254:tid 32265] [client 130.131.193.97:12147] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "achGkKug2IHuyGgCTn8QFwAAAAE"]
[Sun Mar 29 05:22:25.333652 2026] [:error] [pid 32257:tid 32318] [client 130.131.193.97:12195] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "achGkSE3TArOFrUtgWoxMAAAAIA"]
[Sun Mar 29 05:22:25.737952 2026] [:error] [pid 32257:tid 32324] [client 130.131.193.97:12248] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "achGkSE3TArOFrUtgWoxMgAAAIY"]
[Sun Mar 29 05:22:26.167004 2026] [:error] [pid 1524:tid 1544] [client 130.131.193.97:12128] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "achGkloaWSl2asqQCh8VeAAAAQ0"]
[Sun Mar 29 05:22:26.553439 2026] [:error] [pid 1524:tid 1552] [client 130.131.193.97:12110] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "achGkloaWSl2asqQCh8VeQAAARQ"]
[Sun Mar 29 05:22:26.954803 2026] [:error] [pid 12910:tid 12916] [client 130.131.193.97:12270] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "achGkinoNBcZwnBvsMNJnwAAAUQ"]
[Sun Mar 29 05:22:27.361737 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12132] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bo.php"] [unique_id "achGkynoNBcZwnBvsMNJoQAAAUs"]
[Sun Mar 29 05:22:27.774931 2026] [:error] [pid 32257:tid 32341] [client 130.131.193.97:12243] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bo.php"] [unique_id "achGkyE3TArOFrUtgWoxPAAAAJc"]
[Sun Mar 29 05:22:28.165467 2026] [:error] [pid 12910:tid 12919] [client 130.131.193.97:12047] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bo.php"] [unique_id "achGlCnoNBcZwnBvsMNJpAAAAUc"]
[Sun Mar 29 05:22:28.574410 2026] [:error] [pid 32257:tid 32323] [client 130.131.193.97:12218] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bo.php"] [unique_id "achGlCE3TArOFrUtgWoxPgAAAIU"]
[Sun Mar 29 05:22:29.001475 2026] [:error] [pid 32254:tid 32281] [client 130.131.193.97:12213] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "achGlKug2IHuyGgCTn8QHQAAABE"]
[Sun Mar 29 05:22:29.405576 2026] [:error] [pid 32255:tid 32297] [client 130.131.193.97:12099] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "achGlWnfn-AtRoMbquxJeAAAAEY"]
[Sun Mar 29 05:22:29.906178 2026] [:error] [pid 1524:tid 1546] [client 130.131.193.97:12256] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "achGlVoaWSl2asqQCh8VewAAAQ8"]
[Sun Mar 29 05:22:30.324029 2026] [:error] [pid 12910:tid 12933] [client 130.131.193.97:12130] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "achGlinoNBcZwnBvsMNJqAAAAVU"]
[Sun Mar 29 05:22:30.823343 2026] [:error] [pid 12910:tid 12929] [client 130.131.193.97:12193] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "achGlinoNBcZwnBvsMNJqgAAAVE"]
[Sun Mar 29 05:22:31.450343 2026] [:error] [pid 32359:tid 32383] [client 130.131.193.97:12217] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "achGlwMb8G3UzfQP3WjP9wAAANY"]
[Sun Mar 29 05:22:31.870199 2026] [:error] [pid 32359:tid 32371] [client 130.131.193.97:12097] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "achGlwMb8G3UzfQP3WjP-QAAAMo"]
[Sun Mar 29 05:22:32.354480 2026] [:error] [pid 12910:tid 12930] [client 130.131.193.97:12194] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "achGmCnoNBcZwnBvsMNJrwAAAVI"]
[Sun Mar 29 05:22:32.783116 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12272] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "achGmCnoNBcZwnBvsMNJswAAAUs"]
[Sun Mar 29 05:22:33.248686 2026] [:error] [pid 12910:tid 12917] [client 130.131.193.97:12251] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "achGmSnoNBcZwnBvsMNJtwAAAUU"]
[Sun Mar 29 05:22:33.734609 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:12202] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "achGmSnoNBcZwnBvsMNJvQAAAVM"]
[Sun Mar 29 05:22:34.188662 2026] [:error] [pid 32359:tid 32361] [client 130.131.193.97:12224] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "achGmgMb8G3UzfQP3WjP_AAAAMA"]
[Sun Mar 29 05:22:34.723646 2026] [:error] [pid 1524:tid 1552] [client 130.131.193.97:12163] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "achGmloaWSl2asqQCh8VhwAAARQ"]
[Sun Mar 29 05:22:35.189275 2026] [:error] [pid 32359:tid 32382] [client 130.131.193.97:12264] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "achGmwMb8G3UzfQP3WjQBQAAANU"]
[Sun Mar 29 05:22:35.661500 2026] [:error] [pid 32255:tid 32302] [client 130.131.193.97:12125] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "achGm2nfn-AtRoMbquxJgQAAAEs"]
[Sun Mar 29 05:22:36.179123 2026] [:error] [pid 12910:tid 12926] [client 130.131.193.97:12096] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "achGnCnoNBcZwnBvsMNJvwAAAU4"]
[Sun Mar 29 05:22:36.815741 2026] [:error] [pid 1524:tid 1532] [client 130.131.193.97:12215] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx78.php"] [unique_id "achGnFoaWSl2asqQCh8VjQAAAQQ"]
[Sun Mar 29 05:22:37.257025 2026] [:error] [pid 12910:tid 12932] [client 130.131.193.97:12274] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx78.php"] [unique_id "achGnSnoNBcZwnBvsMNJwgAAAVQ"]
[Sun Mar 29 05:22:37.690139 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12267] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx78.php"] [unique_id "achGnSnoNBcZwnBvsMNJxAAAAVg"]
[Sun Mar 29 05:22:38.173801 2026] [:error] [pid 12910:tid 12912] [client 130.131.193.97:12183] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx78.php"] [unique_id "achGninoNBcZwnBvsMNJyQAAAUA"]
[Sun Mar 29 05:22:38.609655 2026] [:error] [pid 12910:tid 12929] [client 130.131.193.97:12077] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "achGninoNBcZwnBvsMNJ0QAAAVE"]
[Sun Mar 29 05:22:39.013168 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12210] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "achGnynoNBcZwnBvsMNJ1AAAAVg"]
[Sun Mar 29 05:22:39.478125 2026] [:error] [pid 12910:tid 12914] [client 130.131.193.97:12050] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "achGnynoNBcZwnBvsMNJ2wAAAUI"]
[Sun Mar 29 05:22:39.875043 2026] [:error] [pid 32257:tid 32340] [client 130.131.193.97:12205] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "achGnyE3TArOFrUtgWoxUQAAAJY"]
[Sun Mar 29 05:22:40.282346 2026] [:error] [pid 1524:tid 1553] [client 130.131.193.97:12206] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "achGoFoaWSl2asqQCh8VjwAAARU"]
[Sun Mar 29 05:22:40.755758 2026] [:error] [pid 32257:tid 32322] [client 130.131.193.97:12226] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "achGoCE3TArOFrUtgWoxVAAAAIQ"]
[Sun Mar 29 05:22:41.374109 2026] [:error] [pid 12910:tid 12925] [client 130.131.193.97:12103] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "achGoSnoNBcZwnBvsMNJ6wAAAU0"]
[Sun Mar 29 05:22:41.756416 2026] [:error] [pid 12910:tid 12930] [client 130.131.193.97:12142] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "achGoSnoNBcZwnBvsMNJ8AAAAVI"]
[Sun Mar 29 05:22:42.128577 2026] [:error] [pid 32257:tid 32320] [client 130.131.193.97:12244] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "achGoiE3TArOFrUtgWoxWgAAAII"]
[Sun Mar 29 05:22:42.503898 2026] [:error] [pid 12910:tid 12933] [client 130.131.193.97:12228] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "achGoinoNBcZwnBvsMNJ9wAAAVU"]
[Sun Mar 29 05:22:42.879630 2026] [:error] [pid 32257:tid 32324] [client 130.131.193.97:12108] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "achGoiE3TArOFrUtgWoxWwAAAIY"]
[Sun Mar 29 05:22:43.256847 2026] [:error] [pid 12910:tid 12913] [client 130.131.193.97:12131] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "achGoynoNBcZwnBvsMNJ_gAAAUE"]
[Sun Mar 29 05:22:43.632502 2026] [:error] [pid 32255:tid 32297] [client 130.131.193.97:12191] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "achGo2nfn-AtRoMbquxJjAAAAEY"]
[Sun Mar 29 05:22:44.005076 2026] [:error] [pid 32254:tid 32277] [client 130.131.193.97:12192] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "achGpKug2IHuyGgCTn8QJwAAAA0"]
[Sun Mar 29 05:22:44.388656 2026] [:error] [pid 12910:tid 12932] [client 130.131.193.97:12158] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "achGpCnoNBcZwnBvsMNKAwAAAVQ"]
[Sun Mar 29 05:22:44.773943 2026] [:error] [pid 1524:tid 1542] [client 130.131.193.97:12043] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "achGpFoaWSl2asqQCh8VngAAAQs"]
[Sun Mar 29 05:22:45.151843 2026] [:error] [pid 32359:tid 32370] [client 130.131.193.97:12101] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "achGpQMb8G3UzfQP3WjQDgAAAMk"]
[Sun Mar 29 05:22:45.530929 2026] [:error] [pid 32359:tid 32381] [client 130.131.193.97:12088] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "achGpQMb8G3UzfQP3WjQDwAAANQ"]
[Sun Mar 29 05:22:45.914963 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12057] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "achGpSnoNBcZwnBvsMNKCQAAAVg"]
[Sun Mar 29 05:22:46.297731 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:12260] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "achGpinoNBcZwnBvsMNKCwAAAVM"]
[Sun Mar 29 05:22:46.680609 2026] [:error] [pid 32254:tid 32270] [client 130.131.193.97:12181] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "achGpqug2IHuyGgCTn8QLAAAAAY"]
[Sun Mar 29 05:22:47.071868 2026] [:error] [pid 32254:tid 32268] [client 130.131.193.97:12034] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "achGp6ug2IHuyGgCTn8QLQAAAAQ"]
[Sun Mar 29 05:22:47.452921 2026] [:error] [pid 32359:tid 32364] [client 130.131.193.97:12196] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "achGpwMb8G3UzfQP3WjQFAAAAMM"]
[Sun Mar 29 05:22:47.827314 2026] [:error] [pid 1524:tid 1553] [client 130.131.193.97:12144] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "achGp1oaWSl2asqQCh8VowAAARU"]
[Sun Mar 29 05:22:48.208576 2026] [:error] [pid 12910:tid 12921] [client 130.131.193.97:12250] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "achGqCnoNBcZwnBvsMNKFAAAAUk"]
[Sun Mar 29 05:22:48.582867 2026] [:error] [pid 32359:tid 32369] [client 130.131.193.97:12221] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "achGqAMb8G3UzfQP3WjQFwAAAMg"]
[Sun Mar 29 05:22:48.973445 2026] [:error] [pid 12910:tid 12913] [client 130.131.193.97:12157] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "achGqCnoNBcZwnBvsMNKGgAAAUE"]
[Sun Mar 29 05:22:49.345559 2026] [:error] [pid 1524:tid 1531] [client 130.131.193.97:12265] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "achGqVoaWSl2asqQCh8VpgAAAQM"]
[Sun Mar 29 05:22:49.763768 2026] [:error] [pid 12910:tid 12934] [client 130.131.193.97:12153] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "achGqSnoNBcZwnBvsMNKIAAAAVY"]
[Sun Mar 29 05:22:50.141916 2026] [:error] [pid 12910:tid 12922] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Sun Mar 29 05:22:50.524324 2026] [:error] [pid 12910:tid 12915] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Sun Mar 29 05:22:50.714337 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Sun Mar 29 05:22:50.904250 2026] [:error] [pid 12910:tid 12920] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/amp.php
[Sun Mar 29 05:22:51.094776 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/ws75.php
[Sun Mar 29 05:22:51.285358 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Mar 29 05:22:51.475353 2026] [:error] [pid 12910:tid 12929] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/maul.php
[Sun Mar 29 05:22:51.665727 2026] [:error] [pid 12910:tid 12919] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/lowpr.php
[Sun Mar 29 05:22:51.855500 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sun Mar 29 05:22:52.046314 2026] [:error] [pid 12910:tid 12914] [client 130.131.193.97:12276] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Sun Mar 29 05:22:52.235375 2026] [:error] [pid 12910:tid 12915] [client 130.131.193.97:12276] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "achGrCnoNBcZwnBvsMNKPAAAAUM"]
[Sun Mar 29 05:22:52.704744 2026] [:error] [pid 1524:tid 1528] [client 130.131.193.97:12204] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "achGrFoaWSl2asqQCh8VqwAAAQE"]
[Sun Mar 29 05:22:53.096882 2026] [:error] [pid 12910:tid 12916] [client 130.131.193.97:12044] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "achGrSnoNBcZwnBvsMNKRAAAAUQ"]
[Sun Mar 29 05:22:53.513334 2026] [:error] [pid 1524:tid 1543] [client 130.131.193.97:12143] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "achGrVoaWSl2asqQCh8VrQAAAQw"]
[Sun Mar 29 05:22:53.896505 2026] [:error] [pid 1524:tid 1549] [client 130.131.193.97:12240] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "achGrVoaWSl2asqQCh8VsAAAARI"]
[Sun Mar 29 05:22:54.295893 2026] [:error] [pid 1524:tid 1554] [client 130.131.193.97:12154] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "achGrloaWSl2asqQCh8VtAAAARY"]
[Sun Mar 29 05:22:54.712411 2026] [:error] [pid 32257:tid 32329] [client 130.131.193.97:12036] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "achGriE3TArOFrUtgWoxfQAAAIs"]
[Sun Mar 29 05:22:55.133059 2026] [:error] [pid 32257:tid 32327] [client 130.131.193.97:11975] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "achGryE3TArOFrUtgWoxfwAAAIk"]
[Sun Mar 29 05:22:55.559021 2026] [:error] [pid 1524:tid 1541] [client 130.131.193.97:12152] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "achGr1oaWSl2asqQCh8VvAAAAQo"]
[Sun Mar 29 05:22:55.982639 2026] [:error] [pid 1524:tid 1543] [client 130.131.193.97:12233] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "achGr1oaWSl2asqQCh8VvwAAAQw"]
[Sun Mar 29 05:22:56.427124 2026] [:error] [pid 32359:tid 32370] [client 130.131.193.97:12258] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "achGsAMb8G3UzfQP3WjQIwAAAMk"]
[Sun Mar 29 05:22:56.844136 2026] [:error] [pid 32359:tid 32381] [client 130.131.193.97:12106] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "achGsAMb8G3UzfQP3WjQJAAAANQ"]
[Sun Mar 29 05:22:57.275919 2026] [:error] [pid 1524:tid 1536] [client 130.131.193.97:12151] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "achGsVoaWSl2asqQCh8VxgAAAQc"]
[Sun Mar 29 05:22:57.754789 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:12258] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "achGsSnoNBcZwnBvsMNKawAAAUY"]
[Sun Mar 29 05:22:58.268586 2026] [:error] [pid 1524:tid 1548] [client 130.131.193.97:12109] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "achGsloaWSl2asqQCh8VywAAARE"]
[Sun Mar 29 05:22:58.672770 2026] [:error] [pid 12910:tid 12924] [client 130.131.193.97:12041] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hehe.php"] [unique_id "achGsinoNBcZwnBvsMNKcgAAAUw"]
[Sun Mar 29 05:22:59.167327 2026] [:error] [pid 12910:tid 12935] [client 130.131.193.97:12188] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "achGsynoNBcZwnBvsMNKeAAAAVc"]
[Sun Mar 29 05:22:59.638322 2026] [:error] [pid 1524:tid 1530] [client 130.131.193.97:12124] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "achGs1oaWSl2asqQCh8VzwAAAQI"]
[Sun Mar 29 05:23:00.098843 2026] [:error] [pid 1524:tid 1555] [client 130.131.193.97:12117] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "achGtFoaWSl2asqQCh8V0gAAARc"]
[Sun Mar 29 05:23:00.529645 2026] [:error] [pid 32257:tid 32331] [client 130.131.193.97:12185] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "achGtCE3TArOFrUtgWoxiwAAAI0"]
[Sun Mar 29 05:23:00.947600 2026] [:error] [pid 12910:tid 12921] [client 130.131.193.97:12052] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ne2026.php"] [unique_id "achGtCnoNBcZwnBvsMNKiQAAAUk"]
[Sun Mar 29 05:23:01.408698 2026] [:error] [pid 32257:tid 32335] [client 130.131.193.97:12141] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ne2026.php"] [unique_id "achGtSE3TArOFrUtgWoxjAAAAJE"]
[Sun Mar 29 05:23:01.885712 2026] [:error] [pid 32257:tid 32323] [client 130.131.193.97:12138] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ne2026.php"] [unique_id "achGtSE3TArOFrUtgWoxjgAAAIU"]
[Sun Mar 29 05:23:02.302849 2026] [:error] [pid 12910:tid 12934] [client 130.131.193.97:12148] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ne2026.php"] [unique_id "achGtinoNBcZwnBvsMNKnwAAAVY"]
[Sun Mar 29 05:23:02.816478 2026] [:error] [pid 32257:tid 32320] [client 130.131.193.97:12118] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws73.php"] [unique_id "achGtiE3TArOFrUtgWoxjwAAAII"]
[Sun Mar 29 05:23:03.380759 2026] [:error] [pid 32257:tid 32329] [client 130.131.193.97:12035] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws73.php"] [unique_id "achGtyE3TArOFrUtgWoxkgAAAIs"]
[Sun Mar 29 05:23:03.864957 2026] [:error] [pid 32257:tid 32330] [client 130.131.193.97:12214] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws73.php"] [unique_id "achGtyE3TArOFrUtgWoxlgAAAIw"]
[Sun Mar 29 05:23:04.305506 2026] [:error] [pid 32257:tid 32341] [client 130.131.193.97:12140] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws73.php"] [unique_id "achGuCE3TArOFrUtgWoxnAAAAJc"]
[Sun Mar 29 05:23:04.689177 2026] [:error] [pid 12910:tid 12924] [client 130.131.193.97:12150] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "achGuCnoNBcZwnBvsMNKtwAAAUw"]
[Sun Mar 29 05:23:05.151735 2026] [:error] [pid 32255:tid 32301] [client 130.131.193.97:12058] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "achGuWnfn-AtRoMbquxJtAAAAEo"]
[Sun Mar 29 05:23:05.555299 2026] [:error] [pid 32257:tid 32320] [client 130.131.193.97:12139] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "achGuSE3TArOFrUtgWoxnwAAAII"]
[Sun Mar 29 05:23:05.973744 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:12120] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "achGuSnoNBcZwnBvsMNKwgAAAVM"]
[Sun Mar 29 05:23:06.446984 2026] [:error] [pid 32254:tid 32281] [client 130.131.193.97:11988] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "achGuqug2IHuyGgCTn8QOwAAABE"]
[Sun Mar 29 05:23:06.872082 2026] [:error] [pid 32257:tid 32325] [client 130.131.193.97:12060] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "achGuiE3TArOFrUtgWoxowAAAIc"]
[Sun Mar 29 05:23:07.323251 2026] [:error] [pid 32254:tid 32272] [client 130.131.193.97:11987] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "achGu6ug2IHuyGgCTn8QPAAAAAg"]
[Sun Mar 29 05:23:07.760324 2026] [:error] [pid 1524:tid 1537] [client 130.131.193.97:12069] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "achGu1oaWSl2asqQCh8V2AAAAQg"]
[Sun Mar 29 05:23:08.247968 2026] [:error] [pid 12910:tid 12932] [client 130.131.193.97:12049] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "achGvCnoNBcZwnBvsMNKygAAAVQ"]
[Sun Mar 29 05:23:08.701998 2026] [:error] [pid 32359:tid 32363] [client 130.131.193.97:12105] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "achGvAMb8G3UzfQP3WjQLgAAAMI"]
[Sun Mar 29 05:23:09.092825 2026] [:error] [pid 32359:tid 32361] [client 130.131.193.97:12116] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "achGvQMb8G3UzfQP3WjQLwAAAMA"]
[Sun Mar 29 05:23:09.481142 2026] [:error] [pid 12910:tid 12913] [client 130.131.193.97:12091] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "achGvSnoNBcZwnBvsMNKzgAAAUE"]
[Sun Mar 29 05:23:09.981015 2026] [:error] [pid 1524:tid 1546] [client 130.131.193.97:12156] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "achGvVoaWSl2asqQCh8V4AAAAQ8"]
[Sun Mar 29 05:23:10.799818 2026] [:error] [pid 32255:tid 32293] [client 130.131.193.97:12076] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "achGvmnfn-AtRoMbquxJvQAAAEI"]
[Sun Mar 29 05:23:11.390347 2026] [:error] [pid 32255:tid 32294] [client 130.131.193.97:12078] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "achGv2nfn-AtRoMbquxJvgAAAEM"]
[Sun Mar 29 05:23:11.821389 2026] [:error] [pid 12910:tid 12934] [client 130.131.193.97:12085] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "achGvynoNBcZwnBvsMNK0wAAAVY"]
[Sun Mar 29 05:23:12.346379 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12061] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "achGwCnoNBcZwnBvsMNK1wAAAVg"]
[Sun Mar 29 05:23:12.805849 2026] [:error] [pid 32359:tid 32362] [client 130.131.193.97:12073] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "achGwAMb8G3UzfQP3WjQNAAAAME"]
[Sun Mar 29 05:23:13.198578 2026] [:error] [pid 32257:tid 32338] [client 130.131.193.97:11980] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "achGwSE3TArOFrUtgWoxqgAAAJQ"]
[Sun Mar 29 05:23:13.639793 2026] [:error] [pid 32257:tid 32326] [client 130.131.193.97:12072] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "achGwSE3TArOFrUtgWoxqwAAAIg"]
[Sun Mar 29 05:23:14.056743 2026] [:error] [pid 32359:tid 32364] [client 130.131.193.97:12062] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "achGwgMb8G3UzfQP3WjQNQAAAMM"]
[Sun Mar 29 05:23:14.458182 2026] [:error] [pid 12910:tid 12920] [client 130.131.193.97:12114] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "achGwinoNBcZwnBvsMNK3AAAAUg"]
[Sun Mar 29 05:23:14.882313 2026] [:error] [pid 12910:tid 12935] [client 130.131.193.97:12095] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "achGwinoNBcZwnBvsMNK3gAAAVc"]
[Sun Mar 29 05:23:15.305415 2026] [:error] [pid 1524:tid 1553] [client 130.131.193.97:11994] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "achGw1oaWSl2asqQCh8V5AAAARU"]
[Sun Mar 29 05:23:15.781609 2026] [:error] [pid 32359:tid 32384] [client 130.131.193.97:12207] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5e0a.php"] [unique_id "achGwwMb8G3UzfQP3WjQOgAAANc"]
[Sun Mar 29 05:23:16.244378 2026] [:error] [pid 32359:tid 32372] [client 130.131.193.97:12065] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5e0a.php"] [unique_id "achGxAMb8G3UzfQP3WjQPQAAAMs"]
[Sun Mar 29 05:23:16.716943 2026] [:error] [pid 32359:tid 32371] [client 130.131.193.97:12238] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5e0a.php"] [unique_id "achGxAMb8G3UzfQP3WjQPgAAAMo"]
[Sun Mar 29 05:23:17.186209 2026] [:error] [pid 1524:tid 1527] [client 130.131.193.97:12082] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5e0a.php"] [unique_id "achGxVoaWSl2asqQCh8V6gAAAQA"]
[Sun Mar 29 05:23:17.706516 2026] [:error] [pid 32257:tid 32319] [client 130.131.193.97:12012] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "achGxSE3TArOFrUtgWoxtAAAAIE"]
[Sun Mar 29 05:23:18.279545 2026] [:error] [pid 32257:tid 32338] [client 130.131.193.97:12056] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "achGxiE3TArOFrUtgWoxuAAAAJQ"]
[Sun Mar 29 05:23:18.892065 2026] [:error] [pid 12910:tid 12916] [client 130.131.193.97:12149] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "achGxinoNBcZwnBvsMNK5AAAAUQ"]
[Sun Mar 29 05:23:19.451083 2026] [:error] [pid 32254:tid 32277] [client 130.131.193.97:12236] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "achGx6ug2IHuyGgCTn8QRgAAAA0"]
[Sun Mar 29 05:23:19.992922 2026] [:error] [pid 32254:tid 32282] [client 130.131.193.97:12054] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "achGx6ug2IHuyGgCTn8QRwAAABI"]
[Sun Mar 29 05:23:20.473932 2026] [:error] [pid 32254:tid 32281] [client 130.131.193.97:11974] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "achGyKug2IHuyGgCTn8QSgAAABE"]
[Sun Mar 29 05:23:20.882057 2026] [:error] [pid 1524:tid 1549] [client 130.131.193.97:12107] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "achGyFoaWSl2asqQCh8V8QAAARI"]
[Sun Mar 29 05:23:21.335848 2026] [:error] [pid 32257:tid 32326] [client 130.131.193.97:12070] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "achGySE3TArOFrUtgWoxxQAAAIg"]
[Sun Mar 29 05:23:21.741547 2026] [:error] [pid 32254:tid 32273] [client 130.131.193.97:12231] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "achGyaug2IHuyGgCTn8QTwAAAAk"]
[Sun Mar 29 05:23:22.182710 2026] [:error] [pid 1524:tid 1538] [client 130.131.193.97:12059] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "achGyloaWSl2asqQCh8V8wAAAQk"]
[Sun Mar 29 05:23:22.594155 2026] [:error] [pid 32257:tid 32320] [client 130.131.193.97:11978] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "achGyiE3TArOFrUtgWoxxgAAAII"]
[Sun Mar 29 05:23:22.995615 2026] [:error] [pid 32255:tid 32303] [client 130.131.193.97:12066] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55b76.php"] [unique_id "achGymnfn-AtRoMbquxJxQAAAEw"]
[Sun Mar 29 05:23:23.448204 2026] [:error] [pid 1524:tid 1556] [client 130.131.193.97:11985] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "achGy1oaWSl2asqQCh8V-wAAARg"]
[Sun Mar 29 05:23:23.830563 2026] [:error] [pid 32255:tid 32298] [client 130.131.193.97:12032] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "achGy2nfn-AtRoMbquxJxwAAAEc"]
[Sun Mar 29 05:23:24.228901 2026] [:error] [pid 32254:tid 32264] [client 130.131.193.97:12220] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "achGzKug2IHuyGgCTn8QVAAAAAA"]
[Sun Mar 29 05:23:24.620611 2026] [:error] [pid 32257:tid 32327] [client 130.131.193.97:12145] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "achGzCE3TArOFrUtgWoxyQAAAIk"]
[Sun Mar 29 05:23:25.007442 2026] [:error] [pid 32257:tid 32341] [client 130.131.193.97:11996] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "achGzSE3TArOFrUtgWoxzAAAAJc"]
[Sun Mar 29 05:23:25.402785 2026] [:error] [pid 32257:tid 32319] [client 130.131.193.97:12029] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "achGzSE3TArOFrUtgWoxzQAAAIE"]
[Sun Mar 29 05:23:25.815056 2026] [:error] [pid 32359:tid 32366] [client 130.131.193.97:12246] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "achGzQMb8G3UzfQP3WjQSQAAAMU"]
[Sun Mar 29 05:23:26.190545 2026] [:error] [pid 32254:tid 32277] [client 130.131.193.97:12067] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "achGzqug2IHuyGgCTn8QVgAAAA0"]
[Sun Mar 29 05:23:26.576449 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:12055] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "achGzinoNBcZwnBvsMNK6wAAAVM"]
[Sun Mar 29 05:23:26.952097 2026] [:error] [pid 12910:tid 12914] [client 130.131.193.97:11992] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "achGzinoNBcZwnBvsMNK7QAAAUI"]
[Sun Mar 29 05:23:27.330499 2026] [:error] [pid 32257:tid 32326] [client 130.131.193.97:12086] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "achGzyE3TArOFrUtgWoxzwAAAIg"]
[Sun Mar 29 05:23:27.797588 2026] [:error] [pid 32257:tid 32320] [client 130.131.193.97:12104] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "achGzyE3TArOFrUtgWox0QAAAII"]
[Sun Mar 29 05:23:28.176615 2026] [:error] [pid 1524:tid 1538] [client 130.131.193.97:12279] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "achG0FoaWSl2asqQCh8WAwAAAQk"]
[Sun Mar 29 05:23:28.589688 2026] [:error] [pid 32359:tid 32370] [client 130.131.193.97:12208] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "achG0AMb8G3UzfQP3WjQUAAAAMk"]
[Sun Mar 29 05:23:28.992565 2026] [:error] [pid 1524:tid 1533] [client 130.131.193.97:12040] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "achG0FoaWSl2asqQCh8WBAAAAQU"]
[Sun Mar 29 05:23:29.386194 2026] [:error] [pid 32255:tid 32301] [client 130.131.193.97:12123] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "achG0Wnfn-AtRoMbquxJzwAAAEo"]
[Sun Mar 29 05:23:29.777295 2026] [:error] [pid 32359:tid 32374] [client 130.131.193.97:12080] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/drhunthq.php"] [unique_id "achG0QMb8G3UzfQP3WjQVwAAAM0"]
[Sun Mar 29 05:23:30.198551 2026] [:error] [pid 32257:tid 32342] [client 130.131.193.97:11998] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/drhunthq.php"] [unique_id "achG0iE3TArOFrUtgWox2AAAAJg"]
[Sun Mar 29 05:23:30.646951 2026] [:error] [pid 32257:tid 32319] [client 130.131.193.97:11908] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/drhunthq.php"] [unique_id "achG0iE3TArOFrUtgWox2wAAAIE"]
[Sun Mar 29 05:23:31.038658 2026] [:error] [pid 32359:tid 32376] [client 130.131.193.97:12051] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/drhunthq.php"] [unique_id "achG0wMb8G3UzfQP3WjQXwAAAM8"]
[Sun Mar 29 05:23:31.436215 2026] [:error] [pid 12910:tid 12935] [client 130.131.193.97:12039] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "achG0ynoNBcZwnBvsMNK9gAAAVc"]
[Sun Mar 29 05:23:31.840452 2026] [:error] [pid 1524:tid 1537] [client 130.131.193.97:12068] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "achG01oaWSl2asqQCh8WBgAAAQg"]
[Sun Mar 29 05:23:32.263284 2026] [:error] [pid 1524:tid 1541] [client 130.131.193.97:12042] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "achG1FoaWSl2asqQCh8WBwAAAQo"]
[Sun Mar 29 05:23:32.679314 2026] [:error] [pid 1524:tid 1543] [client 130.131.193.97:12071] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/file.php"] [unique_id "achG1FoaWSl2asqQCh8WCQAAAQw"]
[Sun Mar 29 05:23:33.070577 2026] [:error] [pid 1524:tid 1528] [client 130.131.193.97:12031] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "achG1VoaWSl2asqQCh8WDAAAAQE"]
[Sun Mar 29 05:23:33.478158 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:12115] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "achG1SnoNBcZwnBvsMNK_AAAAVg"]
[Sun Mar 29 05:23:33.874576 2026] [:error] [pid 12910:tid 12926] [client 130.131.193.97:12037] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "achG1SnoNBcZwnBvsMNK_QAAAU4"]
[Sun Mar 29 05:23:34.251064 2026] [:error] [pid 32257:tid 32341] [client 130.131.193.97:12121] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxw.php"] [unique_id "achG1iE3TArOFrUtgWox5gAAAJc"]
[Sun Mar 29 05:23:34.685882 2026] [:error] [pid 1524:tid 1538] [client 130.131.193.97:11999] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "achG1loaWSl2asqQCh8WEAAAAQk"]
[Sun Mar 29 05:23:35.089077 2026] [:error] [pid 32257:tid 32323] [client 130.131.193.97:11971] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "achG1yE3TArOFrUtgWox6QAAAIU"]
[Sun Mar 29 05:23:35.514564 2026] [:error] [pid 1524:tid 1548] [client 130.131.193.97:12090] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "achG11oaWSl2asqQCh8WEgAAARE"]
[Sun Mar 29 05:23:35.898025 2026] [:error] [pid 1524:tid 1537] [client 130.131.193.97:12134] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "achG11oaWSl2asqQCh8WFAAAAQg"]
[Sun Mar 29 05:23:36.289547 2026] [:error] [pid 32257:tid 32325] [client 130.131.193.97:12084] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "achG2CE3TArOFrUtgWox7wAAAIc"]
[Sun Mar 29 05:23:36.731987 2026] [:error] [pid 32257:tid 32319] [client 130.131.193.97:12236] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "achG2CE3TArOFrUtgWox8QAAAIE"]
[Sun Mar 29 05:23:37.128868 2026] [:error] [pid 32255:tid 32292] [client 130.131.193.97:12038] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "achG2Wnfn-AtRoMbquxJ4AAAAEE"]
[Sun Mar 29 05:23:37.544722 2026] [:error] [pid 1524:tid 1554] [client 130.131.193.97:12223] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "achG2VoaWSl2asqQCh8WHwAAARY"]
[Sun Mar 29 05:23:37.918577 2026] [:error] [pid 32359:tid 32369] [client 130.131.193.97:12146] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "achG2QMb8G3UzfQP3WjQZQAAAMg"]
[Sun Mar 29 05:23:38.324808 2026] [:error] [pid 32359:tid 32384] [client 130.131.193.97:12203] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "achG2gMb8G3UzfQP3WjQZwAAANc"]
[Sun Mar 29 05:23:38.703592 2026] [:error] [pid 32254:tid 32276] [client 130.131.193.97:11976] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "achG2qug2IHuyGgCTn8QWwAAAAw"]
[Sun Mar 29 05:23:39.103297 2026] [:error] [pid 32255:tid 32301] [client 130.131.193.97:11938] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "achG22nfn-AtRoMbquxJ4wAAAEo"]
[Sun Mar 29 05:23:39.505070 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:12079] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "achG2ynoNBcZwnBvsMNLDQAAAUY"]
[Sun Mar 29 05:23:39.880605 2026] [:error] [pid 32254:tid 32279] [client 130.131.193.97:12008] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "achG26ug2IHuyGgCTn8QXQAAAA8"]
[Sun Mar 29 05:23:40.259635 2026] [:error] [pid 32257:tid 32331] [client 130.131.193.97:12001] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "achG3CE3TArOFrUtgWox9wAAAI0"]
[Sun Mar 29 05:23:40.674635 2026] [:error] [pid 32255:tid 32296] [client 130.131.193.97:12219] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "achG3Gnfn-AtRoMbquxJ5QAAAEU"]
[Sun Mar 29 05:23:41.050387 2026] [:error] [pid 32255:tid 32315] [client 130.131.193.97:11977] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "achG3Wnfn-AtRoMbquxJ5wAAAFg"]
[Sun Mar 29 05:23:41.447805 2026] [:error] [pid 12910:tid 12921] [client 130.131.193.97:12010] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "achG3SnoNBcZwnBvsMNLGwAAAUk"]
[Sun Mar 29 05:23:41.821485 2026] [:error] [pid 12910:tid 12930] [client 130.131.193.97:12051] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "achG3SnoNBcZwnBvsMNLHQAAAVI"]
[Sun Mar 29 05:23:42.196661 2026] [:error] [pid 1524:tid 1537] [client 130.131.193.97:12009] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "achG3loaWSl2asqQCh8WIwAAAQg"]
[Sun Mar 29 05:23:42.578626 2026] [:error] [pid 32257:tid 32325] [client 130.131.193.97:12133] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "achG3iE3TArOFrUtgWox-gAAAIc"]
[Sun Mar 29 05:23:42.970097 2026] [:error] [pid 12910:tid 12912] [client 130.131.193.97:11932] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "achG3inoNBcZwnBvsMNLIwAAAUA"]
[Sun Mar 29 05:23:43.348566 2026] [:error] [pid 12910:tid 12913] [client 130.131.193.97:11969] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "achG3ynoNBcZwnBvsMNLJAAAAUE"]
[Sun Mar 29 05:23:43.766931 2026] [:error] [pid 32257:tid 32330] [client 130.131.193.97:11918] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "achG3yE3TArOFrUtgWoyAQAAAIw"]
[Sun Mar 29 05:23:44.157442 2026] [:error] [pid 32257:tid 32338] [client 130.131.193.97:11997] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "achG4CE3TArOFrUtgWoyBAAAAJQ"]
[Sun Mar 29 05:23:44.577104 2026] [:error] [pid 32257:tid 32339] [client 130.131.193.97:12022] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "achG4CE3TArOFrUtgWoyCQAAAJU"]
[Sun Mar 29 05:23:45.066035 2026] [:error] [pid 12910:tid 12935] [client 130.131.193.97:11916] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "achG4SnoNBcZwnBvsMNLKgAAAVc"]
[Sun Mar 29 05:23:45.484667 2026] [:error] [pid 12910:tid 12912] [client 130.131.193.97:12016] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "achG4SnoNBcZwnBvsMNLLgAAAUA"]
[Sun Mar 29 05:23:46.093429 2026] [:error] [pid 32257:tid 32320] [client 130.131.193.97:12007] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "achG4iE3TArOFrUtgWoyFgAAAII"]
[Sun Mar 29 05:23:46.509810 2026] [:error] [pid 32254:tid 32271] [client 130.131.193.97:11904] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "achG4qug2IHuyGgCTn8QYgAAAAc"]
[Sun Mar 29 05:23:46.893299 2026] [:error] [pid 1524:tid 1536] [client 130.131.193.97:12241] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "achG4loaWSl2asqQCh8WKwAAAQc"]
[Sun Mar 29 05:23:47.303381 2026] [:error] [pid 32257:tid 32330] [client 130.131.193.97:12075] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "achG4yE3TArOFrUtgWoyHQAAAIw"]
[Sun Mar 29 05:23:47.704878 2026] [:error] [pid 1524:tid 1548] [client 130.131.193.97:12081] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "achG41oaWSl2asqQCh8WMgAAARE"]
[Sun Mar 29 05:23:48.139004 2026] [:error] [pid 1524:tid 1546] [client 130.131.193.97:12155] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "achG5FoaWSl2asqQCh8WNQAAAQ8"]
[Sun Mar 29 05:23:48.546047 2026] [:error] [pid 32255:tid 32311] [client 130.131.193.97:12053] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "achG5Gnfn-AtRoMbquxJ9AAAAFQ"]
[Sun Mar 29 05:23:49.080141 2026] [:error] [pid 32254:tid 32288] [client 130.131.193.97:12087] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "achG5aug2IHuyGgCTn8QagAAABg"]
[Sun Mar 29 05:23:49.460497 2026] [:error] [pid 32254:tid 32268] [client 130.131.193.97:12261] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clss.php"] [unique_id "achG5aug2IHuyGgCTn8QbAAAAAQ"]
[Sun Mar 29 05:23:49.842618 2026] [:error] [pid 32257:tid 32338] [client 130.131.193.97:11904] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clss.php"] [unique_id "achG5SE3TArOFrUtgWoyIAAAAJQ"]
[Sun Mar 29 05:23:50.234894 2026] [:error] [pid 1524:tid 1527] [client 130.131.193.97:12002] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clss.php"] [unique_id "achG5loaWSl2asqQCh8WOwAAAQA"]
[Sun Mar 29 05:23:50.618635 2026] [:error] [pid 1524:tid 1546] [client 130.131.193.97:12174] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clss.php"] [unique_id "achG5loaWSl2asqQCh8WPwAAAQ8"]
[Sun Mar 29 05:23:51.071244 2026] [:error] [pid 1524:tid 1542] [client 130.131.193.97:12137] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "achG51oaWSl2asqQCh8WRQAAAQs"]
[Sun Mar 29 05:23:51.491770 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12126] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "achG5ynoNBcZwnBvsMNLNgAAAUs"]
[Sun Mar 29 05:23:51.868489 2026] [:error] [pid 12910:tid 12934] [client 130.131.193.97:12064] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "achG5ynoNBcZwnBvsMNLPAAAAVY"]
[Sun Mar 29 05:23:52.446698 2026] [:error] [pid 1524:tid 1536] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Mar 29 05:23:52.638783 2026] [:error] [pid 1524:tid 1532] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Mar 29 05:23:52.828766 2026] [:error] [pid 1524:tid 1527] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Sun Mar 29 05:23:53.020306 2026] [:error] [pid 1524:tid 1533] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax.php
[Sun Mar 29 05:23:53.211497 2026] [:error] [pid 1524:tid 1549] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Sun Mar 29 05:23:53.593706 2026] [:error] [pid 1524:tid 1552] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sun Mar 29 05:23:53.786413 2026] [:error] [pid 1524:tid 1556] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Sun Mar 29 05:23:53.985906 2026] [:error] [pid 1524:tid 1537] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Sun Mar 29 05:23:54.178030 2026] [:error] [pid 1524:tid 1546] [client 130.131.193.97:12024] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sun Mar 29 05:23:54.365161 2026] [:error] [pid 1524:tid 1548] [client 130.131.193.97:12024] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "achG6loaWSl2asqQCh8WUwAAARE"]
[Sun Mar 29 05:23:54.794105 2026] [:error] [pid 32257:tid 32333] [client 130.131.193.97:12020] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "achG6iE3TArOFrUtgWoyMQAAAI8"]
[Sun Mar 29 05:23:55.242669 2026] [:error] [pid 12910:tid 12912] [client 130.131.193.97:11983] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "achG6ynoNBcZwnBvsMNLSQAAAUA"]
[Sun Mar 29 05:23:55.642851 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:12046] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "achG6ynoNBcZwnBvsMNLSgAAAVM"]
[Sun Mar 29 05:23:56.224718 2026] [:error] [pid 32254:tid 32268] [client 130.131.193.97:12028] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "achG7Kug2IHuyGgCTn8QfAAAAAQ"]
[Sun Mar 29 05:23:56.723085 2026] [:error] [pid 32257:tid 32325] [client 130.131.193.97:11981] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "achG7CE3TArOFrUtgWoyOAAAAIc"]
[Sun Mar 29 05:23:57.240613 2026] [:error] [pid 12910:tid 12915] [client 130.131.193.97:12025] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "achG7SnoNBcZwnBvsMNLTQAAAUM"]
[Sun Mar 29 05:23:57.673206 2026] [:error] [pid 32255:tid 32306] [client 130.131.193.97:12197] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "achG7Wnfn-AtRoMbquxKAgAAAE8"]
[Sun Mar 29 05:23:58.102190 2026] [:error] [pid 32257:tid 32341] [client 130.131.193.97:11972] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "achG7iE3TArOFrUtgWoyOQAAAJc"]
[Sun Mar 29 05:23:58.671540 2026] [:error] [pid 32254:tid 32269] [client 130.131.193.97:11906] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "achG7qug2IHuyGgCTn8QhAAAAAU"]
[Sun Mar 29 05:23:59.102431 2026] [:error] [pid 32255:tid 32301] [client 130.131.193.97:11968] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "achG72nfn-AtRoMbquxKBQAAAEo"]
[Sun Mar 29 05:23:59.803504 2026] [:error] [pid 12910:tid 12916] [client 130.131.193.97:12014] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "achG7ynoNBcZwnBvsMNLWwAAAUQ"]
[Sun Mar 29 05:24:00.270799 2026] [:error] [pid 12910:tid 12914] [client 130.131.193.97:11979] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "achG8CnoNBcZwnBvsMNLXQAAAUI"]
[Sun Mar 29 05:24:00.690218 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:11990] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "achG8CnoNBcZwnBvsMNLXwAAAUs"]
[Sun Mar 29 05:24:01.195156 2026] [:error] [pid 12910:tid 12912] [client 130.131.193.97:12030] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "achG8SnoNBcZwnBvsMNLYwAAAUA"]
[Sun Mar 29 05:24:01.657024 2026] [:error] [pid 12910:tid 12921] [client 130.131.193.97:11991] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "achG8SnoNBcZwnBvsMNLZgAAAUk"]
[Sun Mar 29 05:24:02.065989 2026] [:error] [pid 12910:tid 12919] [client 130.131.193.97:12011] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "achG8inoNBcZwnBvsMNLaQAAAUc"]
[Sun Mar 29 05:24:02.441440 2026] [:error] [pid 32257:tid 32333] [client 130.131.193.97:11931] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "achG8iE3TArOFrUtgWoyQwAAAI8"]
[Sun Mar 29 05:24:02.815327 2026] [:error] [pid 32359:tid 32373] [client 130.131.193.97:11964] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "achG8gMb8G3UzfQP3WjQcQAAAMw"]
[Sun Mar 29 05:24:03.196451 2026] [:error] [pid 12910:tid 12926] [client 130.131.193.97:11947] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "achG8ynoNBcZwnBvsMNLbgAAAU4"]
[Sun Mar 29 05:24:03.571357 2026] [:error] [pid 12910:tid 12927] [client 130.131.193.97:12074] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zc-104.php"] [unique_id "achG8ynoNBcZwnBvsMNLdAAAAU8"]
[Sun Mar 29 05:24:03.950778 2026] [:error] [pid 12910:tid 12920] [client 130.131.193.97:11923] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zc-104.php"] [unique_id "achG8ynoNBcZwnBvsMNLegAAAUg"]
[Sun Mar 29 05:24:04.384068 2026] [:error] [pid 32255:tid 32303] [client 130.131.193.97:12089] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zc-104.php"] [unique_id "achG9Gnfn-AtRoMbquxKEQAAAEw"]
[Sun Mar 29 05:24:04.787873 2026] [:error] [pid 32254:tid 32266] [client 130.131.193.97:11934] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zc-104.php"] [unique_id "achG9Kug2IHuyGgCTn8QiAAAAAI"]
[Sun Mar 29 05:24:05.224443 2026] [:error] [pid 32257:tid 32339] [client 130.131.193.97:12017] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "achG9SE3TArOFrUtgWoyTQAAAJU"]
[Sun Mar 29 05:24:05.645379 2026] [:error] [pid 32255:tid 32291] [client 130.131.193.97:12033] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "achG9Wnfn-AtRoMbquxKFQAAAEA"]
[Sun Mar 29 05:24:06.048218 2026] [:error] [pid 12910:tid 12912] [client 130.131.193.97:11970] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "achG9inoNBcZwnBvsMNLfwAAAUA"]
[Sun Mar 29 05:24:06.462359 2026] [:error] [pid 12910:tid 12919] [client 130.131.193.97:11905] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "achG9inoNBcZwnBvsMNLgQAAAUc"]
[Sun Mar 29 05:24:06.836966 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:12038] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "achG9inoNBcZwnBvsMNLiAAAAUs"]
[Sun Mar 29 05:24:07.230414 2026] [:error] [pid 1524:tid 1528] [client 130.131.193.97:11844] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "achG91oaWSl2asqQCh8WZQAAAQE"]
[Sun Mar 29 05:24:07.677901 2026] [:error] [pid 32359:tid 32371] [client 130.131.193.97:11982] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "achG9wMb8G3UzfQP3WjQdgAAAMo"]
[Sun Mar 29 05:24:08.057872 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:11915] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "achG-CnoNBcZwnBvsMNLjAAAAUY"]
[Sun Mar 29 05:24:08.524584 2026] [:error] [pid 32257:tid 32328] [client 130.131.193.97:11930] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "achG-CE3TArOFrUtgWoyWAAAAIo"]
[Sun Mar 29 05:24:08.909768 2026] [:error] [pid 32257:tid 32319] [client 130.131.193.97:11920] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "achG-CE3TArOFrUtgWoyXAAAAIE"]
[Sun Mar 29 05:24:09.297318 2026] [:error] [pid 32255:tid 32308] [client 130.131.193.97:11946] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "achG-Wnfn-AtRoMbquxKGwAAAFE"]
[Sun Mar 29 05:24:09.708788 2026] [:error] [pid 32255:tid 32315] [client 130.131.193.97:11940] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "achG-Wnfn-AtRoMbquxKHAAAAFg"]
[Sun Mar 29 05:24:10.140570 2026] [:error] [pid 12910:tid 12921] [client 130.131.193.97:12083] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "achG-inoNBcZwnBvsMNLjgAAAUk"]
[Sun Mar 29 05:24:10.626945 2026] [:error] [pid 32257:tid 32335] [client 130.131.193.97:11922] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "achG-iE3TArOFrUtgWoyYgAAAJE"]
[Sun Mar 29 05:24:11.011836 2026] [:error] [pid 32257:tid 32326] [client 130.131.193.97:11911] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "achG-yE3TArOFrUtgWoyZAAAAIg"]
[Sun Mar 29 05:24:11.419540 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:11951] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "achG-ynoNBcZwnBvsMNLkAAAAVg"]
[Sun Mar 29 05:24:11.822184 2026] [:error] [pid 1524:tid 1556] [client 130.131.193.97:11979] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "achG-1oaWSl2asqQCh8WcAAAARg"]
[Sun Mar 29 05:24:12.243448 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:11907] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "achG_CnoNBcZwnBvsMNLkQAAAVA"]
[Sun Mar 29 05:24:12.639741 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:11989] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "achG_CnoNBcZwnBvsMNLkgAAAVM"]
[Sun Mar 29 05:24:13.019634 2026] [:error] [pid 32257:tid 32336] [client 130.131.193.97:11958] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "achG_SE3TArOFrUtgWoyawAAAJI"]
[Sun Mar 29 05:24:13.413425 2026] [:error] [pid 32359:tid 32362] [client 130.131.193.97:11942] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bjfl.php"] [unique_id "achG_QMb8G3UzfQP3WjQfwAAAME"]
[Sun Mar 29 05:24:13.796502 2026] [:error] [pid 32359:tid 32369] [client 130.131.193.97:12018] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bjfl.php"] [unique_id "achG_QMb8G3UzfQP3WjQgQAAAMg"]
[Sun Mar 29 05:24:14.179960 2026] [:error] [pid 32255:tid 32293] [client 130.131.193.97:11912] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bjfl.php"] [unique_id "achG_mnfn-AtRoMbquxKJAAAAEI"]
[Sun Mar 29 05:24:14.578971 2026] [:error] [pid 32254:tid 32286] [client 130.131.193.97:11873] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bjfl.php"] [unique_id "achG_qug2IHuyGgCTn8QjQAAABY"]
[Sun Mar 29 05:24:14.990880 2026] [:error] [pid 12910:tid 12929] [client 130.131.193.97:12004] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/155.php"] [unique_id "achG_inoNBcZwnBvsMNLnAAAAVE"]
[Sun Mar 29 05:24:15.369058 2026] [:error] [pid 12910:tid 12913] [client 130.131.193.97:12003] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/155.php"] [unique_id "achG_ynoNBcZwnBvsMNLnwAAAUE"]
[Sun Mar 29 05:24:15.787112 2026] [:error] [pid 32255:tid 32299] [client 130.131.193.97:11955] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/155.php"] [unique_id "achG_2nfn-AtRoMbquxKJQAAAEg"]
[Sun Mar 29 05:24:16.246295 2026] [:error] [pid 1524:tid 1537] [client 130.131.193.97:11888] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/155.php"] [unique_id "achHAFoaWSl2asqQCh8WdAAAAQg"]
[Sun Mar 29 05:24:16.666760 2026] [:error] [pid 12910:tid 12915] [client 130.131.193.97:11846] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rzki.php"] [unique_id "achHACnoNBcZwnBvsMNLpQAAAUM"]
[Sun Mar 29 05:24:17.052582 2026] [:error] [pid 12910:tid 12912] [client 130.131.193.97:11967] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rzki.php"] [unique_id "achHASnoNBcZwnBvsMNLqAAAAUA"]
[Sun Mar 29 05:24:17.426186 2026] [:error] [pid 32359:tid 32381] [client 130.131.193.97:11961] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rzki.php"] [unique_id "achHAQMb8G3UzfQP3WjQiAAAANQ"]
[Sun Mar 29 05:24:17.803169 2026] [:error] [pid 32257:tid 32333] [client 130.131.193.97:11928] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rzki.php"] [unique_id "achHASE3TArOFrUtgWoybAAAAI8"]
[Sun Mar 29 05:24:18.175791 2026] [:error] [pid 12910:tid 12922] [client 130.131.193.97:11925] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "achHAinoNBcZwnBvsMNLqgAAAUo"]
[Sun Mar 29 05:24:18.549077 2026] [:error] [pid 1524:tid 1543] [client 130.131.193.97:12006] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "achHAloaWSl2asqQCh8WeAAAAQw"]
[Sun Mar 29 05:24:18.934745 2026] [:error] [pid 32255:tid 32295] [client 130.131.193.97:12019] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "achHAmnfn-AtRoMbquxKJgAAAEQ"]
[Sun Mar 29 05:24:19.309346 2026] [:error] [pid 32255:tid 32306] [client 130.131.193.97:11926] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "achHA2nfn-AtRoMbquxKKgAAAE8"]
[Sun Mar 29 05:24:19.703565 2026] [:error] [pid 32257:tid 32327] [client 130.131.193.97:11874] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws49.php"] [unique_id "achHAyE3TArOFrUtgWoycwAAAIk"]
[Sun Mar 29 05:24:20.087611 2026] [:error] [pid 1524:tid 1536] [client 130.131.193.97:11919] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws49.php"] [unique_id "achHBFoaWSl2asqQCh8WegAAAQc"]
[Sun Mar 29 05:24:20.467805 2026] [:error] [pid 1524:tid 1554] [client 130.131.193.97:11929] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws49.php"] [unique_id "achHBFoaWSl2asqQCh8WfQAAARY"]
[Sun Mar 29 05:24:20.876934 2026] [:error] [pid 1524:tid 1538] [client 130.131.193.97:12026] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws49.php"] [unique_id "achHBFoaWSl2asqQCh8WfwAAAQk"]
[Sun Mar 29 05:24:21.251867 2026] [:error] [pid 32255:tid 32297] [client 130.131.193.97:11936] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "achHBWnfn-AtRoMbquxKLgAAAEY"]
[Sun Mar 29 05:24:21.642196 2026] [:error] [pid 1524:tid 1546] [client 130.131.193.97:11959] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "achHBVoaWSl2asqQCh8WgwAAAQ8"]
[Sun Mar 29 05:24:22.026327 2026] [:error] [pid 32257:tid 32329] [client 130.131.193.97:11973] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "achHBiE3TArOFrUtgWoydgAAAIs"]
[Sun Mar 29 05:24:22.411008 2026] [:error] [pid 32257:tid 32337] [client 130.131.193.97:11845] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "achHBiE3TArOFrUtgWoyegAAAJM"]
[Sun Mar 29 05:24:22.795940 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:11866] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "achHBinoNBcZwnBvsMNLrwAAAVM"]
[Sun Mar 29 05:24:23.189339 2026] [:error] [pid 12910:tid 12924] [client 130.131.193.97:11957] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "achHBynoNBcZwnBvsMNLsQAAAUw"]
[Sun Mar 29 05:24:23.564933 2026] [:error] [pid 32254:tid 32274] [client 130.131.193.97:12063] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "achHB6ug2IHuyGgCTn8QkgAAAAo"]
[Sun Mar 29 05:24:23.960004 2026] [:error] [pid 32254:tid 32269] [client 130.131.193.97:12005] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "achHB6ug2IHuyGgCTn8QkwAAAAU"]
[Sun Mar 29 05:24:24.334394 2026] [:error] [pid 32257:tid 32329] [client 130.131.193.97:11924] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vanda.php"] [unique_id "achHCCE3TArOFrUtgWoyhwAAAIs"]
[Sun Mar 29 05:24:24.710732 2026] [:error] [pid 12910:tid 12920] [client 130.131.193.97:12015] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vanda.php"] [unique_id "achHCCnoNBcZwnBvsMNLtgAAAUg"]
[Sun Mar 29 05:24:25.102741 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:12000] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vanda.php"] [unique_id "achHCSnoNBcZwnBvsMNLtwAAAUY"]
[Sun Mar 29 05:24:25.487605 2026] [:error] [pid 32254:tid 32264] [client 130.131.193.97:11944] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vanda.php"] [unique_id "achHCaug2IHuyGgCTn8QlAAAAAA"]
[Sun Mar 29 05:24:25.977642 2026] [:error] [pid 1524:tid 1554] [client 130.131.193.97:11848] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "achHCVoaWSl2asqQCh8WiQAAARY"]
[Sun Mar 29 05:24:26.351927 2026] [:error] [pid 32254:tid 32267] [client 130.131.193.97:12092] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "achHCqug2IHuyGgCTn8QlwAAAAM"]
[Sun Mar 29 05:24:26.732194 2026] [:error] [pid 32257:tid 32335] [client 130.131.193.97:11986] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "achHCiE3TArOFrUtgWoyiwAAAJE"]
[Sun Mar 29 05:24:27.113943 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:11896] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "achHCynoNBcZwnBvsMNLvQAAAVA"]
[Sun Mar 29 05:24:27.487242 2026] [:error] [pid 32257:tid 32318] [client 130.131.193.97:11782] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "achHCyE3TArOFrUtgWoyjwAAAIA"]
[Sun Mar 29 05:24:27.871891 2026] [:error] [pid 32255:tid 32298] [client 130.131.193.97:11900] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "achHC2nfn-AtRoMbquxKNQAAAEc"]
[Sun Mar 29 05:24:28.247357 2026] [:error] [pid 32359:tid 32379] [client 130.131.193.97:11909] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "achHDAMb8G3UzfQP3WjQiwAAANI"]
[Sun Mar 29 05:24:28.637066 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:11842] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "achHDCnoNBcZwnBvsMNLxQAAAUY"]
[Sun Mar 29 05:24:29.062987 2026] [:error] [pid 1524:tid 1538] [client 130.131.193.97:11914] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "achHDVoaWSl2asqQCh8WigAAAQk"]
[Sun Mar 29 05:24:29.451886 2026] [:error] [pid 32257:tid 32328] [client 130.131.193.97:12271] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "achHDSE3TArOFrUtgWoykQAAAIo"]
[Sun Mar 29 05:24:29.829061 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:11954] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "achHDSnoNBcZwnBvsMNLzAAAAVA"]
[Sun Mar 29 05:24:30.213515 2026] [:error] [pid 12910:tid 12934] [client 130.131.193.97:11910] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "achHDinoNBcZwnBvsMNLzgAAAVY"]
[Sun Mar 29 05:24:30.588939 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:11995] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "achHDinoNBcZwnBvsMNLzwAAAUs"]
[Sun Mar 29 05:24:30.987793 2026] [:error] [pid 32255:tid 32314] [client 130.131.193.97:11778] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "achHDmnfn-AtRoMbquxKNgAAAFc"]
[Sun Mar 29 05:24:31.364813 2026] [:error] [pid 32257:tid 32333] [client 130.131.193.97:11963] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "achHDyE3TArOFrUtgWoylgAAAI8"]
[Sun Mar 29 05:24:31.741882 2026] [:error] [pid 32257:tid 32335] [client 130.131.193.97:11953] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "achHDyE3TArOFrUtgWoymAAAAJE"]
[Sun Mar 29 05:24:32.187807 2026] [:error] [pid 1524:tid 1556] [client 130.131.193.97:11788] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "achHEFoaWSl2asqQCh8WjAAAARg"]
[Sun Mar 29 05:24:32.564703 2026] [:error] [pid 12910:tid 12935] [client 130.131.193.97:12093] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "achHECnoNBcZwnBvsMNL1gAAAVc"]
[Sun Mar 29 05:24:32.972720 2026] [:error] [pid 32257:tid 32329] [client 130.131.193.97:11956] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "achHECE3TArOFrUtgWoynQAAAIs"]
[Sun Mar 29 05:24:33.352279 2026] [:error] [pid 32254:tid 32287] [client 130.131.193.97:11793] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "achHEaug2IHuyGgCTn8QmAAAABc"]
[Sun Mar 29 05:24:33.728575 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:11954] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa21.php"] [unique_id "achHESnoNBcZwnBvsMNL2QAAAVg"]
[Sun Mar 29 05:24:34.122300 2026] [:error] [pid 1524:tid 1528] [client 130.131.193.97:12027] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa21.php"] [unique_id "achHEloaWSl2asqQCh8WjgAAAQE"]
[Sun Mar 29 05:24:34.537729 2026] [:error] [pid 1524:tid 1531] [client 130.131.193.97:11949] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa21.php"] [unique_id "achHEloaWSl2asqQCh8WkAAAAQM"]
[Sun Mar 29 05:24:34.973582 2026] [:error] [pid 32257:tid 32336] [client 130.131.193.97:11921] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa21.php"] [unique_id "achHEiE3TArOFrUtgWoyoQAAAJI"]
[Sun Mar 29 05:24:35.348924 2026] [:error] [pid 32254:tid 32279] [client 130.131.193.97:11948] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "achHE6ug2IHuyGgCTn8QmgAAAA8"]
[Sun Mar 29 05:24:35.742775 2026] [:error] [pid 32359:tid 32366] [client 130.131.193.97:12021] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "achHEwMb8G3UzfQP3WjQjwAAAMU"]
[Sun Mar 29 05:24:36.139182 2026] [:error] [pid 32257:tid 32335] [client 130.131.193.97:11886] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "achHFCE3TArOFrUtgWoypgAAAJE"]
[Sun Mar 29 05:24:36.517560 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:11854] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "achHFCnoNBcZwnBvsMNL3AAAAVA"]
[Sun Mar 29 05:24:36.890200 2026] [:error] [pid 12910:tid 12927] [client 130.131.193.97:12023] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "achHFCnoNBcZwnBvsMNL3QAAAU8"]
[Sun Mar 29 05:24:37.299990 2026] [:error] [pid 1524:tid 1532] [client 130.131.193.97:11841] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "achHFVoaWSl2asqQCh8WmgAAAQQ"]
[Sun Mar 29 05:24:37.673538 2026] [:error] [pid 32255:tid 32297] [client 130.131.193.97:11871] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "achHFWnfn-AtRoMbquxKOwAAAEY"]
[Sun Mar 29 05:24:38.069806 2026] [:error] [pid 32359:tid 32383] [client 130.131.193.97:11970] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "achHFgMb8G3UzfQP3WjQkgAAANY"]
[Sun Mar 29 05:24:38.443888 2026] [:error] [pid 1524:tid 1552] [client 130.131.193.97:11843] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bootstrap.php"] [unique_id "achHFloaWSl2asqQCh8WnQAAARQ"]
[Sun Mar 29 05:24:38.818829 2026] [:error] [pid 32254:tid 32270] [client 130.131.193.97:11941] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bootstrap.php"] [unique_id "achHFqug2IHuyGgCTn8QngAAAAY"]
[Sun Mar 29 05:24:39.302711 2026] [:error] [pid 1524:tid 1542] [client 130.131.193.97:11851] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bootstrap.php"] [unique_id "achHF1oaWSl2asqQCh8WpQAAAQs"]
[Sun Mar 29 05:24:39.857825 2026] [:error] [pid 32257:tid 32323] [client 130.131.193.97:11856] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bootstrap.php"] [unique_id "achHFyE3TArOFrUtgWoyqgAAAIU"]
[Sun Mar 29 05:24:40.733874 2026] [:error] [pid 32255:tid 32291] [client 130.131.193.97:11853] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/wp-blog.php"] [unique_id "achHGGnfn-AtRoMbquxKPwAAAEA"]
[Sun Mar 29 05:24:41.272848 2026] [:error] [pid 32254:tid 32275] [client 130.131.193.97:11857] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/wp-blog.php"] [unique_id "achHGaug2IHuyGgCTn8QoAAAAAs"]
[Sun Mar 29 05:24:42.075991 2026] [:error] [pid 32255:tid 32309] [client 130.131.193.97:12013] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/wp-blog.php"] [unique_id "achHGmnfn-AtRoMbquxKQwAAAFI"]
[Sun Mar 29 05:24:42.621851 2026] [:error] [pid 32255:tid 32292] [client 130.131.193.97:11859] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/wp-blog.php"] [unique_id "achHGmnfn-AtRoMbquxKRQAAAEE"]
[Sun Mar 29 05:24:43.212505 2026] [:error] [pid 12910:tid 12925] [client 130.131.193.97:11840] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "achHGynoNBcZwnBvsMNL5QAAAU0"]
[Sun Mar 29 05:24:43.640165 2026] [:error] [pid 32359:tid 32371] [client 130.131.193.97:11895] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "achHGwMb8G3UzfQP3WjQmwAAAMo"]
[Sun Mar 29 05:24:44.055865 2026] [:error] [pid 12910:tid 12918] [client 130.131.193.97:11872] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "achHHCnoNBcZwnBvsMNL6AAAAUY"]
[Sun Mar 29 05:24:44.447177 2026] [:error] [pid 12910:tid 12922] [client 130.131.193.97:12094] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "achHHCnoNBcZwnBvsMNL6wAAAUo"]
[Sun Mar 29 05:24:44.830790 2026] [:error] [pid 32257:tid 32330] [client 130.131.193.97:11849] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/csv.php"] [unique_id "achHHCE3TArOFrUtgWoyrwAAAIw"]
[Sun Mar 29 05:24:45.209378 2026] [:error] [pid 12910:tid 12936] [client 130.131.193.97:11867] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/csv.php"] [unique_id "achHHSnoNBcZwnBvsMNL7AAAAVg"]
[Sun Mar 29 05:24:45.603526 2026] [:error] [pid 32257:tid 32324] [client 130.131.193.97:11984] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/csv.php"] [unique_id "achHHSE3TArOFrUtgWoytAAAAIY"]
[Sun Mar 29 05:24:46.007188 2026] [:error] [pid 12910:tid 12933] [client 130.131.193.97:11861] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/csv.php"] [unique_id "achHHinoNBcZwnBvsMNL7QAAAVU"]
[Sun Mar 29 05:24:46.391835 2026] [:error] [pid 12910:tid 12928] [client 130.131.193.97:11852] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/varb.php"] [unique_id "achHHinoNBcZwnBvsMNL7wAAAVA"]
[Sun Mar 29 05:24:46.771362 2026] [:error] [pid 12910:tid 12924] [client 130.131.193.97:11945] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/varb.php"] [unique_id "achHHinoNBcZwnBvsMNL8AAAAUw"]
[Sun Mar 29 05:24:47.167682 2026] [:error] [pid 32255:tid 32315] [client 130.131.193.97:11884] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/varb.php"] [unique_id "achHH2nfn-AtRoMbquxKSQAAAFg"]
[Sun Mar 29 05:24:47.599555 2026] [:error] [pid 12910:tid 12930] [client 130.131.193.97:11889] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/varb.php"] [unique_id "achHHynoNBcZwnBvsMNL8wAAAVI"]
[Sun Mar 29 05:24:47.981422 2026] [:error] [pid 12910:tid 12931] [client 130.131.193.97:11863] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "achHHynoNBcZwnBvsMNL9AAAAVM"]
[Sun Mar 29 05:24:48.393261 2026] [:error] [pid 12910:tid 12925] [client 130.131.193.97:11829] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "achHICnoNBcZwnBvsMNL9gAAAU0"]
[Sun Mar 29 05:24:48.784710 2026] [:error] [pid 12910:tid 12923] [client 130.131.193.97:11870] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "achHICnoNBcZwnBvsMNL-QAAAUs"]
[Sun Mar 29 05:24:49.197624 2026] [:error] [pid 12910:tid 12935] [client 130.131.193.97:11913] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "achHISnoNBcZwnBvsMNL-wAAAVc"]
[Sun Mar 29 05:24:49.585078 2026] [:error] [pid 32254:tid 32273] [client 130.131.193.97:11885] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "achHIaug2IHuyGgCTn8QowAAAAk"]
[Sun Mar 29 05:24:49.963719 2026] [:error] [pid 32255:tid 32297] [client 130.131.193.97:11862] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "achHIWnfn-AtRoMbquxKSwAAAEY"]
[Sun Mar 29 05:24:50.352910 2026] [:error] [pid 32359:tid 32374] [client 130.131.193.97:11993] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "achHIgMb8G3UzfQP3WjQpQAAAM0"]
[Sun Mar 29 05:24:50.730084 2026] [:error] [pid 32254:tid 32274] [client 130.131.193.97:11877] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "achHIqug2IHuyGgCTn8QpAAAAAo"]
[Sun Mar 29 05:24:51.120969 2026] [:error] [pid 1524:tid 1549] [client 130.131.193.97:11850] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "achHI1oaWSl2asqQCh8WtwAAARI"]
[Sun Mar 29 05:24:51.526499 2026] [:error] [pid 1524:tid 1533] [client 130.131.193.97:11875] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "achHI1oaWSl2asqQCh8WugAAAQU"]
[Sun Mar 29 05:24:51.924168 2026] [:error] [pid 32257:tid 32322] [client 130.131.193.97:11890] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "achHIyE3TArOFrUtgWoyvwAAAIQ"]
[Sun Mar 29 05:24:52.310297 2026] [:error] [pid 1524:tid 1528] [client 130.131.193.97:11858] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "achHJFoaWSl2asqQCh8WvgAAAQE"]
[Sun Mar 29 05:24:52.715843 2026] [:error] [pid 12910:tid 12921] [client 130.131.193.97:11811] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "achHJCnoNBcZwnBvsMNL_gAAAUk"]
[Sun Mar 29 05:24:53.095873 2026] [:error] [pid 32359:tid 32371] [client 130.131.193.97:11814] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "achHJQMb8G3UzfQP3WjQqQAAAMo"]
[Sun Mar 29 05:24:53.492981 2026] [:error] [pid 32359:tid 32364] [client 130.131.193.97:11939] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "achHJQMb8G3UzfQP3WjQqgAAAMM"]
[Sun Mar 29 05:24:53.891250 2026] [:error] [pid 32359:tid 32365] [client 130.131.193.97:11876] [client 130.131.193.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "achHJQMb8G3UzfQP3WjQrgAAAMQ"]
[Sun Mar 29 05:24:54.277345 2026] [:error] [pid 12910:tid 12914] [client 130.131.193.97:11882] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Sun Mar 29 05:24:54.467817 2026] [:error] [pid 12910:tid 12916] [client 130.131.193.97:11882] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sun Mar 29 21:39:59.430091 2026] [:error] [pid 23284:tid 23305] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Sun Mar 29 21:39:59.639757 2026] [:error] [pid 23284:tid 23299] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Sun Mar 29 21:39:59.848472 2026] [:error] [pid 23284:tid 23291] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Sun Mar 29 21:40:00.057625 2026] [:error] [pid 23284:tid 23303] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Sun Mar 29 21:40:00.267932 2026] [:error] [pid 23284:tid 23306] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Mar 29 21:40:00.481336 2026] [:error] [pid 23284:tid 23286] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Sun Mar 29 21:40:00.704577 2026] [:error] [pid 23284:tid 23300] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Sun Mar 29 21:40:02.166646 2026] [:error] [pid 23284:tid 23300] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Sun Mar 29 21:40:02.374801 2026] [:error] [pid 23284:tid 23290] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/nz.php
[Sun Mar 29 21:40:02.584377 2026] [:error] [pid 23284:tid 23294] [client 20.220.61.78:37251] File does not exist: /usr/local/apache/htdocs/suspended-page/bnn_.php
[Sun Mar 29 21:40:02.801669 2026] [:error] [pid 23284:tid 23296] [client 20.220.61.78:37251] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/anz.php"] [unique_id "ackrsozBujdPHsq7wySU1wAAAoo"]
[Sun Mar 29 21:40:08.629222 2026] [:error] [pid 32257:tid 32331] [client 20.220.61.78:6091] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/anz.php"] [unique_id "ackruCE3TArOFrUtgWosDQAAAI0"]
[Sun Mar 29 21:40:12.341096 2026] [:error] [pid 32255:tid 32297] [client 20.220.61.78:25296] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/anz.php"] [unique_id "ackrvGnfn-AtRoMbquznbwAAAEY"]
[Sun Mar 29 21:40:13.716901 2026] [:error] [pid 23167:tid 23188] [client 20.220.61.78:32645] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/anz.php"] [unique_id "ackrvRIAHJCFaHff3_e9FQAAAdI"]
[Sun Mar 29 21:40:15.285610 2026] [:error] [pid 32254:tid 32281] [client 20.220.61.78:26815] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "ackrv6ug2IHuyGgCTn9bKgAAABE"]
[Sun Mar 29 21:40:16.840199 2026] [:error] [pid 32254:tid 32272] [client 20.220.61.78:41954] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "ackrwKug2IHuyGgCTn9bKwAAAAg"]
[Sun Mar 29 21:40:17.853347 2026] [:error] [pid 32255:tid 32300] [client 20.220.61.78:5532] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kure.php"] [unique_id "ackrwWnfn-AtRoMbquzniwAAAEk"]
[Sun Mar 29 21:40:21.069628 2026] [:error] [pid 32257:tid 32318] [client 20.220.61.78:34191] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gaje.php"] [unique_id "ackrxSE3TArOFrUtgWosHAAAAIA"]
[Sun Mar 29 21:40:24.520277 2026] [:error] [pid 8818:tid 8822] [client 20.220.61.78:36822] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gaje.php"] [unique_id "ackryCCDvotZNSF0FBrctAAAAUA"]
[Sun Mar 29 21:40:28.549438 2026] [:error] [pid 32255:tid 32302] [client 20.220.61.78:25630] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gaje.php"] [unique_id "ackrzGnfn-AtRoMbquznkQAAAEs"]
[Sun Mar 29 21:40:35.082594 2026] [:error] [pid 32359:tid 32374] [client 20.220.61.78:23801] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fgd.php"] [unique_id "ackr0wMb8G3UzfQP3Wgs0AAAAM0"]
[Sun Mar 29 21:40:38.565110 2026] [:error] [pid 8818:tid 8828] [client 20.220.61.78:51043] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fgd.php"] [unique_id "ackr1iCDvotZNSF0FBrcwgAAAUY"]
[Sun Mar 29 21:40:42.833742 2026] [:error] [pid 23167:tid 23184] [client 20.220.61.78:5297] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fgd.php"] [unique_id "ackr2hIAHJCFaHff3_e9OQAAAc4"]
[Sun Mar 29 21:40:45.370449 2026] [:error] [pid 23167:tid 23181] [client 20.220.61.78:23788] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fgd.php"] [unique_id "ackr3RIAHJCFaHff3_e9OwAAAcs"]
[Sun Mar 29 21:40:49.595915 2026] [:error] [pid 23167:tid 23176] [client 20.220.61.78:22559] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alog.php"] [unique_id "ackr4RIAHJCFaHff3_e9QQAAAcY"]
[Sun Mar 29 21:40:54.513829 2026] [:error] [pid 23168:tid 23202] [client 20.220.61.78:27612] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alog.php"] [unique_id "ackr5mP8p0yRL8ot_2-YEAAAAgU"]
[Sun Mar 29 21:41:02.149827 2026] [:error] [pid 32257:tid 32334] [client 20.220.61.78:22270] File does not exist: /usr/local/apache/htdocs/suspended-page/sef.php
[Sun Mar 29 21:41:02.364502 2026] [:error] [pid 32257:tid 32321] [client 20.220.61.78:22270] File does not exist: /usr/local/apache/htdocs/suspended-page/ztv.php
[Sun Mar 29 21:41:02.575146 2026] [:error] [pid 32257:tid 32327] [client 20.220.61.78:22270] File does not exist: /usr/local/apache/htdocs/suspended-page/Rk41.php
[Sun Mar 29 21:41:02.780338 2026] [:error] [pid 32257:tid 32324] [client 20.220.61.78:22270] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "ackr7iE3TArOFrUtgWoskgAAAIY"]
[Sun Mar 29 21:41:04.937401 2026] [:error] [pid 32257:tid 32318] [client 20.220.61.78:35243] [client 20.220.61.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.61.78, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "ackr8CE3TArOFrUtgWosmwAAAIA"]
[Sun Mar 29 21:41:05.774991 2026] [:error] [pid 32257:tid 32329] [client 20.220.61.78:35243] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Mar 29 21:41:05.984822 2026] [:error] [pid 32257:tid 32330] [client 20.220.61.78:35243] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Sun Mar 29 21:41:07.719350 2026] [:error] [pid 32257:tid 32322] [client 20.220.61.78:35243] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "ackr8yE3TArOFrUtgWosqQAAAIQ"]
[Sun Mar 29 21:41:10.184715 2026] [:error] [pid 23137:tid 23153] [client 20.220.61.78:32766] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ini.php"] [unique_id "ackr9haWQa7LdZ_qGFb5YgAAAY4"]
[Sun Mar 29 21:41:11.759029 2026] [:error] [pid 32359:tid 32382] [client 20.220.61.78:48604] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ini.php"] [unique_id "ackr9wMb8G3UzfQP3Wgs6gAAANU"]
[Sun Mar 29 21:41:14.565299 2026] [:error] [pid 23250:tid 23255] [client 20.220.61.78:48587] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ini.php"] [unique_id "ackr-pxrpj-dQjy1cvoCMgAAAkM"]
[Sun Mar 29 21:41:17.121139 2026] [:error] [pid 32255:tid 32300] [client 20.220.61.78:18256] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ini.php"] [unique_id "ackr_Wnfn-AtRoMbquzn1gAAAEk"]
[Sun Mar 29 21:41:23.376253 2026] [:error] [pid 32254:tid 32273] [client 20.220.61.78:18240] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "acksA6ug2IHuyGgCTn9bVAAAAAk"]
[Sun Mar 29 21:41:25.175168 2026] [:error] [pid 8818:tid 8840] [client 20.220.61.78:47466] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "acksBSCDvotZNSF0FBrc_AAAAVI"]
[Sun Mar 29 21:41:28.838302 2026] [:error] [pid 32257:tid 32333] [client 20.220.61.78:37329] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libraries/legacy/info.php"] [unique_id "acksCCE3TArOFrUtgWostAAAAI8"]
[Sun Mar 29 21:41:35.533073 2026] [:error] [pid 32257:tid 32342] [client 20.220.61.78:18289] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "acksDyE3TArOFrUtgWosvQAAAJg"]
[Sun Mar 29 21:41:39.551702 2026] [:error] [pid 32255:tid 32299] [client 20.220.61.78:38275] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "acksE2nfn-AtRoMbquzn7gAAAEg"]
[Sun Mar 29 21:41:43.098870 2026] [:error] [pid 32257:tid 32318] [client 20.220.61.78:47441] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/include.php"] [unique_id "acksFyE3TArOFrUtgWos0AAAAIA"]
[Sun Mar 29 21:41:48.630813 2026] [:error] [pid 32257:tid 32332] [client 20.220.61.78:32735] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "acksHCE3TArOFrUtgWos5gAAAI4"]
[Sun Mar 29 21:41:54.494794 2026] [:error] [pid 8818:tid 8832] [client 20.220.61.78:32758] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "acksIiCDvotZNSF0FBrdFQAAAUo"]
[Sun Mar 29 21:41:56.109434 2026] [:error] [pid 32255:tid 32303] [client 20.220.61.78:18253] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "acksJGnfn-AtRoMbquzoAwAAAEw"]
[Sun Mar 29 21:41:59.589028 2026] [:error] [pid 8818:tid 8842] [client 20.220.61.78:48639] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "acksJyCDvotZNSF0FBrdHAAAAVQ"]
[Sun Mar 29 21:42:01.050575 2026] [:error] [pid 23167:tid 23184] [client 20.220.61.78:32719] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "acksKRIAHJCFaHff3_e9iwAAAc4"]
[Sun Mar 29 21:42:02.306030 2026] [:error] [pid 23167:tid 23172] [client 20.220.61.78:48596] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "acksKhIAHJCFaHff3_e9kgAAAcI"]
[Sun Mar 29 21:42:05.207637 2026] [:error] [pid 8818:tid 8841] [client 20.220.61.78:32713] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "acksLSCDvotZNSF0FBrdIQAAAVM"]
[Sun Mar 29 21:42:08.181626 2026] [:error] [pid 23284:tid 23289] [client 20.220.61.78:37324] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "acksMIzBujdPHsq7wySV9AAAAoM"]
[Sun Mar 29 21:42:12.834636 2026] [:error] [pid 32257:tid 32321] [client 20.220.61.78:40050] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Mar 29 21:42:13.047052 2026] [:error] [pid 32257:tid 32320] [client 20.220.61.78:40050] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acksNSE3TArOFrUtgWotFQAAAII"]
[Sun Mar 29 21:42:15.378005 2026] [:error] [pid 23284:tid 23305] [client 20.220.61.78:25233] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "acksN4zBujdPHsq7wySWFQAAApM"]
[Sun Mar 29 21:42:19.463409 2026] [:error] [pid 32257:tid 32334] [client 20.220.61.78:26434] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sun Mar 29 21:42:19.670584 2026] [:error] [pid 32257:tid 32335] [client 20.220.61.78:26434] [client 20.220.61.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.61.78, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acksOyE3TArOFrUtgWotIwAAAJE"]
[Sun Mar 29 21:42:23.105873 2026] [:error] [pid 32257:tid 32337] [client 20.220.61.78:26434] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "acksPyE3TArOFrUtgWotNAAAAJM"]
[Sun Mar 29 21:42:23.608906 2026] [:error] [pid 32255:tid 32310] [client 20.220.61.78:24492] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acksP2nfn-AtRoMbquzoLgAAAFM"]
[Sun Mar 29 21:43:01.739896 2026] [:error] [pid 23168:tid 23200] [client 20.220.61.78:38909] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acksZWP8p0yRL8ot_2-YogAAAgM"]
[Sun Mar 29 21:43:02.508536 2026] [:error] [pid 23168:tid 23218] [client 20.220.61.78:20550] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "acksZmP8p0yRL8ot_2-YpgAAAhU"]
[Sun Mar 29 21:43:03.307864 2026] [:error] [pid 32359:tid 32373] [client 20.220.61.78:5704] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acksZwMb8G3UzfQP3WgtOQAAAMw"]
[Sun Mar 29 21:43:03.981978 2026] [:error] [pid 32257:tid 32319] [client 20.220.61.78:61520] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acksZyE3TArOFrUtgWothQAAAIE"]
[Sun Mar 29 21:43:05.800428 2026] [:error] [pid 32254:tid 32278] [client 20.220.61.78:38857] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acksaaug2IHuyGgCTn9bcQAAAA4"]
[Sun Mar 29 21:43:08.206131 2026] [:error] [pid 23168:tid 23215] [client 20.220.61.78:5743] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acksbGP8p0yRL8ot_2-YsgAAAhI"]
[Sun Mar 29 21:43:09.007038 2026] [:error] [pid 23137:tid 23158] [client 20.220.61.78:40636] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acksbRaWQa7LdZ_qGFb5xAAAAZM"]
[Sun Mar 29 21:43:10.152791 2026] [:error] [pid 23250:tid 23254] [client 20.220.61.78:5751] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acksbpxrpj-dQjy1cvoCzQAAAkI"]
[Sun Mar 29 21:43:11.037136 2026] [:error] [pid 23137:tid 23156] [client 20.220.61.78:19367] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acksbxaWQa7LdZ_qGFb5zgAAAZE"]
[Sun Mar 29 21:43:12.471674 2026] [:error] [pid 8818:tid 8835] [client 20.220.61.78:64625] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "ackscCCDvotZNSF0FBrdSQAAAU0"]
[Sun Mar 29 21:43:13.773134 2026] [:error] [pid 8818:tid 8827] [client 20.220.61.78:48125] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "ackscSCDvotZNSF0FBrdTAAAAUU"]
[Sun Mar 29 21:43:15.481108 2026] [:error] [pid 23167:tid 23192] [client 20.220.61.78:28576] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "ackscxIAHJCFaHff3_e96AAAAdY"]
[Sun Mar 29 21:43:17.315452 2026] [:error] [pid 23167:tid 23188] [client 20.220.61.78:28562] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acksdRIAHJCFaHff3_e98AAAAdI"]
[Sun Mar 29 21:43:19.114461 2026] [:error] [pid 23250:tid 23258] [client 20.220.61.78:28617] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acksd5xrpj-dQjy1cvoC0AAAAkY"]
[Sun Mar 29 21:43:19.838371 2026] [:error] [pid 23137:tid 23161] [client 20.220.61.78:51876] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "acksdxaWQa7LdZ_qGFb50wAAAZY"]
[Sun Mar 29 21:43:20.630387 2026] [:error] [pid 8818:tid 8824] [client 20.220.61.78:28654] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/images/wp-login.php"] [unique_id "ackseCCDvotZNSF0FBrdTwAAAUI"]
[Sun Mar 29 21:43:21.385436 2026] [:error] [pid 23168:tid 23216] [client 20.220.61.78:36754] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css/xp.php"] [unique_id "ackseWP8p0yRL8ot_2-YyAAAAhM"]
[Sun Mar 29 21:43:22.722311 2026] [:error] [pid 32359:tid 32370] [client 20.220.61.78:25994] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/themes.php"] [unique_id "acksegMb8G3UzfQP3WgtlQAAAMk"]
[Sun Mar 29 21:43:24.311804 2026] [:error] [pid 23137:tid 23148] [client 20.220.61.78:20129] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acksfBaWQa7LdZ_qGFb52AAAAYk"]
[Sun Mar 29 21:43:25.212397 2026] [:error] [pid 32255:tid 32303] [client 20.220.61.78:63405] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Content/Type/wp-login.php"] [unique_id "acksfWnfn-AtRoMbquzo1gAAAEw"]
[Sun Mar 29 21:43:26.216758 2026] [:error] [pid 32255:tid 32291] [client 20.220.61.78:51421] [client 20.220.61.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.61.78, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acksfmnfn-AtRoMbquzo5QAAAEA"]
[Sun Mar 29 21:43:26.434054 2026] [:error] [pid 32255:tid 32303] [client 20.220.61.78:51421] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Mar 29 21:43:26.639789 2026] [:error] [pid 32255:tid 32307] [client 20.220.61.78:51421] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "acksfmnfn-AtRoMbquzo6QAAAFA"]
[Sun Mar 29 21:43:27.464547 2026] [:error] [pid 23284:tid 23305] [client 20.220.61.78:41325] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "acksf4zBujdPHsq7wySXZQAAApM"]
[Sun Mar 29 21:43:28.550953 2026] [:error] [pid 32255:tid 32310] [client 20.220.61.78:32162] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "acksgGnfn-AtRoMbquzo9AAAAFM"]
[Sun Mar 29 21:43:29.386565 2026] [:error] [pid 32257:tid 32337] [client 20.220.61.78:44752] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Sun Mar 29 21:43:29.594668 2026] [:error] [pid 32257:tid 32327] [client 20.220.61.78:44752] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 29 21:43:30.726002 2026] [:error] [pid 32257:tid 32320] [client 20.220.61.78:44752] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "acksgiE3TArOFrUtgWotywAAAII"]
[Sun Mar 29 21:43:31.831061 2026] [:error] [pid 23284:tid 23300] [client 20.220.61.78:44796] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/link.php"] [unique_id "acksg4zBujdPHsq7wySXbAAAAo4"]
[Sun Mar 29 21:43:33.580348 2026] [:error] [pid 23284:tid 23291] [client 20.220.61.78:6076] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/link.php"] [unique_id "ackshYzBujdPHsq7wySXeAAAAoU"]
[Sun Mar 29 21:43:34.608947 2026] [:error] [pid 23250:tid 23252] [client 20.220.61.78:58335] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/link.php"] [unique_id "ackshpxrpj-dQjy1cvoC1gAAAkA"]
[Sun Mar 29 21:43:35.858515 2026] [:error] [pid 23168:tid 23211] [client 20.220.61.78:6042] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/link.php"] [unique_id "acksh2P8p0yRL8ot_2-Y_AAAAg4"]
[Sun Mar 29 21:43:37.595507 2026] [:error] [pid 23250:tid 23276] [client 20.220.61.78:24959] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/403.php"] [unique_id "acksiZxrpj-dQjy1cvoC2AAAAlg"]
[Sun Mar 29 21:43:38.906837 2026] [:error] [pid 32255:tid 32299] [client 20.220.61.78:23302] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/403.php"] [unique_id "acksimnfn-AtRoMbquzpNwAAAEg"]
[Sun Mar 29 21:43:40.467092 2026] [:error] [pid 23284:tid 23304] [client 20.220.61.78:26827] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/403.php"] [unique_id "acksjIzBujdPHsq7wySXigAAApI"]
[Sun Mar 29 21:43:42.407498 2026] [:error] [pid 23168:tid 23199] [client 20.220.61.78:22160] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/403.php"] [unique_id "acksjmP8p0yRL8ot_2-ZBAAAAgI"]
[Sun Mar 29 21:43:43.345463 2026] [:error] [pid 23137:tid 23140] [client 20.220.61.78:5881] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "acksjxaWQa7LdZ_qGFb55gAAAYE"]
[Sun Mar 29 21:43:44.988855 2026] [:error] [pid 32257:tid 32329] [client 20.220.61.78:26876] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "ackskCE3TArOFrUtgWot1wAAAIs"]
[Sun Mar 29 21:43:46.007332 2026] [:error] [pid 32359:tid 32382] [client 20.220.61.78:51385] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "ackskgMb8G3UzfQP3Wgt3QAAANU"]
[Sun Mar 29 21:43:46.646808 2026] [:error] [pid 23284:tid 23293] [client 20.220.61.78:39965] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/plugins.php"] [unique_id "ackskozBujdPHsq7wySXmgAAAoc"]
[Sun Mar 29 21:43:47.493884 2026] [:error] [pid 23284:tid 23300] [client 20.220.61.78:22162] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "acksk4zBujdPHsq7wySXngAAAo4"]
[Sun Mar 29 21:43:48.772298 2026] [:error] [pid 32257:tid 32330] [client 20.220.61.78:45241] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "ackslCE3TArOFrUtgWot3AAAAIw"]
[Sun Mar 29 21:43:50.187460 2026] [:error] [pid 23250:tid 23270] [client 20.220.61.78:26825] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "ackslpxrpj-dQjy1cvoC4QAAAlI"]
[Sun Mar 29 21:43:51.733211 2026] [:error] [pid 23168:tid 23203] [client 20.220.61.78:19028] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "acksl2P8p0yRL8ot_2-ZCwAAAgY"]
[Sun Mar 29 21:43:53.502214 2026] [:error] [pid 23137:tid 23141] [client 20.220.61.78:22634] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "acksmRaWQa7LdZ_qGFb56gAAAYI"]
[Sun Mar 29 21:43:55.340178 2026] [:error] [pid 32257:tid 32320] [client 20.220.61.78:41339] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Assets/edit.php"] [unique_id "acksmyE3TArOFrUtgWot7wAAAII"]
[Sun Mar 29 21:43:58.120409 2026] [:error] [pid 23284:tid 23288] [client 20.220.61.78:58353] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Assets/edit.php"] [unique_id "acksnozBujdPHsq7wySXtwAAAoI"]
[Sun Mar 29 21:44:20.245165 2026] [:error] [pid 23284:tid 23294] [client 20.220.61.78:23727] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "ackstIzBujdPHsq7wySX6QAAAog"]
[Sun Mar 29 21:44:28.357281 2026] [:error] [pid 32359:tid 32380] [client 20.220.61.78:64558] [client 20.220.61.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/file.php"] [unique_id "acksvAMb8G3UzfQP3Wgt7gAAANM"]
[Sun Mar 29 21:44:30.900892 2026] [:error] [pid 8818:tid 8845] [client 20.220.61.78:59728] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acksviCDvotZNSF0FBrdjAAAAVc"]
[Sun Mar 29 21:44:41.456154 2026] [:error] [pid 32257:tid 32341] [client 20.220.61.78:48033] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Sun Mar 29 21:44:41.680086 2026] [:error] [pid 32257:tid 32338] [client 20.220.61.78:48033] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 29 21:44:41.885050 2026] [:error] [pid 32257:tid 32329] [client 20.220.61.78:48033] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "acksySE3TArOFrUtgWouSAAAAIs"]
[Sun Mar 29 21:44:46.349673 2026] [:error] [pid 8818:tid 8842] [client 20.220.61.78:50467] [client 20.220.61.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "acksziCDvotZNSF0FBrdkwAAAVQ"]
[Mon Mar 30 12:32:05.322402 2026] [:error] [pid 35248:tid 35259] [client 20.213.160.162:1566] [client 20.213.160.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn8xb3igMCgAQPFS_80WwAAAEU"]
[Mon Mar 30 12:32:05.395448 2026] [:error] [pid 35248:tid 35258] [client 20.213.160.162:1595] [client 20.213.160.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn8xb3igMCgAQPFS_80aQAAAEQ"]
[Mon Mar 30 12:32:05.465899 2026] [:error] [pid 35248:tid 35278] [client 20.213.160.162:1513] [client 20.213.160.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn8xb3igMCgAQPFS_80hgAAAFg"]
[Mon Mar 30 12:32:05.572663 2026] [:error] [pid 35250:tid 35327] [client 20.213.160.162:1571] [client 20.213.160.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.trash7206/index.php"] [unique_id "acn8xYaKM1MR6zcp2YPBkQAAANA"]
[Mon Mar 30 13:28:48.070875 2026] [:error] [pid 51065:tid 51071] [client 172.71.148.182:13751] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/index"] [unique_id "acoKEHMr8wtZeHSSB7LtiQAAAcQ"]
[Mon Mar 30 13:28:48.071072 2026] [:error] [pid 51065:tid 51081] [client 172.71.148.184:9599] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "acoKEHMr8wtZeHSSB7LtigAAAc4"]
[Mon Mar 30 13:28:48.073704 2026] [:error] [pid 41941:tid 41949] [client 172.71.148.182:13749] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/refs/heads/master"] [unique_id "acoKECB2g7BNCXGBOJOnGgAAAQY"]
[Mon Mar 30 13:28:48.222582 2026] [:error] [pid 41941:tid 41944] [client 172.71.148.4:9318] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "acoKECB2g7BNCXGBOJOnGwAAAQE"]
[Mon Mar 30 13:28:48.247787 2026] [:error] [pid 41941:tid 41966] [client 172.71.148.5:9367] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/refs/heads/main"] [unique_id "acoKECB2g7BNCXGBOJOnHAAAARc"]
[Mon Mar 30 13:28:48.318490 2026] [:error] [pid 35343:tid 35347] [client 172.71.148.3:10272] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/logs/HEAD"] [unique_id "acoKEKP5HurqmbvwN-Ku9QAAAAI"]
[Mon Mar 30 13:28:49.084571 2026] [:error] [pid 35249:tid 35303] [client 172.71.148.183:11966] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "acoKESqCKiTq85d6rgAwAQAAAJM"]
[Mon Mar 30 13:28:49.102206 2026] [:error] [pid 35343:tid 35363] [client 172.71.148.2:12040] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "acoKEaP5HurqmbvwN-Ku-AAAABI"]
[Mon Mar 30 13:28:49.108427 2026] [:error] [pid 41941:tid 41943] [client 172.71.148.182:13754] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "acoKESB2g7BNCXGBOJOnIAAAAQA"]
[Mon Mar 30 13:28:49.209686 2026] [:error] [pid 41941:tid 41950] [client 172.71.148.183:11974] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "acoKESB2g7BNCXGBOJOnIgAAAQc"]
[Mon Mar 30 13:28:49.254557 2026] [:error] [pid 35343:tid 35355] [client 172.71.148.2:12047] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dev"] [unique_id "acoKEaP5HurqmbvwN-Ku-QAAAAo"]
[Mon Mar 30 13:28:49.351488 2026] [:error] [pid 41941:tid 41946] [client 172.71.148.184:9603] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "acoKESB2g7BNCXGBOJOnIwAAAQM"]
[Mon Mar 30 13:28:50.104381 2026] [:error] [pid 51065:tid 51076] [client 172.71.148.5:9375] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "acoKEnMr8wtZeHSSB7LtjQAAAck"]
[Mon Mar 30 13:28:50.132422 2026] [:error] [pid 51065:tid 51068] [client 172.71.148.183:11979] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.backup"] [unique_id "acoKEnMr8wtZeHSSB7LtjgAAAcE"]
[Mon Mar 30 13:28:50.157184 2026] [:error] [pid 64743:tid 64763] [client 172.71.148.2:12053] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.bak"] [unique_id "acoKEizmpVL6Ubzil4hzbAAAAVI"]
[Mon Mar 30 13:28:50.204346 2026] [:error] [pid 64743:tid 64754] [client 172.71.148.3:10278] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.old"] [unique_id "acoKEizmpVL6Ubzil4hzbQAAAUk"]
[Mon Mar 30 13:28:50.263008 2026] [:error] [pid 50663:tid 50678] [client 172.71.148.185:10794] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.save"] [unique_id "acoKEm28b9DKIAMEdfDQ4wAAAY0"]
[Mon Mar 30 13:28:50.353943 2026] [:error] [pid 50663:tid 50672] [client 172.71.148.5:9378] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.tmp"] [unique_id "acoKEm28b9DKIAMEdfDQ5QAAAYc"]
[Mon Mar 30 13:28:51.155703 2026] [:error] [pid 41941:tid 41949] [client 172.71.148.184:9605] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.example"] [unique_id "acoKEyB2g7BNCXGBOJOnJQAAAQY"]
[Mon Mar 30 13:28:51.168947 2026] [:error] [pid 41941:tid 41956] [client 172.71.148.3:10279] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development.local"] [unique_id "acoKEyB2g7BNCXGBOJOnJgAAAQ0"]
[Mon Mar 30 13:28:51.170085 2026] [:error] [pid 41941:tid 41958] [client 172.71.148.185:10796] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production.local"] [unique_id "acoKEyB2g7BNCXGBOJOnJwAAAQ8"]
[Mon Mar 30 13:28:51.224296 2026] [:error] [pid 41941:tid 41944] [client 172.71.148.3:10286] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config/.env"] [unique_id "acoKEyB2g7BNCXGBOJOnKAAAAQE"]
[Mon Mar 30 13:28:51.289995 2026] [:error] [pid 41941:tid 41963] [client 172.71.148.184:9613] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env"] [unique_id "acoKEyB2g7BNCXGBOJOnKQAAARQ"]
[Mon Mar 30 13:28:51.380553 2026] [:error] [pid 35343:tid 35354] [client 172.71.148.5:9385] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/backend/.env"] [unique_id "acoKE6P5HurqmbvwN-Ku_QAAAAk"]
[Mon Mar 30 13:28:52.170912 2026] [:error] [pid 41941:tid 41951] [client 172.71.148.3:10290] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env"] [unique_id "acoKFCB2g7BNCXGBOJOnLAAAAQg"]
[Mon Mar 30 13:28:52.199245 2026] [:error] [pid 41941:tid 41947] [client 172.71.148.4:10632] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env"] [unique_id "acoKFCB2g7BNCXGBOJOnLgAAAQQ"]
[Mon Mar 30 13:28:52.213064 2026] [:error] [pid 41941:tid 41953] [client 172.71.148.185:10798] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/.env"] [unique_id "acoKFCB2g7BNCXGBOJOnLwAAAQo"]
[Mon Mar 30 13:28:52.240709 2026] [:error] [pid 41941:tid 41943] [client 172.71.148.3:10292] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/.env"] [unique_id "acoKFCB2g7BNCXGBOJOnMAAAAQA"]
[Mon Mar 30 13:28:52.331372 2026] [:error] [pid 41941:tid 41950] [client 172.71.148.185:10805] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/private/.env"] [unique_id "acoKFCB2g7BNCXGBOJOnMQAAAQc"]
[Mon Mar 30 13:28:53.174460 2026] [:error] [pid 35343:tid 35349] [client 172.71.148.3:10302] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config/.env.local"] [unique_id "acoKFaP5HurqmbvwN-KvBwAAAAQ"]
[Mon Mar 30 13:28:53.221409 2026] [:error] [pid 41941:tid 41959] [client 172.71.148.185:10810] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.php"] [unique_id "acoKFSB2g7BNCXGBOJOnNAAAARA"]
[Mon Mar 30 13:28:53.254869 2026] [:error] [pid 41941:tid 41961] [client 172.71.148.5:9303] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.json"] [unique_id "acoKFSB2g7BNCXGBOJOnNQAAARI"]
[Mon Mar 30 13:28:53.265533 2026] [:error] [pid 41941:tid 41957] [client 172.71.148.4:10638] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env_backup"] [unique_id "acoKFSB2g7BNCXGBOJOnNgAAAQ4"]
[Mon Mar 30 13:28:53.346213 2026] [:error] [pid 41941:tid 41966] [client 172.71.148.5:9305] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env~"] [unique_id "acoKFSB2g7BNCXGBOJOnOAAAARc"]
[Mon Mar 30 13:28:53.413614 2026] [:error] [pid 41941:tid 41952] [client 172.71.148.5:9307] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env1"] [unique_id "acoKFSB2g7BNCXGBOJOnOgAAAQk"]
[Mon Mar 30 13:28:53.477948 2026] [:error] [pid 35343:tid 35348] [client 172.71.148.3:10297] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dist"] [unique_id "acoKFaP5HurqmbvwN-KvCAAAAAM"]
[Mon Mar 30 13:28:54.187961 2026] [:error] [pid 41941:tid 41956] [client 172.71.148.182:11646] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env2"] [unique_id "acoKFiB2g7BNCXGBOJOnPAAAAQ0"]
[Mon Mar 30 13:28:54.266682 2026] [:error] [pid 35343:tid 35365] [client 172.71.148.184:9617] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.orig"] [unique_id "acoKFqP5HurqmbvwN-KvCQAAABQ"]
[Mon Mar 30 13:28:54.340929 2026] [:error] [pid 35343:tid 35354] [client 172.71.148.2:12056] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production.bak"] [unique_id "acoKFqP5HurqmbvwN-KvCgAAAAk"]
[Mon Mar 30 13:28:54.421507 2026] [:error] [pid 41941:tid 41954] [client 172.71.148.185:10818] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.prod"] [unique_id "acoKFiB2g7BNCXGBOJOnPgAAAQs"]
[Mon Mar 30 13:28:54.506553 2026] [:error] [pid 35343:tid 35345] [client 172.71.148.182:11651] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dev.local"] [unique_id "acoKFqP5HurqmbvwN-KvCwAAAAA"]
[Mon Mar 30 13:28:54.947166 2026] [:error] [pid 35343:tid 35352] [client 172.71.148.185:10823] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.envrc"] [unique_id "acoKFqP5HurqmbvwN-KvDAAAAAc"]
[Mon Mar 30 13:28:55.197353 2026] [:error] [pid 35343:tid 35346] [client 172.71.148.3:10304] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.docker"] [unique_id "acoKF6P5HurqmbvwN-KvDgAAAAE"]
[Mon Mar 30 13:28:55.272786 2026] [:error] [pid 35343:tid 35366] [client 172.71.148.184:9622] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.container"] [unique_id "acoKF6P5HurqmbvwN-KvDwAAABU"]
[Mon Mar 30 13:28:55.366168 2026] [:error] [pid 41941:tid 41960] [client 172.71.148.2:12059] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/docker/.env"] [unique_id "acoKFyB2g7BNCXGBOJOnQwAAARE"]
[Mon Mar 30 13:28:55.528440 2026] [:error] [pid 35250:tid 35311] [client 172.71.148.183:13834] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/docker/.env.local"] [unique_id "acoKF4aKM1MR6zcp2YPNywAAAMA"]
[Mon Mar 30 13:28:55.985781 2026] [:error] [pid 35248:tid 35255] [client 172.71.148.184:12046] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/server/.env"] [unique_id "acoKF73igMCgAQPFS_9GcwAAAEE"]
[Mon Mar 30 13:28:56.233058 2026] [:error] [pid 35343:tid 35347] [client 172.71.148.184:12051] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/srv/.env"] [unique_id "acoKGKP5HurqmbvwN-KvFQAAAAI"]
[Mon Mar 30 13:28:56.289693 2026] [:error] [pid 35343:tid 35354] [client 172.71.148.4:10639] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/.env"] [unique_id "acoKGKP5HurqmbvwN-KvFgAAAAk"]
[Mon Mar 30 13:28:56.378071 2026] [:error] [pid 35343:tid 35360] [client 172.71.148.182:11656] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/site/.env"] [unique_id "acoKGKP5HurqmbvwN-KvGAAAAA8"]
[Mon Mar 30 13:28:56.444972 2026] [:error] [pid 41941:tid 41950] [client 172.71.148.183:13837] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/www/.env"] [unique_id "acoKGCB2g7BNCXGBOJOnRgAAAQc"]
[Mon Mar 30 13:28:56.544499 2026] [:error] [pid 35343:tid 35368] [client 172.71.148.185:10342] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/var/www/.env"] [unique_id "acoKGKP5HurqmbvwN-KvGgAAABc"]
[Mon Mar 30 13:28:57.020317 2026] [:error] [pid 50663:tid 50678] [client 172.71.148.182:11663] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/var/www/html/.env"] [unique_id "acoKGW28b9DKIAMEdfDQ7QAAAY0"]
[Mon Mar 30 13:28:57.265684 2026] [:error] [pid 41941:tid 41959] [client 172.71.148.185:10345] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/home/.env"] [unique_id "acoKGSB2g7BNCXGBOJOnRwAAARA"]
[Mon Mar 30 13:28:57.301619 2026] [:error] [pid 41941:tid 41961] [client 172.71.148.182:11671] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/root/.env"] [unique_id "acoKGSB2g7BNCXGBOJOnSAAAARI"]
[Mon Mar 30 13:28:57.389660 2026] [:error] [pid 41941:tid 41952] [client 172.71.148.185:10351] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env_config"] [unique_id "acoKGSB2g7BNCXGBOJOnSQAAAQk"]
[Mon Mar 30 13:28:57.439673 2026] [:error] [pid 41941:tid 41965] [client 172.71.148.182:11679] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env_secret"] [unique_id "acoKGSB2g7BNCXGBOJOnSgAAARY"]
[Mon Mar 30 13:28:57.581327 2026] [:error] [pid 41941:tid 41962] [client 172.71.148.184:12059] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env_settings"] [unique_id "acoKGSB2g7BNCXGBOJOnSwAAARM"]
[Mon Mar 30 13:28:57.772281 2026] [:error] [pid 64743:tid 64758] [client 172.71.148.4:14321] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "acoKGSzmpVL6Ubzil4hzbgAAAU0"]
[Mon Mar 30 13:28:57.810972 2026] [:error] [pid 51065:tid 51087] [client 172.71.148.183:13045] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "acoKGXMr8wtZeHSSB7LtlAAAAdQ"]
[Mon Mar 30 13:28:57.900411 2026] [:error] [pid 51065:tid 51084] [client 172.71.148.183:13052] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/index"] [unique_id "acoKGXMr8wtZeHSSB7LtlQAAAdE"]
[Mon Mar 30 13:28:57.936059 2026] [:error] [pid 51065:tid 51067] [client 172.71.148.184:12883] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/logs/HEAD"] [unique_id "acoKGXMr8wtZeHSSB7LtlgAAAcA"]
[Mon Mar 30 13:28:58.039127 2026] [:error] [pid 35250:tid 35312] [client 172.71.148.4:10646] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local.backup"] [unique_id "acoKGoaKM1MR6zcp2YPN0QAAAME"]
[Mon Mar 30 13:28:58.095138 2026] [:error] [pid 51065:tid 51077] [client 172.71.148.2:13784] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/refs/heads/master"] [unique_id "acoKGnMr8wtZeHSSB7LtlwAAAco"]
[Mon Mar 30 13:28:58.280618 2026] [:error] [pid 35343:tid 35358] [client 172.71.148.183:13058] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/refs/heads/main"] [unique_id "acoKGqP5HurqmbvwN-KvHQAAAA0"]
[Mon Mar 30 13:28:58.325028 2026] [:error] [pid 35248:tid 35258] [client 172.71.148.185:11531] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "acoKGr3igMCgAQPFS_9GdQAAAEQ"]
[Mon Mar 30 13:28:58.413437 2026] [:error] [pid 51065:tid 51090] [client 172.71.148.185:11536] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "acoKGnMr8wtZeHSSB7LtmAAAAdc"]
[Mon Mar 30 13:28:58.440898 2026] [:error] [pid 35248:tid 35273] [client 172.71.148.182:11494] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "acoKGr3igMCgAQPFS_9GdgAAAFM"]
[Mon Mar 30 13:28:58.550348 2026] [:error] [pid 35248:tid 35270] [client 172.71.148.4:14323] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "acoKGr3igMCgAQPFS_9GdwAAAFA"]
[Mon Mar 30 13:28:58.603491 2026] [:error] [pid 35248:tid 35277] [client 172.71.148.183:13064] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dev"] [unique_id "acoKGr3igMCgAQPFS_9GeAAAAFc"]
[Mon Mar 30 13:28:58.794204 2026] [:error] [pid 64743:tid 64756] [client 172.71.148.184:12889] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "acoKGizmpVL6Ubzil4hzcAAAAUs"]
[Mon Mar 30 13:28:58.844621 2026] [:error] [pid 41941:tid 41967] [client 172.71.148.184:12892] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "acoKGiB2g7BNCXGBOJOnTAAAARg"]
[Mon Mar 30 13:28:58.925191 2026] [:error] [pid 35250:tid 35321] [client 172.71.148.3:9811] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.backup"] [unique_id "acoKGoaKM1MR6zcp2YPN0wAAAMo"]
[Mon Mar 30 13:28:58.958318 2026] [:error] [pid 50663:tid 50667] [client 172.71.148.2:13790] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.bak"] [unique_id "acoKGm28b9DKIAMEdfDQ7wAAAYI"]
[Mon Mar 30 13:28:59.063993 2026] [:error] [pid 35343:tid 35353] [client 172.71.148.183:13067] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.old"] [unique_id "acoKG6P5HurqmbvwN-KvHgAAAAg"]
[Mon Mar 30 13:28:59.124296 2026] [:error] [pid 41941:tid 41950] [client 172.71.148.4:14330] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.save"] [unique_id "acoKGyB2g7BNCXGBOJOnTQAAAQc"]
[Mon Mar 30 13:28:59.313904 2026] [:error] [pid 35343:tid 35352] [client 172.71.148.184:12899] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.tmp"] [unique_id "acoKG6P5HurqmbvwN-KvHwAAAAc"]
[Mon Mar 30 13:28:59.350705 2026] [:error] [pid 41941:tid 41966] [client 172.71.148.3:9817] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.example"] [unique_id "acoKGyB2g7BNCXGBOJOnTwAAARc"]
[Mon Mar 30 13:28:59.438501 2026] [:error] [pid 41941:tid 41964] [client 172.71.148.3:9823] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production.local"] [unique_id "acoKGyB2g7BNCXGBOJOnUAAAARU"]
[Mon Mar 30 13:28:59.470700 2026] [:error] [pid 41941:tid 41943] [client 172.71.148.2:13798] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development.local"] [unique_id "acoKGyB2g7BNCXGBOJOnUQAAAQA"]
[Mon Mar 30 13:28:59.578150 2026] [:error] [pid 35343:tid 35366] [client 172.71.148.183:13069] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config/.env"] [unique_id "acoKG6P5HurqmbvwN-KvIgAAABU"]
[Mon Mar 30 13:28:59.635855 2026] [:error] [pid 41941:tid 41965] [client 172.71.148.2:13805] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env"] [unique_id "acoKGyB2g7BNCXGBOJOnVAAAARY"]
[Mon Mar 30 13:28:59.818690 2026] [:error] [pid 35343:tid 35369] [client 172.71.148.182:11502] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/backend/.env"] [unique_id "acoKG6P5HurqmbvwN-KvIwAAABg"]
[Mon Mar 30 13:28:59.863008 2026] [:error] [pid 35343:tid 35367] [client 172.71.148.183:13076] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env"] [unique_id "acoKG6P5HurqmbvwN-KvJAAAABY"]
[Mon Mar 30 13:28:59.950842 2026] [:error] [pid 35343:tid 35348] [client 172.71.148.184:12904] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env"] [unique_id "acoKG6P5HurqmbvwN-KvJQAAAAM"]
[Mon Mar 30 13:28:59.986420 2026] [:error] [pid 35343:tid 35350] [client 172.71.148.184:12908] [client 172.71.148.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/.env"] [unique_id "acoKG6P5HurqmbvwN-KvJgAAAAU"]
[Mon Mar 30 13:29:00.098049 2026] [:error] [pid 35343:tid 35347] [client 172.71.148.4:14334] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/.env"] [unique_id "acoKHKP5HurqmbvwN-KvKAAAAAI"]
[Mon Mar 30 13:29:00.145390 2026] [:error] [pid 35343:tid 35364] [client 172.71.148.185:11544] [client 172.71.148.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/private/.env"] [unique_id "acoKHKP5HurqmbvwN-KvKQAAABM"]
[Mon Mar 30 13:29:00.613003 2026] [:error] [pid 51065:tid 51075] [client 172.71.148.182:11505] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env_backup"] [unique_id "acoKHHMr8wtZeHSSB7LtmgAAAcg"]
[Mon Mar 30 13:29:00.654730 2026] [:error] [pid 41941:tid 41950] [client 172.71.148.5:10460] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env~"] [unique_id "acoKHCB2g7BNCXGBOJOnVgAAAQc"]
[Mon Mar 30 13:29:00.823212 2026] [:error] [pid 41941:tid 41964] [client 172.71.148.4:14335] [client 172.71.148.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env1"] [unique_id "acoKHCB2g7BNCXGBOJOnVwAAARU"]
[Mon Mar 30 13:29:01.133018 2026] [:error] [pid 41941:tid 41956] [client 172.71.148.183:13084] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env2"] [unique_id "acoKHSB2g7BNCXGBOJOnWQAAAQ0"]
[Mon Mar 30 13:29:01.321826 2026] [:error] [pid 41941:tid 41962] [client 172.71.148.183:13086] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.envrc"] [unique_id "acoKHSB2g7BNCXGBOJOnWgAAARM"]
[Mon Mar 30 13:29:01.393349 2026] [:error] [pid 35343:tid 35355] [client 172.71.148.2:13807] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.orig"] [unique_id "acoKHaP5HurqmbvwN-KvMgAAAAo"]
[Mon Mar 30 13:29:01.816282 2026] [:error] [pid 41941:tid 41967] [client 172.71.148.183:13087] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production.bak"] [unique_id "acoKHSB2g7BNCXGBOJOnXQAAARg"]
[Mon Mar 30 13:29:01.902377 2026] [:error] [pid 41941:tid 41957] [client 172.71.148.182:11513] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.prod"] [unique_id "acoKHSB2g7BNCXGBOJOnXwAAAQ4"]
[Mon Mar 30 13:29:02.317094 2026] [:error] [pid 35248:tid 35272] [client 172.71.148.5:10695] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.dev.local"] [unique_id "acoKHr3igMCgAQPFS_9GewAAAFI"]
[Mon Mar 30 13:29:02.417145 2026] [:error] [pid 50663:tid 50673] [client 172.71.148.5:10702] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.docker"] [unique_id "acoKHm28b9DKIAMEdfDQ8QAAAYg"]
[Mon Mar 30 13:29:02.813429 2026] [:error] [pid 35248:tid 35276] [client 172.71.148.182:11515] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.container"] [unique_id "acoKHr3igMCgAQPFS_9GfgAAAFY"]
[Mon Mar 30 13:29:02.920290 2026] [:error] [pid 50663:tid 50670] [client 172.71.148.5:10705] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/docker/.env"] [unique_id "acoKHm28b9DKIAMEdfDQ8gAAAYU"]
[Mon Mar 30 13:29:03.417453 2026] [:error] [pid 51065:tid 51087] [client 172.71.148.182:10785] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/docker/.env.local"] [unique_id "acoKH3Mr8wtZeHSSB7LtnwAAAdQ"]
[Mon Mar 30 13:29:03.863939 2026] [:error] [pid 51065:tid 51067] [client 172.71.148.2:13814] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/server/.env"] [unique_id "acoKH3Mr8wtZeHSSB7LtoAAAAcA"]
[Mon Mar 30 13:29:03.926656 2026] [:error] [pid 35250:tid 35318] [client 172.71.148.3:9825] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/srv/.env"] [unique_id "acoKH4aKM1MR6zcp2YPN1wAAAMc"]
[Mon Mar 30 13:29:04.370431 2026] [:error] [pid 41941:tid 41965] [client 172.71.148.3:9826] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/.env"] [unique_id "acoKICB2g7BNCXGBOJOnZQAAARY"]
[Mon Mar 30 13:29:04.433423 2026] [:error] [pid 41941:tid 41956] [client 172.71.148.3:9830] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/site/.env"] [unique_id "acoKICB2g7BNCXGBOJOnZwAAAQ0"]
[Mon Mar 30 13:29:04.689316 2026] [:error] [pid 35343:tid 35345] [client 172.71.148.182:10784] [client 172.71.148.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/var/www/.env"] [unique_id "acoKIKP5HurqmbvwN-KvOwAAAAA"]
[Mon Mar 30 13:29:04.869682 2026] [:error] [pid 35248:tid 35265] [client 172.71.148.3:9834] [client 172.71.148.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/www/.env"] [unique_id "acoKIL3igMCgAQPFS_9GfwAAAEs"]
[Mon Mar 30 13:29:05.210535 2026] [:error] [pid 41941:tid 41949] [client 172.71.148.183:13955] [client 172.71.148.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/var/www/html/.env"] [unique_id "acoKISB2g7BNCXGBOJOnawAAAQY"]
[Mon Mar 30 13:29:05.714668 2026] [:error] [pid 35248:tid 35270] [client 172.71.148.5:10711] [client 172.71.148.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/root/.env"] [unique_id "acoKIb3igMCgAQPFS_9GgAAAAFA"]
[Mon Mar 30 13:29:06.219656 2026] [:error] [pid 50663:tid 50667] [client 172.71.148.2:13821] [client 172.71.148.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env_config"] [unique_id "acoKIm28b9DKIAMEdfDQ-wAAAYI"]
[Mon Mar 30 13:29:24.479766 2026] [:error] [pid 41941:tid 41945] [client 172.69.186.203:11927] [client 172.69.186.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local.backup"] [unique_id "acoKNCB2g7BNCXGBOJOnkQAAAQI"]
[Mon Mar 30 13:34:47.082247 2026] [:error] [pid 35343:tid 35348] [client 20.222.17.205:1669] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.trash7206/index.php"] [unique_id "acoLd6P5HurqmbvwN-KzSQAAAAM"]
[Mon Mar 30 13:34:48.184050 2026] [:error] [pid 51065:tid 51075] [client 20.222.17.205:1322] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.trash7206/index.php"] [unique_id "acoLeHMr8wtZeHSSB7Lu_wAAAcg"]
[Mon Mar 30 13:34:49.331910 2026] [:error] [pid 35249:tid 35297] [client 20.222.17.205:6796] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.trash7206/index.php"] [unique_id "acoLeSqCKiTq85d6rgAwcgAAAI0"]
[Mon Mar 30 13:34:49.979935 2026] [:error] [pid 41941:tid 41944] [client 20.222.17.205:6811] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.trash7206/index.php"] [unique_id "acoLeSB2g7BNCXGBOJOp0QAAAQE"]
[Mon Mar 30 20:18:14.273045 2026] [:error] [pid 35250:tid 35320] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Mon Mar 30 20:18:14.576530 2026] [:error] [pid 35250:tid 35313] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Mon Mar 30 20:18:14.841124 2026] [:error] [pid 35250:tid 35319] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Mon Mar 30 20:18:15.113511 2026] [:error] [pid 35250:tid 35331] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Mon Mar 30 20:18:16.374018 2026] [:error] [pid 35250:tid 35331] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/wxfyf.php
[Mon Mar 30 20:18:16.643636 2026] [:error] [pid 35250:tid 35321] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/callback.php
[Mon Mar 30 20:18:16.910552 2026] [:error] [pid 35250:tid 35334] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Mon Mar 30 20:18:17.194355 2026] [:error] [pid 35250:tid 35333] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Mon Mar 30 20:18:17.460443 2026] [:error] [pid 35250:tid 35315] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Mon Mar 30 20:18:17.725715 2026] [:error] [pid 35250:tid 35323] [client 20.91.240.203:12069] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Mon Mar 30 20:18:17.988635 2026] [:error] [pid 35250:tid 35335] [client 20.91.240.203:12069] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "acpqCYaKM1MR6zcp2YNyxwAAANg"]
[Mon Mar 30 20:18:19.914680 2026] [:error] [pid 50663:tid 50679] [client 20.91.240.203:59793] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "acpqC228b9DKIAMEdfA4GgAAAY4"]
[Mon Mar 30 20:18:23.516454 2026] [:error] [pid 41941:tid 41967] [client 20.91.240.203:6927] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "acpqDyB2g7BNCXGBOJN5iAAAARg"]
[Mon Mar 30 20:18:25.404333 2026] [:error] [pid 35248:tid 35276] [client 20.91.240.203:6939] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "acpqEb3igMCgAQPFS_-iIgAAAFY"]
[Mon Mar 30 20:18:27.478419 2026] [:error] [pid 11947:tid 11954] [client 20.91.240.203:46702] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "acpqEzSVtzzXIgk-FgluVwAAAgU"]
[Mon Mar 30 20:18:30.085777 2026] [:error] [pid 35343:tid 35366] [client 20.91.240.203:48511] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "acpqFqP5HurqmbvwN-IvTQAAABU"]
[Mon Mar 30 20:18:43.732774 2026] [:error] [pid 50663:tid 50681] [client 20.91.240.203:51039] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "acpqI228b9DKIAMEdfA4TAAAAZA"]
[Mon Mar 30 20:18:45.175439 2026] [:error] [pid 12046:tid 12064] [client 20.91.240.203:6932] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "acpqJZDbtlkoJ6ELn7ggLAAAAk8"]
[Mon Mar 30 20:18:46.350508 2026] [:error] [pid 11947:tid 11963] [client 20.91.240.203:48487] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "acpqJjSVtzzXIgk-FglufAAAAg4"]
[Mon Mar 30 20:18:47.302794 2026] [:error] [pid 11947:tid 11967] [client 20.91.240.203:6712] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "acpqJzSVtzzXIgk-FglugAAAAhI"]
[Mon Mar 30 20:18:48.078403 2026] [:error] [pid 12106:tid 12118] [client 20.91.240.203:6846] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acpqKLIKxOs8TAdw7hcd6QAAAoo"]
[Mon Mar 30 20:18:49.483958 2026] [:error] [pid 35343:tid 35366] [client 20.91.240.203:6660] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acpqKaP5HurqmbvwN-IvWgAAABU"]
[Mon Mar 30 20:18:50.128361 2026] [:error] [pid 11947:tid 11962] [client 20.91.240.203:16284] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acpqKjSVtzzXIgk-FgluhAAAAg0"]
[Mon Mar 30 20:18:51.171288 2026] [:error] [pid 35248:tid 35266] [client 20.91.240.203:28609] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "acpqK73igMCgAQPFS_-iVQAAAEw"]
[Mon Mar 30 20:18:52.302208 2026] [:error] [pid 11947:tid 11961] [client 20.91.240.203:6332] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acpqLDSVtzzXIgk-FgluhgAAAgw"]
[Mon Mar 30 20:18:53.192749 2026] [:error] [pid 11947:tid 11963] [client 20.91.240.203:6946] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acpqLTSVtzzXIgk-FgluigAAAg4"]
[Mon Mar 30 20:18:54.739273 2026] [:error] [pid 35343:tid 35351] [client 20.91.240.203:6289] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acpqLqP5HurqmbvwN-IvZAAAAAY"]
[Mon Mar 30 20:18:56.696290 2026] [:error] [pid 11947:tid 11959] [client 20.91.240.203:46129] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "acpqMDSVtzzXIgk-FglulgAAAgo"]
[Mon Mar 30 20:18:59.089838 2026] [:error] [pid 35248:tid 35274] [client 20.91.240.203:48460] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acpqM73igMCgAQPFS_-iXQAAAFQ"]
[Mon Mar 30 20:19:00.887729 2026] [:error] [pid 35248:tid 35268] [client 20.91.240.203:28629] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acpqNL3igMCgAQPFS_-iXwAAAE4"]
[Mon Mar 30 20:19:04.500541 2026] [:error] [pid 11947:tid 11965] [client 20.91.240.203:23486] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acpqODSVtzzXIgk-FglusAAAAhA"]
[Mon Mar 30 20:19:08.596650 2026] [:error] [pid 11947:tid 11950] [client 20.91.240.203:6751] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "acpqPDSVtzzXIgk-FgluwAAAAgE"]
[Mon Mar 30 20:19:11.013162 2026] [:error] [pid 11947:tid 11957] [client 20.91.240.203:9732] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sale.php"] [unique_id "acpqPzSVtzzXIgk-FgluyQAAAgg"]
[Mon Mar 30 20:19:12.021652 2026] [:error] [pid 12046:tid 12053] [client 20.91.240.203:6781] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sale.php"] [unique_id "acpqQJDbtlkoJ6ELn7ggOQAAAkQ"]
[Mon Mar 30 20:19:13.902142 2026] [:error] [pid 11947:tid 11955] [client 20.91.240.203:6322] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sale.php"] [unique_id "acpqQTSVtzzXIgk-Fglu1gAAAgY"]
[Mon Mar 30 20:19:16.352519 2026] [:error] [pid 11947:tid 11971] [client 20.91.240.203:27054] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sale.php"] [unique_id "acpqRDSVtzzXIgk-Fglu6AAAAhY"]
[Mon Mar 30 20:19:20.039059 2026] [:error] [pid 35248:tid 35262] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Mon Mar 30 20:19:20.306310 2026] [:error] [pid 35248:tid 35272] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/2ksm17n.php
[Mon Mar 30 20:19:20.588268 2026] [:error] [pid 35248:tid 35266] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Mar 30 20:19:20.854337 2026] [:error] [pid 35248:tid 35256] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/hots.php
[Mon Mar 30 20:19:21.119398 2026] [:error] [pid 35248:tid 35261] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Mon Mar 30 20:19:21.397161 2026] [:error] [pid 35248:tid 35254] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 30 20:19:21.816274 2026] [:error] [pid 35248:tid 35254] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Mon Mar 30 20:19:22.104937 2026] [:error] [pid 35248:tid 35269] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Mon Mar 30 20:19:22.408754 2026] [:error] [pid 35248:tid 35270] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Mon Mar 30 20:19:22.676735 2026] [:error] [pid 35248:tid 35267] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Mon Mar 30 20:19:22.946714 2026] [:error] [pid 35248:tid 35259] [client 20.91.240.203:29153] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Mon Mar 30 20:19:23.209770 2026] [:error] [pid 35248:tid 35278] [client 20.91.240.203:29153] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "acpqS73igMCgAQPFS_-ifgAAAFg"]
[Mon Mar 30 20:19:24.329439 2026] [:error] [pid 11947:tid 11960] [client 20.91.240.203:30680] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "acpqTDSVtzzXIgk-FglvAAAAAgs"]
[Mon Mar 30 20:19:26.027615 2026] [:error] [pid 35250:tid 35317] [client 20.91.240.203:23472] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "acpqToaKM1MR6zcp2YNy7AAAAMY"]
[Mon Mar 30 20:19:27.958857 2026] [:error] [pid 50663:tid 50672] [client 20.91.240.203:12865] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws83.php"] [unique_id "acpqT228b9DKIAMEdfA4lgAAAYc"]
[Mon Mar 30 20:19:29.144431 2026] [:error] [pid 50663:tid 50679] [client 20.91.240.203:29167] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/56c53.php"] [unique_id "acpqUW28b9DKIAMEdfA4nAAAAY4"]
[Mon Mar 30 20:19:30.782725 2026] [:error] [pid 50663:tid 50685] [client 20.91.240.203:18292] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/56c53.php"] [unique_id "acpqUm28b9DKIAMEdfA4pAAAAZQ"]
[Mon Mar 30 20:19:33.401105 2026] [:error] [pid 50663:tid 50684] [client 20.91.240.203:23476] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/56c53.php"] [unique_id "acpqVW28b9DKIAMEdfA4pwAAAZM"]
[Mon Mar 30 20:19:34.362116 2026] [:error] [pid 50663:tid 50678] [client 20.91.240.203:56145] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/56c53.php"] [unique_id "acpqVm28b9DKIAMEdfA4rAAAAY0"]
[Mon Mar 30 20:19:36.033807 2026] [:error] [pid 41941:tid 41947] [client 20.91.240.203:45674] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "acpqWCB2g7BNCXGBOJN5rgAAAQQ"]
[Mon Mar 30 20:19:37.340122 2026] [:error] [pid 35248:tid 35260] [client 20.91.240.203:26529] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "acpqWb3igMCgAQPFS_-ihwAAAEY"]
[Mon Mar 30 20:19:38.584779 2026] [:error] [pid 11947:tid 11964] [client 20.91.240.203:29148] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "acpqWjSVtzzXIgk-FglvEgAAAg8"]
[Mon Mar 30 20:19:40.934874 2026] [:error] [pid 35343:tid 35369] [client 20.91.240.203:16643] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "acpqXKP5HurqmbvwN-IvhwAAABg"]
[Mon Mar 30 20:19:42.165118 2026] [:error] [pid 50663:tid 50680] [client 20.91.240.203:26515] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "acpqXm28b9DKIAMEdfA4wgAAAY8"]
[Mon Mar 30 20:19:45.006135 2026] [:error] [pid 35249:tid 35288] [client 20.91.240.203:42038] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "acpqYSqCKiTq85d6rgBYrAAAAIQ"]
[Mon Mar 30 20:19:49.090848 2026] [:error] [pid 35250:tid 35313] [client 20.91.240.203:56122] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "acpqZYaKM1MR6zcp2YNzAwAAAMI"]
[Mon Mar 30 20:19:51.669194 2026] [:error] [pid 35250:tid 35316] [client 20.91.240.203:61053] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "acpqZ4aKM1MR6zcp2YNzCAAAAMU"]
[Mon Mar 30 20:19:53.972683 2026] [:error] [pid 41941:tid 41961] [client 20.91.240.203:39600] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acpqaSB2g7BNCXGBOJN5uAAAARI"]
[Mon Mar 30 20:19:56.876479 2026] [:error] [pid 35248:tid 35264] [client 20.91.240.203:65222] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acpqbL3igMCgAQPFS_-ioAAAAEo"]
[Mon Mar 30 20:19:58.868120 2026] [:error] [pid 50663:tid 50672] [client 20.91.240.203:15506] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acpqbm28b9DKIAMEdfA4zgAAAYc"]
[Mon Mar 30 20:20:02.158104 2026] [:error] [pid 35248:tid 35267] [client 20.91.240.203:58034] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "acpqcr3igMCgAQPFS_-isQAAAE0"]
[Mon Mar 30 20:20:06.020218 2026] [:error] [pid 50663:tid 50682] [client 20.91.240.203:24966] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bo.php"] [unique_id "acpqdm28b9DKIAMEdfA42AAAAZE"]
[Mon Mar 30 20:20:07.958617 2026] [:error] [pid 50663:tid 50676] [client 20.91.240.203:15543] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bo.php"] [unique_id "acpqd228b9DKIAMEdfA45wAAAYs"]
[Mon Mar 30 20:20:11.496642 2026] [:error] [pid 64743:tid 64745] [client 20.91.240.203:40154] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bo.php"] [unique_id "acpqeyzmpVL6Ubzil4imzwAAAUA"]
[Mon Mar 30 20:20:12.690532 2026] [:error] [pid 35249:tid 35307] [client 20.91.240.203:36408] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bo.php"] [unique_id "acpqfCqCKiTq85d6rgBYtQAAAJc"]
[Mon Mar 30 20:20:13.390859 2026] [:error] [pid 11947:tid 11969] [client 20.91.240.203:6467] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acpqfTSVtzzXIgk-FglvYAAAAhQ"]
[Mon Mar 30 20:20:14.762041 2026] [:error] [pid 12106:tid 12112] [client 20.91.240.203:28061] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acpqfrIKxOs8TAdw7hceHgAAAoQ"]
[Mon Mar 30 20:20:17.051451 2026] [:error] [pid 11947:tid 11953] [client 20.91.240.203:32022] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acpqgTSVtzzXIgk-FglvZAAAAgQ"]
[Mon Mar 30 20:20:18.400450 2026] [:error] [pid 12106:tid 12128] [client 20.91.240.203:47966] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5b9ac.php"] [unique_id "acpqgrIKxOs8TAdw7hceJgAAApQ"]
[Mon Mar 30 20:20:21.479843 2026] [:error] [pid 50663:tid 50682] [client 20.91.240.203:32050] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acpqhW28b9DKIAMEdfA5CgAAAZE"]
[Mon Mar 30 20:20:25.074592 2026] [:error] [pid 41941:tid 41948] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Mon Mar 30 20:20:25.359323 2026] [:error] [pid 41941:tid 41954] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Mon Mar 30 20:20:25.642078 2026] [:error] [pid 41941:tid 41953] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Mon Mar 30 20:20:25.909699 2026] [:error] [pid 41941:tid 41952] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Mon Mar 30 20:20:26.178059 2026] [:error] [pid 41941:tid 41959] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Mon Mar 30 20:20:26.467961 2026] [:error] [pid 41941:tid 41963] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Mon Mar 30 20:20:26.734772 2026] [:error] [pid 41941:tid 41946] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Mon Mar 30 20:20:27.021923 2026] [:error] [pid 41941:tid 41951] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Mon Mar 30 20:20:27.289710 2026] [:error] [pid 41941:tid 41955] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Mon Mar 30 20:20:27.556061 2026] [:error] [pid 41941:tid 41949] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/6kDPjgFTmvS.php
[Mon Mar 30 20:20:27.823601 2026] [:error] [pid 41941:tid 41958] [client 20.91.240.203:35157] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Mon Mar 30 20:20:28.087384 2026] [:error] [pid 41941:tid 41957] [client 20.91.240.203:35157] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "acpqjCB2g7BNCXGBOJN52gAAAQ4"]
[Mon Mar 30 20:20:29.814973 2026] [:error] [pid 35249:tid 35288] [client 20.91.240.203:61118] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "acpqjSqCKiTq85d6rgBYxAAAAIQ"]
[Mon Mar 30 20:20:30.929691 2026] [:error] [pid 64743:tid 64745] [client 20.91.240.203:35779] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "acpqjizmpVL6Ubzil4im2QAAAUA"]
[Mon Mar 30 20:20:31.955683 2026] [:error] [pid 35248:tid 35272] [client 20.91.240.203:34109] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws81.php"] [unique_id "acpqj73igMCgAQPFS_-i2QAAAFI"]
[Mon Mar 30 20:20:33.066660 2026] [:error] [pid 35248:tid 35270] [client 20.91.240.203:27607] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/ws49.php"] [unique_id "acpqkb3igMCgAQPFS_-i2wAAAFA"]
[Mon Mar 30 20:20:34.579910 2026] [:error] [pid 11947:tid 11954] [client 20.91.240.203:43384] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/ws49.php"] [unique_id "acpqkjSVtzzXIgk-FglvfQAAAgU"]
[Mon Mar 30 20:20:37.366162 2026] [:error] [pid 35343:tid 35363] [client 20.91.240.203:15562] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/ws49.php"] [unique_id "acpqlaP5HurqmbvwN-IvoQAAABI"]
[Mon Mar 30 20:20:40.547097 2026] [:error] [pid 41941:tid 41967] [client 20.91.240.203:6848] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/ws49.php"] [unique_id "acpqmCB2g7BNCXGBOJN56AAAARg"]
[Mon Mar 30 20:20:43.937398 2026] [:error] [pid 64743:tid 64751] [client 20.91.240.203:49083] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acpqmyzmpVL6Ubzil4im6QAAAUY"]
[Mon Mar 30 20:20:47.705078 2026] [:error] [pid 35249:tid 35307] [client 20.91.240.203:34630] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acpqnyqCKiTq85d6rgBYywAAAJc"]
[Mon Mar 30 20:20:51.065609 2026] [:error] [pid 12046:tid 12065] [client 20.91.240.203:34668] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acpqo5DbtlkoJ6ELn7ggWgAAAlA"]
[Mon Mar 30 20:20:53.522957 2026] [:error] [pid 41941:tid 41945] [client 20.91.240.203:21112] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gfd.php"] [unique_id "acpqpSB2g7BNCXGBOJN5-QAAAQI"]
[Mon Mar 30 20:20:56.746344 2026] [:error] [pid 64743:tid 64750] [client 20.91.240.203:26062] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "acpqqCzmpVL6Ubzil4im9wAAAUU"]
[Mon Mar 30 20:20:59.740582 2026] [:error] [pid 50663:tid 50684] [client 20.91.240.203:62814] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "acpqq228b9DKIAMEdfA5MgAAAZM"]
[Mon Mar 30 20:21:01.748586 2026] [:error] [pid 64743:tid 64748] [client 20.91.240.203:50365] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "acpqrSzmpVL6Ubzil4im-gAAAUM"]
[Mon Mar 30 20:21:03.198056 2026] [:error] [pid 11947:tid 11950] [client 20.91.240.203:6999] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "acpqrzSVtzzXIgk-FglviAAAAgE"]
[Mon Mar 30 20:21:05.299314 2026] [:error] [pid 11947:tid 11972] [client 20.91.240.203:16383] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amp.php"] [unique_id "acpqsTSVtzzXIgk-FglvlgAAAhc"]
[Mon Mar 30 20:21:06.994673 2026] [:error] [pid 35250:tid 35331] [client 20.91.240.203:10531] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amp.php"] [unique_id "acpqsoaKM1MR6zcp2YNzdwAAANQ"]
[Mon Mar 30 20:21:09.099439 2026] [:error] [pid 50663:tid 50674] [client 20.91.240.203:7032] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amp.php"] [unique_id "acpqtW28b9DKIAMEdfA5UQAAAYk"]
[Mon Mar 30 20:21:09.796753 2026] [:error] [pid 12046:tid 12051] [client 20.91.240.203:20581] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amp.php"] [unique_id "acpqtZDbtlkoJ6ELn7ggagAAAkI"]
[Mon Mar 30 20:21:10.740561 2026] [:error] [pid 35248:tid 35269] [client 20.91.240.203:18180] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws75.php"] [unique_id "acpqtr3igMCgAQPFS_-jCgAAAE8"]
[Mon Mar 30 20:21:13.310813 2026] [:error] [pid 41941:tid 41967] [client 20.91.240.203:50337] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws75.php"] [unique_id "acpquSB2g7BNCXGBOJN6BgAAARg"]
[Mon Mar 30 20:21:15.170401 2026] [:error] [pid 11947:tid 11955] [client 20.91.240.203:20602] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws75.php"] [unique_id "acpquzSVtzzXIgk-FglvrgAAAgY"]
[Mon Mar 30 20:21:16.406043 2026] [:error] [pid 50663:tid 50669] [client 20.91.240.203:23501] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws75.php"] [unique_id "acpqvG28b9DKIAMEdfA5VgAAAYQ"]
[Mon Mar 30 20:21:17.924786 2026] [:error] [pid 35250:tid 35333] [client 20.91.240.203:23504] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/install.php"] [unique_id "acpqvYaKM1MR6zcp2YNzhwAAANY"]
[Mon Mar 30 20:21:19.529633 2026] [:error] [pid 11947:tid 11963] [client 20.91.240.203:20550] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/install.php"] [unique_id "acpqvzSVtzzXIgk-FglvvwAAAg4"]
[Mon Mar 30 20:21:20.235157 2026] [:error] [pid 11947:tid 11969] [client 20.91.240.203:55495] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/install.php"] [unique_id "acpqwDSVtzzXIgk-FglvwQAAAhQ"]
[Mon Mar 30 20:21:23.409583 2026] [:error] [pid 50663:tid 50679] [client 20.91.240.203:10959] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/install.php"] [unique_id "acpqw228b9DKIAMEdfA5XQAAAY4"]
[Mon Mar 30 20:21:24.864101 2026] [:error] [pid 35343:tid 35346] [client 20.91.240.203:11698] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acpqxKP5HurqmbvwN-IvqQAAAAE"]
[Mon Mar 30 20:21:26.502564 2026] [:error] [pid 11947:tid 11954] [client 20.91.240.203:11372] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maul.php"] [unique_id "acpqxjSVtzzXIgk-Fglv2QAAAgU"]
[Mon Mar 30 20:21:27.850536 2026] [:error] [pid 35248:tid 35257] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/maul.php
[Mon Mar 30 20:21:28.139570 2026] [:error] [pid 35248:tid 35260] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/lowpr.php
[Mon Mar 30 20:21:28.425923 2026] [:error] [pid 35248:tid 35265] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Mon Mar 30 20:21:28.707513 2026] [:error] [pid 35248:tid 35263] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Mon Mar 30 20:21:28.975828 2026] [:error] [pid 35248:tid 35271] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Mon Mar 30 20:21:29.243296 2026] [:error] [pid 35248:tid 35273] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Mon Mar 30 20:21:29.716936 2026] [:error] [pid 35248:tid 35277] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Mon Mar 30 20:21:29.995991 2026] [:error] [pid 35248:tid 35270] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Mon Mar 30 20:21:30.340628 2026] [:error] [pid 35248:tid 35261] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Mon Mar 30 20:21:30.611548 2026] [:error] [pid 35248:tid 35274] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/ne2026.php
[Mon Mar 30 20:21:30.877477 2026] [:error] [pid 35248:tid 35265] [client 20.91.240.203:11675] File does not exist: /usr/local/apache/htdocs/suspended-page/ws73.php
[Mon Mar 30 20:21:31.156610 2026] [:error] [pid 35248:tid 35278] [client 20.91.240.203:11675] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acpqy73igMCgAQPFS_-jQQAAAFg"]
[Mon Mar 30 20:21:35.860515 2026] [:error] [pid 35248:tid 35260] [client 20.91.240.203:28546] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acpqz73igMCgAQPFS_-jQwAAAEY"]
[Mon Mar 30 20:21:37.892898 2026] [:error] [pid 50663:tid 50665] [client 20.91.240.203:7146] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acpq0W28b9DKIAMEdfA5dAAAAYA"]
[Mon Mar 30 20:21:39.303026 2026] [:error] [pid 50663:tid 50670] [client 20.91.240.203:35084] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "acpq0228b9DKIAMEdfA5dwAAAYU"]
[Mon Mar 30 20:21:40.860780 2026] [:error] [pid 35250:tid 35321] [client 20.91.240.203:14424] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "acpq1IaKM1MR6zcp2YNzuwAAAMo"]
[Mon Mar 30 20:21:43.180289 2026] [:error] [pid 35250:tid 35316] [client 20.91.240.203:61650] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "acpq14aKM1MR6zcp2YNzwgAAAMU"]
[Mon Mar 30 20:21:45.105509 2026] [:error] [pid 35250:tid 35325] [client 20.91.240.203:59316] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "acpq2YaKM1MR6zcp2YNzygAAAM4"]
[Mon Mar 30 20:21:51.125182 2026] [:error] [pid 35250:tid 35311] [client 20.91.240.203:21987] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/baixy.php"] [unique_id "acpq34aKM1MR6zcp2YNz2AAAAMA"]
[Mon Mar 30 20:21:52.430052 2026] [:error] [pid 11947:tid 11972] [client 20.91.240.203:42747] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "acpq4DSVtzzXIgk-Fglv-gAAAhc"]
[Mon Mar 30 20:21:55.972317 2026] [:error] [pid 35250:tid 35325] [client 20.91.240.203:50399] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "acpq44aKM1MR6zcp2YNz5AAAAM4"]
[Mon Mar 30 20:21:59.320552 2026] [:error] [pid 50663:tid 50669] [client 20.91.240.203:47294] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "acpq5228b9DKIAMEdfA5lwAAAYQ"]
[Mon Mar 30 20:22:02.317596 2026] [:error] [pid 35248:tid 35270] [client 20.91.240.203:27557] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "acpq6r3igMCgAQPFS_-jXgAAAFA"]
[Mon Mar 30 20:22:04.823548 2026] [:error] [pid 11947:tid 11959] [client 20.91.240.203:32591] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "acpq7DSVtzzXIgk-FglwEgAAAgo"]
[Mon Mar 30 20:22:09.485896 2026] [:error] [pid 35250:tid 35321] [client 20.91.240.203:26021] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "acpq8YaKM1MR6zcp2YNz_wAAAMo"]
[Mon Mar 30 20:22:10.842755 2026] [:error] [pid 50663:tid 50683] [client 20.91.240.203:32622] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "acpq8m28b9DKIAMEdfA5qAAAAZI"]
[Mon Mar 30 20:22:11.977161 2026] [:error] [pid 35343:tid 35362] [client 20.91.240.203:24540] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "acpq86P5HurqmbvwN-IwLQAAABE"]
[Mon Mar 30 20:22:13.401544 2026] [:error] [pid 41941:tid 41946] [client 20.91.240.203:22941] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acpq9SB2g7BNCXGBOJN6OgAAAQM"]
[Mon Mar 30 20:22:14.468102 2026] [:error] [pid 64743:tid 64769] [client 20.91.240.203:6351] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acpq9izmpVL6Ubzil4inFAAAAVg"]
[Mon Mar 30 20:22:15.952980 2026] [:error] [pid 35248:tid 35255] [client 20.91.240.203:22961] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acpq973igMCgAQPFS_-jbwAAAEE"]
[Mon Mar 30 20:22:16.938907 2026] [:error] [pid 11947:tid 11950] [client 20.91.240.203:62378] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acpq-DSVtzzXIgk-FglwMwAAAgE"]
[Mon Mar 30 20:22:20.221658 2026] [:error] [pid 35249:tid 35308] [client 20.91.240.203:25984] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "acpq_CqCKiTq85d6rgBY8AAAAJg"]
[Mon Mar 30 20:22:21.097148 2026] [:error] [pid 11947:tid 11965] [client 20.91.240.203:9405] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "acpq_TSVtzzXIgk-FglwQwAAAhA"]
[Mon Mar 30 20:22:22.662694 2026] [:error] [pid 50663:tid 50677] [client 20.91.240.203:6374] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "acpq_m28b9DKIAMEdfA5sgAAAYw"]
[Mon Mar 30 20:22:25.070373 2026] [:error] [pid 50663:tid 50676] [client 20.91.240.203:12507] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "acprAW28b9DKIAMEdfA5tQAAAYs"]
[Mon Mar 30 20:22:26.534015 2026] [:error] [pid 11947:tid 11966] [client 20.91.240.203:12518] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5e0a.php"] [unique_id "acprAjSVtzzXIgk-FglwUgAAAhE"]
[Mon Mar 30 20:22:27.440223 2026] [:error] [pid 12046:tid 12062] [client 20.91.240.203:53720] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5e0a.php"] [unique_id "acprA5DbtlkoJ6ELn7ggigAAAk0"]
[Mon Mar 30 20:22:28.705817 2026] [:error] [pid 35248:tid 35263] [client 20.91.240.203:32635] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5e0a.php"] [unique_id "acprBL3igMCgAQPFS_-joAAAAEk"]
[Mon Mar 30 20:22:30.200285 2026] [:error] [pid 12046:tid 12058] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/a5e0a.php
[Mon Mar 30 20:22:30.740858 2026] [:error] [pid 12046:tid 12073] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Mon Mar 30 20:22:31.193365 2026] [:error] [pid 12046:tid 12059] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Mon Mar 30 20:22:31.504480 2026] [:error] [pid 12046:tid 12057] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/55b76.php
[Mon Mar 30 20:22:31.773531 2026] [:error] [pid 12046:tid 12069] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Mon Mar 30 20:22:32.045075 2026] [:error] [pid 12046:tid 12065] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Mon Mar 30 20:22:32.324038 2026] [:error] [pid 12046:tid 12054] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Mon Mar 30 20:22:32.751658 2026] [:error] [pid 12046:tid 12068] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Mon Mar 30 20:22:33.020540 2026] [:error] [pid 12046:tid 12052] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/drhunthq.php
[Mon Mar 30 20:22:33.653059 2026] [:error] [pid 12046:tid 12051] [client 20.91.240.203:8629] File does not exist: /usr/local/apache/htdocs/suspended-page/xxw.php
[Mon Mar 30 20:22:33.926664 2026] [:error] [pid 12046:tid 12071] [client 20.91.240.203:8629] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acprCZDbtlkoJ6ELn7ggmQAAAlY"]
[Mon Mar 30 20:22:34.941574 2026] [:error] [pid 41941:tid 41959] [client 20.91.240.203:24561] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acprCiB2g7BNCXGBOJN6RQAAARA"]
[Mon Mar 30 20:22:37.159641 2026] [:error] [pid 35343:tid 35346] [client 20.91.240.203:12857] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acprDaP5HurqmbvwN-IwQQAAAAE"]
[Mon Mar 30 20:22:38.564606 2026] [:error] [pid 11947:tid 11965] [client 20.91.240.203:62342] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "acprDjSVtzzXIgk-FglwagAAAhA"]
[Mon Mar 30 20:22:42.481592 2026] [:error] [pid 11947:tid 11968] [client 20.91.240.203:8632] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "acprEjSVtzzXIgk-FglwbQAAAhM"]
[Mon Mar 30 20:22:44.504370 2026] [:error] [pid 35250:tid 35319] [client 20.91.240.203:53759] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "acprFIaKM1MR6zcp2YN0KQAAAMg"]
[Mon Mar 30 20:22:46.011872 2026] [:error] [pid 35250:tid 35325] [client 20.91.240.203:15195] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "acprFoaKM1MR6zcp2YN0LwAAAM4"]
[Mon Mar 30 20:22:49.725547 2026] [:error] [pid 12046:tid 12073] [client 20.91.240.203:13652] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws87.php"] [unique_id "acprGZDbtlkoJ6ELn7ggngAAAlg"]
[Mon Mar 30 20:22:51.730930 2026] [:error] [pid 64743:tid 64745] [client 20.91.240.203:15189] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "acprGyzmpVL6Ubzil4inGgAAAUA"]
[Mon Mar 30 20:22:52.719320 2026] [:error] [pid 11947:tid 11961] [client 20.91.240.203:53742] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "acprHDSVtzzXIgk-FglwdwAAAgw"]
[Mon Mar 30 20:22:53.842615 2026] [:error] [pid 50663:tid 50685] [client 20.91.240.203:10168] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "acprHW28b9DKIAMEdfA56AAAAZQ"]
[Mon Mar 30 20:22:55.102614 2026] [:error] [pid 50663:tid 50682] [client 20.91.240.203:24527] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lm15.php"] [unique_id "acprH228b9DKIAMEdfA56gAAAZE"]
[Mon Mar 30 20:22:56.024729 2026] [:error] [pid 35248:tid 35265] [client 20.91.240.203:8595] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "acprIL3igMCgAQPFS_-juQAAAEs"]
[Mon Mar 30 20:22:57.310284 2026] [:error] [pid 11947:tid 11952] [client 20.91.240.203:10141] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "acprITSVtzzXIgk-FglwhQAAAgM"]
[Mon Mar 30 20:22:58.260911 2026] [:error] [pid 35250:tid 35335] [client 20.91.240.203:53715] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "acprIoaKM1MR6zcp2YN0OgAAANg"]
[Mon Mar 30 20:22:59.413498 2026] [:error] [pid 11947:tid 11971] [client 20.91.240.203:42630] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/green.php"] [unique_id "acprIzSVtzzXIgk-FglwiwAAAhY"]
[Mon Mar 30 20:23:00.329685 2026] [:error] [pid 50663:tid 50687] [client 20.91.240.203:10117] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "acprJG28b9DKIAMEdfA59AAAAZY"]
[Mon Mar 30 20:23:03.094924 2026] [:error] [pid 50663:tid 50669] [client 20.91.240.203:12497] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "acprJ228b9DKIAMEdfA6AAAAAYQ"]
[Mon Mar 30 20:23:04.637884 2026] [:error] [pid 35250:tid 35330] [client 20.91.240.203:10125] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "acprKIaKM1MR6zcp2YN0PgAAANM"]
[Mon Mar 30 20:23:06.119922 2026] [:error] [pid 11947:tid 11956] [client 20.91.240.203:35745] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "acprKjSVtzzXIgk-FglwmgAAAgc"]
[Mon Mar 30 20:23:07.845477 2026] [:error] [pid 11947:tid 11969] [client 20.91.240.203:20992] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acprKzSVtzzXIgk-FglwngAAAhQ"]
[Mon Mar 30 20:23:09.583552 2026] [:error] [pid 35343:tid 35352] [client 20.91.240.203:15172] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acprLaP5HurqmbvwN-IwTwAAAAc"]
[Mon Mar 30 20:23:12.410050 2026] [:error] [pid 35250:tid 35333] [client 20.91.240.203:12859] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acprMIaKM1MR6zcp2YN0QAAAANY"]
[Mon Mar 30 20:23:13.530603 2026] [:error] [pid 35248:tid 35268] [client 20.91.240.203:42644] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "acprMb3igMCgAQPFS_-j0wAAAE4"]
[Mon Mar 30 20:23:14.528439 2026] [:error] [pid 12106:tid 12110] [client 20.91.240.203:12480] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "acprMrIKxOs8TAdw7hceewAAAoI"]
[Mon Mar 30 20:23:15.760410 2026] [:error] [pid 12106:tid 12132] [client 20.91.240.203:10167] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "acprM7IKxOs8TAdw7hcefwAAApg"]
[Mon Mar 30 20:23:16.509689 2026] [:error] [pid 12106:tid 12121] [client 20.91.240.203:6390] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "acprNLIKxOs8TAdw7hcegwAAAo0"]
[Mon Mar 30 20:23:17.715126 2026] [:error] [pid 35248:tid 35274] [client 20.91.240.203:12844] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "acprNb3igMCgAQPFS_-j2wAAAFQ"]
[Mon Mar 30 20:23:19.041883 2026] [:error] [pid 11947:tid 11960] [client 20.91.240.203:46593] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acprNzSVtzzXIgk-FglwswAAAgs"]
[Mon Mar 30 20:23:21.098868 2026] [:error] [pid 35250:tid 35324] [client 20.91.240.203:17899] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acprOYaKM1MR6zcp2YN0RgAAAM0"]
[Mon Mar 30 20:23:21.832737 2026] [:error] [pid 12106:tid 12127] [client 20.91.240.203:8592] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acprObIKxOs8TAdw7hcejAAAApM"]
[Mon Mar 30 20:23:26.382210 2026] [:error] [pid 12106:tid 12118] [client 20.91.240.203:53746] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "acprPrIKxOs8TAdw7hcejgAAAoo"]
[Mon Mar 30 20:23:31.176355 2026] [:error] [pid 35343:tid 35356] [client 20.91.240.203:15214] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "acprQ6P5HurqmbvwN-IwXQAAAAs"]
[Mon Mar 30 20:23:33.416642 2026] [:error] [pid 11947:tid 11952] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Mon Mar 30 20:23:33.681303 2026] [:error] [pid 11947:tid 11972] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Mon Mar 30 20:23:34.217339 2026] [:error] [pid 11947:tid 11953] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Mon Mar 30 20:23:34.500587 2026] [:error] [pid 11947:tid 11964] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Mon Mar 30 20:23:34.768538 2026] [:error] [pid 11947:tid 11965] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Mon Mar 30 20:23:35.037063 2026] [:error] [pid 11947:tid 11957] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax.php
[Mon Mar 30 20:23:35.321187 2026] [:error] [pid 11947:tid 11958] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Mon Mar 30 20:23:37.158092 2026] [:error] [pid 11947:tid 11949] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Mon Mar 30 20:23:37.424028 2026] [:error] [pid 11947:tid 11961] [client 20.91.240.203:22972] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Mon Mar 30 20:23:37.686700 2026] [:error] [pid 11947:tid 11965] [client 20.91.240.203:22972] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws60.php"] [unique_id "acprSTSVtzzXIgk-Fglw1QAAAhA"]
[Mon Mar 30 20:23:39.206075 2026] [:error] [pid 11947:tid 11953] [client 20.91.240.203:19776] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws60.php"] [unique_id "acprSzSVtzzXIgk-Fglw3QAAAgQ"]
[Mon Mar 30 20:23:42.193421 2026] [:error] [pid 64743:tid 64769] [client 20.91.240.203:25544] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws60.php"] [unique_id "acprTizmpVL6Ubzil4inKQAAAVg"]
[Mon Mar 30 20:23:43.347260 2026] [:error] [pid 50663:tid 50686] [client 20.91.240.203:43302] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws60.php"] [unique_id "acprT228b9DKIAMEdfA6NwAAAZU"]
[Mon Mar 30 20:23:44.887749 2026] [:error] [pid 12106:tid 12125] [client 20.91.240.203:22926] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acprULIKxOs8TAdw7hcelQAAApE"]
[Mon Mar 30 20:23:45.666606 2026] [:error] [pid 41941:tid 41959] [client 20.91.240.203:12500] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acprUSB2g7BNCXGBOJN6eAAAARA"]
[Mon Mar 30 20:23:47.039535 2026] [:error] [pid 12046:tid 12067] [client 20.91.240.203:55454] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acprU5DbtlkoJ6ELn7gguAAAAlI"]
[Mon Mar 30 20:23:48.284010 2026] [:error] [pid 11947:tid 11971] [client 20.91.240.203:22942] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "acprVDSVtzzXIgk-Fglw6QAAAhY"]
[Mon Mar 30 20:23:49.931392 2026] [:error] [pid 50663:tid 50678] [client 20.91.240.203:53713] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acprVW28b9DKIAMEdfA6SQAAAY0"]
[Mon Mar 30 20:23:51.138903 2026] [:error] [pid 50663:tid 50674] [client 20.91.240.203:30652] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acprV228b9DKIAMEdfA6TgAAAYk"]
[Mon Mar 30 20:23:52.553283 2026] [:error] [pid 50663:tid 50681] [client 20.91.240.203:9777] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acprWG28b9DKIAMEdfA6UAAAAZA"]
[Mon Mar 30 20:23:54.721182 2026] [:error] [pid 35250:tid 35322] [client 20.91.240.203:62390] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buc.php"] [unique_id "acprWoaKM1MR6zcp2YN0WQAAAMs"]
[Mon Mar 30 20:23:56.880589 2026] [:error] [pid 50663:tid 50673] [client 20.91.240.203:12513] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acprXG28b9DKIAMEdfA6XgAAAYg"]
[Mon Mar 30 20:23:59.145943 2026] [:error] [pid 41941:tid 41949] [client 20.91.240.203:6972] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acprXyB2g7BNCXGBOJN6hAAAAQY"]
[Mon Mar 30 20:24:01.109424 2026] [:error] [pid 50663:tid 50682] [client 20.91.240.203:51068] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acprYW28b9DKIAMEdfA6agAAAZE"]
[Mon Mar 30 20:24:02.563419 2026] [:error] [pid 11947:tid 11954] [client 20.91.240.203:6839] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/myfile.php"] [unique_id "acprYjSVtzzXIgk-Fglw-QAAAgU"]
[Mon Mar 30 20:24:05.415532 2026] [:error] [pid 64743:tid 64754] [client 20.91.240.203:9001] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acprZSzmpVL6Ubzil4inLgAAAUk"]
[Mon Mar 30 20:24:08.110327 2026] [:error] [pid 12106:tid 12130] [client 20.91.240.203:28614] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acpraLIKxOs8TAdw7hcenQAAApY"]
[Mon Mar 30 20:24:10.778067 2026] [:error] [pid 64743:tid 64751] [client 20.91.240.203:12507] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acpraizmpVL6Ubzil4inNAAAAUY"]
[Mon Mar 30 20:24:12.299313 2026] [:error] [pid 35343:tid 35365] [client 20.91.240.203:12060] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "acprbKP5HurqmbvwN-IweAAAABQ"]
[Mon Mar 30 20:24:14.275527 2026] [:error] [pid 12106:tid 12126] [client 20.91.240.203:23427] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "acprbrIKxOs8TAdw7hceogAAApI"]
[Mon Mar 30 20:24:15.934455 2026] [:error] [pid 12046:tid 12071] [client 20.91.240.203:12032] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "acprb5DbtlkoJ6ELn7ggywAAAlY"]
[Mon Mar 30 20:24:17.265502 2026] [:error] [pid 50663:tid 50686] [client 20.91.240.203:46653] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "acprcW28b9DKIAMEdfA6igAAAZU"]
[Mon Mar 30 20:24:20.995805 2026] [:error] [pid 50663:tid 50689] [client 20.91.240.203:23482] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/okxh.php"] [unique_id "acprdG28b9DKIAMEdfA6jAAAAZg"]
[Mon Mar 30 20:24:23.589481 2026] [:error] [pid 35249:tid 35302] [client 20.91.240.203:31124] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acprdyqCKiTq85d6rgBZEwAAAJI"]
[Mon Mar 30 20:24:27.525154 2026] [:error] [pid 35343:tid 35362] [client 20.91.240.203:29169] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acpre6P5HurqmbvwN-IwhAAAABE"]
[Mon Mar 30 20:24:29.860955 2026] [:error] [pid 35249:tid 35288] [client 20.91.240.203:6319] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acprfSqCKiTq85d6rgBZHwAAAIQ"]
[Mon Mar 30 20:24:31.824439 2026] [:error] [pid 50663:tid 50685] [client 20.91.240.203:61003] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acprf228b9DKIAMEdfA6kAAAAZQ"]
[Mon Mar 30 20:24:37.345905 2026] [:error] [pid 11947:tid 11951] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-104.php
[Mon Mar 30 20:24:37.626304 2026] [:error] [pid 11947:tid 11962] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Mon Mar 30 20:24:38.219709 2026] [:error] [pid 11947:tid 11968] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Mon Mar 30 20:24:38.487988 2026] [:error] [pid 11947:tid 11951] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon Mar 30 20:24:38.754463 2026] [:error] [pid 11947:tid 11969] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Mon Mar 30 20:24:39.024959 2026] [:error] [pid 11947:tid 11967] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/xfun.php
[Mon Mar 30 20:24:39.291357 2026] [:error] [pid 11947:tid 11957] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Mon Mar 30 20:24:39.557800 2026] [:error] [pid 11947:tid 11964] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Mon Mar 30 20:24:39.824393 2026] [:error] [pid 11947:tid 11958] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/rzki.php
[Mon Mar 30 20:24:40.090978 2026] [:error] [pid 11947:tid 11959] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Mar 30 20:24:40.363492 2026] [:error] [pid 11947:tid 11968] [client 20.91.240.203:16268] File does not exist: /usr/local/apache/htdocs/suspended-page/ws49.php
[Mon Mar 30 20:24:40.647479 2026] [:error] [pid 11947:tid 11963] [client 20.91.240.203:16268] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acpriDSVtzzXIgk-FglxPQAAAg4"]
[Mon Mar 30 20:24:43.435171 2026] [:error] [pid 35250:tid 35325] [client 20.91.240.203:62319] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acpri4aKM1MR6zcp2YN0gQAAAM4"]
[Mon Mar 30 20:24:46.527640 2026] [:error] [pid 35248:tid 35263] [client 20.91.240.203:18598] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acprjr3igMCgAQPFS_-kFAAAAEk"]
[Mon Mar 30 20:24:47.821025 2026] [:error] [pid 35248:tid 35277] [client 20.91.240.203:39587] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "acprj73igMCgAQPFS_-kGgAAAFc"]
[Mon Mar 30 20:24:49.661643 2026] [:error] [pid 12046:tid 12051] [client 20.91.240.203:54312] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "acprkZDbtlkoJ6ELn7gg3AAAAkI"]
[Mon Mar 30 20:24:52.426637 2026] [:error] [pid 35248:tid 35268] [client 20.91.240.203:21477] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "acprlL3igMCgAQPFS_-kVgAAAE4"]
[Mon Mar 30 20:24:54.545820 2026] [:error] [pid 35343:tid 35345] [client 20.91.240.203:31134] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "acprlqP5HurqmbvwN-IwqgAAAAA"]
[Mon Mar 30 20:24:55.620070 2026] [:error] [pid 35250:tid 35323] [client 20.91.240.203:39640] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "acprl4aKM1MR6zcp2YN0jgAAAMw"]
[Mon Mar 30 20:24:57.970202 2026] [:error] [pid 50663:tid 50666] [client 20.91.240.203:31122] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vanda.php"] [unique_id "acprmW28b9DKIAMEdfA6pAAAAYE"]
[Mon Mar 30 20:24:59.596731 2026] [:error] [pid 11947:tid 11957] [client 20.91.240.203:39576] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vanda.php"] [unique_id "acprmzSVtzzXIgk-FglxSgAAAgg"]
[Mon Mar 30 20:25:03.273341 2026] [:error] [pid 11947:tid 11961] [client 20.91.240.203:37107] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vanda.php"] [unique_id "acprnzSVtzzXIgk-FglxUgAAAgw"]
[Mon Mar 30 20:25:07.074650 2026] [:error] [pid 12106:tid 12118] [client 20.91.240.203:39632] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vanda.php"] [unique_id "acpro7IKxOs8TAdw7hce7gAAAoo"]
[Mon Mar 30 20:25:09.226352 2026] [:error] [pid 35343:tid 35369] [client 20.91.240.203:15935] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "acprpaP5HurqmbvwN-IwsgAAABg"]
[Mon Mar 30 20:25:10.058870 2026] [:error] [pid 11947:tid 11958] [client 20.91.240.203:21447] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "acprpjSVtzzXIgk-FglxVAAAAgk"]
[Mon Mar 30 20:25:11.432063 2026] [:error] [pid 11947:tid 11973] [client 20.91.240.203:33110] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "acprpzSVtzzXIgk-FglxVgAAAhg"]
[Mon Mar 30 20:25:12.563309 2026] [:error] [pid 12106:tid 12129] [client 20.91.240.203:18659] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "acprqLIKxOs8TAdw7hce8gAAApU"]
[Mon Mar 30 20:25:13.629714 2026] [:error] [pid 11947:tid 11965] [client 20.91.240.203:48448] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acprqTSVtzzXIgk-FglxWQAAAhA"]
[Mon Mar 30 20:25:15.309290 2026] [:error] [pid 12046:tid 12053] [client 20.91.240.203:27018] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acprq5DbtlkoJ6ELn7gg6wAAAkQ"]
[Mon Mar 30 20:25:16.760794 2026] [:error] [pid 64743:tid 64750] [client 20.91.240.203:27008] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acprrCzmpVL6Ubzil4inWwAAAUU"]
[Mon Mar 30 20:25:17.839706 2026] [:error] [pid 35250:tid 35320] [client 20.91.240.203:46661] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "acprrYaKM1MR6zcp2YN0pQAAAMk"]
[Mon Mar 30 20:25:18.654373 2026] [:error] [pid 41941:tid 41943] [client 20.91.240.203:37058] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acprriB2g7BNCXGBOJN6wAAAAQA"]
[Mon Mar 30 20:25:25.212608 2026] [:error] [pid 35250:tid 35319] [client 20.91.240.203:12864] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acprtYaKM1MR6zcp2YN0vAAAAMg"]
[Mon Mar 30 20:25:26.869715 2026] [:error] [pid 64743:tid 64763] [client 20.91.240.203:6788] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acprtizmpVL6Ubzil4inYQAAAVI"]
[Mon Mar 30 20:25:28.322809 2026] [:error] [pid 35250:tid 35318] [client 20.91.240.203:6750] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "acpruIaKM1MR6zcp2YN0vQAAAMc"]
[Mon Mar 30 20:25:29.261572 2026] [:error] [pid 11947:tid 11965] [client 20.91.240.203:6841] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "acpruTSVtzzXIgk-FglxZwAAAhA"]
[Mon Mar 30 20:25:30.131063 2026] [:error] [pid 35248:tid 35262] [client 20.91.240.203:39636] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "acprur3igMCgAQPFS_-kgQAAAEg"]
[Mon Mar 30 20:25:31.353704 2026] [:error] [pid 35248:tid 35258] [client 20.91.240.203:26552] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "acpru73igMCgAQPFS_-kiQAAAEQ"]
[Mon Mar 30 20:25:32.880250 2026] [:error] [pid 50663:tid 50684] [client 20.91.240.203:45682] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "acprvG28b9DKIAMEdfA60QAAAZM"]
[Mon Mar 30 20:25:33.747125 2026] [:error] [pid 50663:tid 50685] [client 20.91.240.203:32127] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acprvW28b9DKIAMEdfA61QAAAZQ"]
[Mon Mar 30 20:25:35.545677 2026] [:error] [pid 50663:tid 50687] [client 20.91.240.203:32090] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acprv228b9DKIAMEdfA62wAAAZY"]
[Mon Mar 30 20:25:36.509360 2026] [:error] [pid 35248:tid 35271] [client 20.91.240.203:39664] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acprwL3igMCgAQPFS_-kjAAAAFE"]
[Mon Mar 30 20:25:37.920181 2026] [:error] [pid 50663:tid 50672] [client 20.91.240.203:46660] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acprwW28b9DKIAMEdfA64gAAAYc"]
[Mon Mar 30 20:25:38.906185 2026] [:error] [pid 50663:tid 50684] [client 20.91.240.203:33150] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa21.php"] [unique_id "acprwm28b9DKIAMEdfA66QAAAZM"]
[Mon Mar 30 20:25:40.489909 2026] [:error] [pid 35248:tid 35262] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/aa21.php
[Mon Mar 30 20:25:40.774886 2026] [:error] [pid 35248:tid 35269] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Mon Mar 30 20:25:41.041457 2026] [:error] [pid 35248:tid 35268] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Mon Mar 30 20:25:41.328902 2026] [:error] [pid 35248:tid 35254] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/bootstrap.php
[Mon Mar 30 20:25:41.862180 2026] [:error] [pid 35248:tid 35267] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Mon Mar 30 20:25:42.128028 2026] [:error] [pid 35248:tid 35259] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/csv.php
[Mon Mar 30 20:25:42.427273 2026] [:error] [pid 35248:tid 35278] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/varb.php
[Mon Mar 30 20:25:42.692604 2026] [:error] [pid 35248:tid 35266] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Mon Mar 30 20:25:42.959093 2026] [:error] [pid 35248:tid 35257] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Mon Mar 30 20:25:43.244677 2026] [:error] [pid 35248:tid 35261] [client 20.91.240.203:39621] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Mon Mar 30 20:25:43.519410 2026] [:error] [pid 35248:tid 35256] [client 20.91.240.203:39621] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "acprx73igMCgAQPFS_-kpwAAAEI"]
[Mon Mar 30 20:25:47.107453 2026] [:error] [pid 35250:tid 35313] [client 20.91.240.203:54330] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "acpry4aKM1MR6zcp2YN0yQAAAMI"]
[Mon Mar 30 20:25:48.706371 2026] [:error] [pid 35248:tid 35276] [client 20.91.240.203:6780] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "acprzL3igMCgAQPFS_-kqAAAAFY"]
[Mon Mar 30 20:25:52.838421 2026] [:error] [pid 64743:tid 64749] [client 20.91.240.203:42644] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "acpr0CzmpVL6Ubzil4inaAAAAUQ"]
[Mon Mar 30 20:25:53.990302 2026] [:error] [pid 64743:tid 64769] [client 20.91.240.203:33113] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acpr0SzmpVL6Ubzil4inagAAAVg"]
[Mon Mar 30 20:25:54.992513 2026] [:error] [pid 12046:tid 12067] [client 20.91.240.203:37092] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acpr0pDbtlkoJ6ELn7gg-QAAAlI"]
[Mon Mar 30 20:25:57.698649 2026] [:error] [pid 50663:tid 50670] [client 20.91.240.203:6755] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acpr1W28b9DKIAMEdfA7CgAAAYU"]
[Mon Mar 30 20:25:58.709380 2026] [:error] [pid 12046:tid 12057] [client 20.91.240.203:26539] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "acpr1pDbtlkoJ6ELn7gg_AAAAkg"]
[Mon Mar 30 20:26:00.898764 2026] [:error] [pid 41941:tid 41946] [client 20.91.240.203:46687] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acpr2CB2g7BNCXGBOJN65AAAAQM"]
[Mon Mar 30 20:26:03.291770 2026] [:error] [pid 11947:tid 11950] [client 20.91.240.203:54305] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acpr2zSVtzzXIgk-FglxpQAAAgE"]
[Mon Mar 30 20:26:05.748192 2026] [:error] [pid 50663:tid 50685] [client 20.91.240.203:18684] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acpr3W28b9DKIAMEdfA7GQAAAZQ"]
[Mon Mar 30 20:26:07.729617 2026] [:error] [pid 35249:tid 35298] [client 20.91.240.203:46670] [client 20.91.240.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin-footer.php"] [unique_id "acpr3yqCKiTq85d6rgBZPgAAAI4"]
[Tue Mar 31 23:05:33.067097 2026] [:error] [pid 41421:tid 41440] [client 35.193.176.249:41124] [client 35.193.176.249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "acvivRSaDjY9kKFtUQDOegAAARA"]
[Wed Apr 01 05:49:49.162960 2026] [:error] [pid 24314:tid 24331] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Apr 01 05:49:49.256700 2026] [:error] [pid 24314:tid 24320] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Apr 01 05:49:49.372539 2026] [:error] [pid 24314:tid 24319] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 01 05:49:49.465937 2026] [:error] [pid 24314:tid 24318] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Apr 01 05:49:49.651958 2026] [:error] [pid 24314:tid 24325] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Apr 01 05:49:49.743812 2026] [:error] [pid 24314:tid 24323] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Apr 01 05:49:49.834966 2026] [:error] [pid 24314:tid 24338] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Wed Apr 01 05:49:50.040962 2026] [:error] [pid 24314:tid 24339] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Apr 01 05:49:50.132125 2026] [:error] [pid 24314:tid 24337] [client 20.212.200.71:2661] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Apr 01 05:49:50.239756 2026] [:error] [pid 24314:tid 24326] [client 20.212.200.71:2661] [client 20.212.200.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "acxBfpRF3FCzjmMUX5bZPQAAAQg"]
[Wed Apr 01 05:49:50.596622 2026] [:error] [pid 23714:tid 23744] [client 20.212.200.71:2054] [client 20.212.200.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "acxBfkHxDDU2ETcG9DStugAAAAo"]
[Wed Apr 01 05:49:50.999532 2026] [:error] [pid 23714:tid 23737] [client 20.212.200.71:2664] [client 20.212.200.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "acxBfkHxDDU2ETcG9DStvgAAAAM"]
[Wed Apr 01 05:49:51.355617 2026] [:error] [pid 23714:tid 23746] [client 20.212.200.71:4620] [client 20.212.200.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "acxBf0HxDDU2ETcG9DStwgAAAAw"]
[Wed Apr 01 09:52:38.541474 2026] [:error] [pid 23819:tid 23830] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/fffff.php
[Wed Apr 01 09:52:38.779770 2026] [:error] [pid 23819:tid 23846] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/xdd.php
[Wed Apr 01 09:52:39.016531 2026] [:error] [pid 23819:tid 23837] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/wo.php
[Wed Apr 01 09:52:39.255788 2026] [:error] [pid 23819:tid 23831] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/wdone1.php
[Wed Apr 01 09:52:39.493543 2026] [:error] [pid 23819:tid 23845] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/ws79.php
[Wed Apr 01 09:52:39.732640 2026] [:error] [pid 23819:tid 23832] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/aee.php
[Wed Apr 01 09:52:39.969427 2026] [:error] [pid 23819:tid 23828] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Wed Apr 01 09:52:40.207601 2026] [:error] [pid 23819:tid 23822] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Wed Apr 01 09:52:40.443979 2026] [:error] [pid 23819:tid 23842] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/wglum1.php
[Wed Apr 01 09:52:40.682712 2026] [:error] [pid 23819:tid 23840] [client 72.146.8.102:64459] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Wed Apr 01 09:52:40.915680 2026] [:error] [pid 23819:tid 23824] [client 72.146.8.102:64459] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-true.php"] [unique_id "acx6aNdfUS_37wFAM74TxwAAAMI"]
[Wed Apr 01 09:52:41.381357 2026] [:error] [pid 24346:tid 24362] [client 72.146.8.102:64403] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-true.php"] [unique_id "acx6abc1l8kg9MhGHIK6UAAAAUo"]
[Wed Apr 01 09:52:41.847505 2026] [:error] [pid 23714:tid 23758] [client 72.146.8.102:64465] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-true.php"] [unique_id "acx6aUHxDDU2ETcG9DRamAAAABg"]
[Wed Apr 01 09:52:42.317128 2026] [:error] [pid 23819:tid 23826] [client 72.146.8.102:65005] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-true.php"] [unique_id "acx6atdfUS_37wFAM74TygAAAMQ"]
[Wed Apr 01 09:52:42.791602 2026] [:error] [pid 24346:tid 24371] [client 72.146.8.102:64924] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws42.php"] [unique_id "acx6arc1l8kg9MhGHIK6VQAAAVM"]
[Wed Apr 01 09:52:43.260217 2026] [:error] [pid 23714:tid 23749] [client 72.146.8.102:64466] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws42.php"] [unique_id "acx6a0HxDDU2ETcG9DRangAAAA8"]
[Wed Apr 01 09:52:43.729054 2026] [:error] [pid 23714:tid 23742] [client 72.146.8.102:64492] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws42.php"] [unique_id "acx6a0HxDDU2ETcG9DRaoQAAAAg"]
[Wed Apr 01 09:52:44.198086 2026] [:error] [pid 23714:tid 23757] [client 72.146.8.102:64957] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws42.php"] [unique_id "acx6bEHxDDU2ETcG9DRapAAAABc"]
[Wed Apr 01 09:52:44.666065 2026] [:error] [pid 24346:tid 24368] [client 72.146.8.102:64936] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acx6bLc1l8kg9MhGHIK6WAAAAVA"]
[Wed Apr 01 09:52:45.143080 2026] [:error] [pid 23716:tid 23812] [client 72.146.8.102:64948] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acx6bXVtFUg_mx-RYb6pFgAAAJg"]
[Wed Apr 01 09:52:45.611780 2026] [:error] [pid 24346:tid 24364] [client 72.146.8.102:64478] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acx6bbc1l8kg9MhGHIK6WgAAAUw"]
[Wed Apr 01 09:52:46.080345 2026] [:error] [pid 24314:tid 24332] [client 72.146.8.102:64417] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "acx6bpRF3FCzjmMUX5YM4gAAAQ4"]
[Wed Apr 01 09:52:46.546488 2026] [:error] [pid 23714:tid 23750] [client 72.146.8.102:64929] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "acx6bkHxDDU2ETcG9DRarQAAABA"]
[Wed Apr 01 09:52:47.014874 2026] [:error] [pid 23714:tid 23743] [client 72.146.8.102:64486] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "acx6b0HxDDU2ETcG9DRasAAAAAk"]
[Wed Apr 01 09:52:47.483076 2026] [:error] [pid 23714:tid 23753] [client 72.146.8.102:64996] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "acx6b0HxDDU2ETcG9DRaswAAABM"]
[Wed Apr 01 09:52:48.001851 2026] [:error] [pid 23819:tid 23846] [client 72.146.8.102:65002] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "acx6cNdfUS_37wFAM74TzwAAANg"]
[Wed Apr 01 09:52:48.472475 2026] [:error] [pid 23714:tid 23749] [client 72.146.8.102:64456] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "acx6cEHxDDU2ETcG9DRauAAAAA8"]
[Wed Apr 01 09:52:48.939074 2026] [:error] [pid 23714:tid 23736] [client 72.146.8.102:64469] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "acx6cEHxDDU2ETcG9DRauQAAAAI"]
[Wed Apr 01 09:52:49.407431 2026] [:error] [pid 24348:tid 24393] [client 72.146.8.102:64454] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "acx6cW0Vs69Y5nF1HA8gQgAAAY4"]
[Wed Apr 01 09:52:49.872994 2026] [:error] [pid 23716:tid 23804] [client 72.146.8.102:65016] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "acx6cXVtFUg_mx-RYb6pGAAAAJA"]
[Wed Apr 01 09:52:50.348322 2026] [:error] [pid 24314:tid 24318] [client 72.146.8.102:64396] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/north1.php"] [unique_id "acx6cpRF3FCzjmMUX5YM5AAAAQA"]
[Wed Apr 01 09:52:50.817707 2026] [:error] [pid 23716:tid 23794] [client 72.146.8.102:65015] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/north1.php"] [unique_id "acx6cnVtFUg_mx-RYb6pIAAAAIY"]
[Wed Apr 01 09:52:51.319140 2026] [:error] [pid 24346:tid 24359] [client 72.146.8.102:64932] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/north1.php"] [unique_id "acx6c7c1l8kg9MhGHIK6WwAAAUc"]
[Wed Apr 01 09:52:51.796513 2026] [:error] [pid 23819:tid 23834] [client 72.146.8.102:64914] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/north1.php"] [unique_id "acx6c9dfUS_37wFAM74T0QAAAMw"]
[Wed Apr 01 09:52:52.300993 2026] [:error] [pid 23714:tid 23744] [client 72.146.8.102:64945] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/eee.php"] [unique_id "acx6dEHxDDU2ETcG9DRawAAAAAo"]
[Wed Apr 01 09:52:52.767748 2026] [:error] [pid 23714:tid 23758] [client 72.146.8.102:64397] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/eee.php"] [unique_id "acx6dEHxDDU2ETcG9DRawQAAABg"]
[Wed Apr 01 09:52:53.237295 2026] [:error] [pid 24348:tid 24384] [client 72.146.8.102:64896] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/eee.php"] [unique_id "acx6dW0Vs69Y5nF1HA8gSwAAAYU"]
[Wed Apr 01 09:52:53.704503 2026] [:error] [pid 24348:tid 24395] [client 72.146.8.102:65021] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/eee.php"] [unique_id "acx6dW0Vs69Y5nF1HA8gTQAAAZA"]
[Wed Apr 01 09:52:54.178863 2026] [:error] [pid 23714:tid 23736] [client 72.146.8.102:64930] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "acx6dkHxDDU2ETcG9DRaxgAAAAI"]
[Wed Apr 01 09:52:54.647855 2026] [:error] [pid 23714:tid 23740] [client 72.146.8.102:63816] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "acx6dkHxDDU2ETcG9DRayAAAAAY"]
[Wed Apr 01 09:52:55.116775 2026] [:error] [pid 23715:tid 23775] [client 72.146.8.102:64987] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "acx6d6-REzOruNbiT9yYpgAAAE4"]
[Wed Apr 01 09:52:55.587860 2026] [:error] [pid 23715:tid 23764] [client 72.146.8.102:64905] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "acx6d6-REzOruNbiT9yYpwAAAEM"]
[Wed Apr 01 09:52:56.054687 2026] [:error] [pid 23714:tid 23751] [client 72.146.8.102:64391] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acx6eEHxDDU2ETcG9DRaygAAABE"]
[Wed Apr 01 09:52:56.532674 2026] [:error] [pid 23716:tid 23812] [client 72.146.8.102:64501] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acx6eHVtFUg_mx-RYb6pKwAAAJg"]
[Wed Apr 01 09:52:57.000361 2026] [:error] [pid 23716:tid 23811] [client 72.146.8.102:64498] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acx6eHVtFUg_mx-RYb6pLAAAAJc"]
[Wed Apr 01 09:52:57.491141 2026] [:error] [pid 23714:tid 23735] [client 72.146.8.102:64951] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acx6eUHxDDU2ETcG9DRazgAAAAE"]
[Wed Apr 01 09:52:57.958722 2026] [:error] [pid 23714:tid 23737] [client 72.146.8.102:64926] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acx6eUHxDDU2ETcG9DRa0AAAAAM"]
[Wed Apr 01 09:52:58.425104 2026] [:error] [pid 23714:tid 23736] [client 72.146.8.102:63861] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acx6ekHxDDU2ETcG9DRa0gAAAAI"]
[Wed Apr 01 09:52:58.892659 2026] [:error] [pid 23714:tid 23745] [client 72.146.8.102:64464] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acx6ekHxDDU2ETcG9DRa1AAAAAs"]
[Wed Apr 01 09:52:59.361419 2026] [:error] [pid 23714:tid 23738] [client 72.146.8.102:64919] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws77.php"] [unique_id "acx6e0HxDDU2ETcG9DRa1QAAAAQ"]
[Wed Apr 01 09:52:59.831784 2026] [:error] [pid 23714:tid 23746] [client 72.146.8.102:64395] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gpt-sh.php"] [unique_id "acx6e0HxDDU2ETcG9DRa2AAAAAw"]
[Wed Apr 01 09:53:00.323797 2026] [:error] [pid 24314:tid 24326] [client 72.146.8.102:64475] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gpt-sh.php"] [unique_id "acx6fJRF3FCzjmMUX5YM7QAAAQg"]
[Wed Apr 01 09:53:00.802895 2026] [:error] [pid 24348:tid 24393] [client 72.146.8.102:64999] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gpt-sh.php"] [unique_id "acx6fG0Vs69Y5nF1HA8gUQAAAY4"]
[Wed Apr 01 09:53:01.272001 2026] [:error] [pid 24314:tid 24333] [client 72.146.8.102:64955] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gpt-sh.php"] [unique_id "acx6fZRF3FCzjmMUX5YM7wAAAQ8"]
[Wed Apr 01 09:53:01.762067 2026] [:error] [pid 23715:tid 23781] [client 72.146.8.102:64933] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "acx6fa-REzOruNbiT9yYrwAAAFQ"]
[Wed Apr 01 09:53:02.229502 2026] [:error] [pid 24348:tid 24397] [client 72.146.8.102:64943] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "acx6fm0Vs69Y5nF1HA8gUwAAAZI"]
[Wed Apr 01 09:53:02.721005 2026] [:error] [pid 24348:tid 24399] [client 72.146.8.102:64935] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "acx6fm0Vs69Y5nF1HA8gVAAAAZQ"]
[Wed Apr 01 09:53:03.189506 2026] [:error] [pid 24314:tid 24336] [client 72.146.8.102:63764] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "acx6f5RF3FCzjmMUX5YM8wAAARI"]
[Wed Apr 01 09:53:03.681422 2026] [:error] [pid 23714:tid 23747] [client 72.146.8.102:63821] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "acx6f0HxDDU2ETcG9DRa6gAAAA0"]
[Wed Apr 01 09:53:04.149921 2026] [:error] [pid 23716:tid 23808] [client 72.146.8.102:64940] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "acx6gHVtFUg_mx-RYb6pOwAAAJQ"]
[Wed Apr 01 09:53:04.671982 2026] [:error] [pid 23714:tid 23751] [client 72.146.8.102:64904] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "acx6gEHxDDU2ETcG9DRa8gAAABE"]
[Wed Apr 01 09:53:05.152369 2026] [:error] [pid 24348:tid 24383] [client 72.146.8.102:64455] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "acx6gW0Vs69Y5nF1HA8gVwAAAYQ"]
[Wed Apr 01 09:53:05.643103 2026] [:error] [pid 23714:tid 23758] [client 72.146.8.102:63828] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wander.php"] [unique_id "acx6gUHxDDU2ETcG9DRa-AAAABg"]
[Wed Apr 01 09:53:06.112585 2026] [:error] [pid 23714:tid 23756] [client 72.146.8.102:64407] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wander.php"] [unique_id "acx6gkHxDDU2ETcG9DRa-gAAABY"]
[Wed Apr 01 09:53:06.587869 2026] [:error] [pid 24348:tid 24394] [client 72.146.8.102:64953] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wander.php"] [unique_id "acx6gm0Vs69Y5nF1HA8gXQAAAY8"]
[Wed Apr 01 09:53:07.065881 2026] [:error] [pid 24346:tid 24366] [client 72.146.8.102:64386] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wander.php"] [unique_id "acx6g7c1l8kg9MhGHIK6ZAAAAU4"]
[Wed Apr 01 09:53:07.555537 2026] [:error] [pid 23716:tid 23806] [client 72.146.8.102:63186] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/h02ugyh.php"] [unique_id "acx6g3VtFUg_mx-RYb6pPwAAAJI"]
[Wed Apr 01 09:53:08.026924 2026] [:error] [pid 23714:tid 23751] [client 72.146.8.102:64398] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/h02ugyh.php"] [unique_id "acx6hEHxDDU2ETcG9DRbBwAAABE"]
[Wed Apr 01 09:53:08.508538 2026] [:error] [pid 24348:tid 24382] [client 72.146.8.102:64463] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/h02ugyh.php"] [unique_id "acx6hG0Vs69Y5nF1HA8gYAAAAYM"]
[Wed Apr 01 09:53:08.974820 2026] [:error] [pid 24348:tid 24397] [client 72.146.8.102:64392] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/h02ugyh.php"] [unique_id "acx6hG0Vs69Y5nF1HA8gYwAAAZI"]
[Wed Apr 01 09:53:09.443305 2026] [:error] [pid 23819:tid 23822] [client 72.146.8.102:65017] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ad.php"] [unique_id "acx6hddfUS_37wFAM74T0wAAAMA"]
[Wed Apr 01 09:53:09.908764 2026] [:error] [pid 23716:tid 23812] [client 72.146.8.102:63793] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ad.php"] [unique_id "acx6hXVtFUg_mx-RYb6pRQAAAJg"]
[Wed Apr 01 09:53:10.376864 2026] [:error] [pid 23714:tid 23754] [client 72.146.8.102:64497] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ad.php"] [unique_id "acx6hkHxDDU2ETcG9DRbEwAAABQ"]
[Wed Apr 01 09:53:10.849588 2026] [:error] [pid 23714:tid 23740] [client 72.146.8.102:64984] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ad.php"] [unique_id "acx6hkHxDDU2ETcG9DRbFwAAAAY"]
[Wed Apr 01 09:53:11.316890 2026] [:error] [pid 24346:tid 24373] [client 72.146.8.102:64927] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/z60.php"] [unique_id "acx6h7c1l8kg9MhGHIK6ZQAAAVU"]
[Wed Apr 01 09:53:11.785140 2026] [:error] [pid 23716:tid 23793] [client 72.146.8.102:63866] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/z60.php"] [unique_id "acx6h3VtFUg_mx-RYb6pSAAAAIU"]
[Wed Apr 01 09:53:12.252182 2026] [:error] [pid 24346:tid 24372] [client 72.146.8.102:65022] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/z60.php"] [unique_id "acx6iLc1l8kg9MhGHIK6ZwAAAVQ"]
[Wed Apr 01 09:53:12.729604 2026] [:error] [pid 24348:tid 24400] [client 72.146.8.102:64983] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/z60.php"] [unique_id "acx6iG0Vs69Y5nF1HA8gagAAAZU"]
[Wed Apr 01 09:53:13.198226 2026] [:error] [pid 23716:tid 23806] [client 72.146.8.102:63776] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "acx6iXVtFUg_mx-RYb6pTAAAAJI"]
[Wed Apr 01 09:53:13.670995 2026] [:error] [pid 23716:tid 23797] [client 72.146.8.102:64422] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "acx6iXVtFUg_mx-RYb6pUAAAAIk"]
[Wed Apr 01 09:53:14.136872 2026] [:error] [pid 24314:tid 24327] [client 72.146.8.102:64954] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "acx6ipRF3FCzjmMUX5YM9wAAAQk"]
[Wed Apr 01 09:53:14.633049 2026] [:error] [pid 23714:tid 23747] [client 72.146.8.102:64421] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "acx6ikHxDDU2ETcG9DRbKgAAAA0"]
[Wed Apr 01 09:53:15.112223 2026] [:error] [pid 23714:tid 23739] [client 72.146.8.102:63829] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acx6i0HxDDU2ETcG9DRbLgAAAAU"]
[Wed Apr 01 09:53:15.581997 2026] [:error] [pid 24314:tid 24328] [client 72.146.8.102:64946] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acx6i5RF3FCzjmMUX5YM_AAAAQo"]
[Wed Apr 01 09:53:16.053394 2026] [:error] [pid 23716:tid 23811] [client 72.146.8.102:64493] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acx6jHVtFUg_mx-RYb6pUwAAAJc"]
[Wed Apr 01 09:53:16.521270 2026] [:error] [pid 23714:tid 23754] [client 72.146.8.102:64916] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acx6jEHxDDU2ETcG9DRbNgAAABQ"]
[Wed Apr 01 09:53:16.991543 2026] [:error] [pid 23715:tid 23784] [client 72.146.8.102:64963] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sql.php"] [unique_id "acx6jK-REzOruNbiT9yYtwAAAFc"]
[Wed Apr 01 09:53:17.463545 2026] [:error] [pid 23714:tid 23739] [client 72.146.8.102:64457] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sql.php"] [unique_id "acx6jUHxDDU2ETcG9DRbPAAAAAU"]
[Wed Apr 01 09:53:17.961544 2026] [:error] [pid 23819:tid 23843] [client 72.146.8.102:65008] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sql.php"] [unique_id "acx6jddfUS_37wFAM74T1QAAANU"]
[Wed Apr 01 09:53:18.430182 2026] [:error] [pid 23715:tid 23769] [client 72.146.8.102:64451] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sql.php"] [unique_id "acx6jq-REzOruNbiT9yYuwAAAEg"]
[Wed Apr 01 09:53:18.904151 2026] [:error] [pid 24314:tid 24318] [client 72.146.8.102:64511] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acx6jpRF3FCzjmMUX5YNAgAAAQA"]
[Wed Apr 01 09:53:19.377674 2026] [:error] [pid 23716:tid 23798] [client 72.146.8.102:64503] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acx6j3VtFUg_mx-RYb6pWAAAAIo"]
[Wed Apr 01 09:53:19.842236 2026] [:error] [pid 23716:tid 23805] [client 72.146.8.102:64452] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acx6j3VtFUg_mx-RYb6pWgAAAJE"]
[Wed Apr 01 09:53:20.308362 2026] [:error] [pid 23716:tid 23802] [client 72.146.8.102:64505] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "acx6kHVtFUg_mx-RYb6pXwAAAI4"]
[Wed Apr 01 09:53:20.782586 2026] [:error] [pid 23714:tid 23752] [client 72.146.8.102:63786] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "acx6kEHxDDU2ETcG9DRbTgAAABI"]
[Wed Apr 01 09:53:21.254371 2026] [:error] [pid 23714:tid 23734] [client 72.146.8.102:63803] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "acx6kUHxDDU2ETcG9DRbUgAAAAA"]
[Wed Apr 01 09:53:21.725820 2026] [:error] [pid 23715:tid 23770] [client 72.146.8.102:64988] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "acx6ka-REzOruNbiT9yYvQAAAEk"]
[Wed Apr 01 09:53:22.194004 2026] [:error] [pid 24314:tid 24339] [client 72.146.8.102:64912] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "acx6kpRF3FCzjmMUX5YNBAAAARU"]
[Wed Apr 01 09:53:22.661924 2026] [:error] [pid 24348:tid 24397] [client 72.146.8.102:64504] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "acx6km0Vs69Y5nF1HA8gbAAAAZI"]
[Wed Apr 01 09:53:23.127105 2026] [:error] [pid 23715:tid 23774] [client 72.146.8.102:64969] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "acx6k6-REzOruNbiT9yYvwAAAE0"]
[Wed Apr 01 09:53:23.598558 2026] [:error] [pid 24348:tid 24380] [client 72.146.8.102:63770] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "acx6k20Vs69Y5nF1HA8gcQAAAYE"]
[Wed Apr 01 09:53:24.088496 2026] [:error] [pid 24346:tid 24375] [client 72.146.8.102:64982] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "acx6lLc1l8kg9MhGHIK6bQAAAVc"]
[Wed Apr 01 09:53:24.554862 2026] [:error] [pid 23714:tid 23742] [client 72.146.8.102:64420] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws78.php"] [unique_id "acx6lEHxDDU2ETcG9DRbXwAAAAg"]
[Wed Apr 01 09:53:25.021079 2026] [:error] [pid 24348:tid 24390] [client 72.146.8.102:63833] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws78.php"] [unique_id "acx6lW0Vs69Y5nF1HA8gcwAAAYs"]
[Wed Apr 01 09:53:25.490786 2026] [:error] [pid 24348:tid 24388] [client 72.146.8.102:64956] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws78.php"] [unique_id "acx6lW0Vs69Y5nF1HA8gdQAAAYk"]
[Wed Apr 01 09:53:25.957919 2026] [:error] [pid 24346:tid 24374] [client 72.146.8.102:65004] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws78.php"] [unique_id "acx6lbc1l8kg9MhGHIK6cAAAAVY"]
[Wed Apr 01 09:53:26.425268 2026] [:error] [pid 23716:tid 23809] [client 72.146.8.102:64441] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uang.php"] [unique_id "acx6lnVtFUg_mx-RYb6pagAAAJU"]
[Wed Apr 01 09:53:26.892770 2026] [:error] [pid 23716:tid 23800] [client 72.146.8.102:64476] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uang.php"] [unique_id "acx6lnVtFUg_mx-RYb6pawAAAIw"]
[Wed Apr 01 09:53:27.362477 2026] [:error] [pid 23716:tid 23793] [client 72.146.8.102:64450] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uang.php"] [unique_id "acx6l3VtFUg_mx-RYb6pbAAAAIU"]
[Wed Apr 01 09:53:27.830594 2026] [:error] [pid 23716:tid 23791] [client 72.146.8.102:64460] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uang.php"] [unique_id "acx6l3VtFUg_mx-RYb6pcAAAAIM"]
[Wed Apr 01 09:53:28.302330 2026] [:error] [pid 23716:tid 23795] [client 72.146.8.102:64896] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/save.php"] [unique_id "acx6mHVtFUg_mx-RYb6pcwAAAIc"]
[Wed Apr 01 09:53:28.771457 2026] [:error] [pid 23716:tid 23809] [client 72.146.8.102:65012] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/save.php"] [unique_id "acx6mHVtFUg_mx-RYb6pdgAAAJU"]
[Wed Apr 01 09:53:29.246847 2026] [:error] [pid 23715:tid 23775] [client 72.146.8.102:64939] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/save.php"] [unique_id "acx6ma-REzOruNbiT9yYwgAAAE4"]
[Wed Apr 01 09:53:29.715111 2026] [:error] [pid 23819:tid 23844] [client 72.146.8.102:65010] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/save.php"] [unique_id "acx6mddfUS_37wFAM74T3AAAANY"]
[Wed Apr 01 09:53:30.183278 2026] [:error] [pid 24314:tid 24326] [client 72.146.8.102:64979] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "acx6mpRF3FCzjmMUX5YNCQAAAQg"]
[Wed Apr 01 09:53:30.652055 2026] [:error] [pid 24348:tid 24385] [client 72.146.8.102:63818] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "acx6mm0Vs69Y5nF1HA8gfgAAAYY"]
[Wed Apr 01 09:53:31.122962 2026] [:error] [pid 23716:tid 23806] [client 72.146.8.102:64986] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "acx6m3VtFUg_mx-RYb6pewAAAJI"]
[Wed Apr 01 09:53:31.601905 2026] [:error] [pid 23716:tid 23799] [client 72.146.8.102:64425] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "acx6m3VtFUg_mx-RYb6pfQAAAIs"]
[Wed Apr 01 09:53:32.072540 2026] [:error] [pid 23714:tid 23747] [client 72.146.8.102:64942] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xs.php"] [unique_id "acx6nEHxDDU2ETcG9DRbYQAAAA0"]
[Wed Apr 01 09:53:32.546974 2026] [:error] [pid 23819:tid 23842] [client 72.146.8.102:64413] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xs.php"] [unique_id "acx6nNdfUS_37wFAM74T4AAAANQ"]
[Wed Apr 01 09:53:33.017529 2026] [:error] [pid 23715:tid 23763] [client 72.146.8.102:63822] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xs.php"] [unique_id "acx6na-REzOruNbiT9yYxgAAAEI"]
[Wed Apr 01 09:53:33.484592 2026] [:error] [pid 23716:tid 23792] [client 72.146.8.102:64985] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xs.php"] [unique_id "acx6nXVtFUg_mx-RYb6pfgAAAIQ"]
[Wed Apr 01 09:53:33.954999 2026] [:error] [pid 24314:tid 24318] [client 72.146.8.102:63187] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acx6nZRF3FCzjmMUX5YNDgAAAQA"]
[Wed Apr 01 09:53:34.429063 2026] [:error] [pid 23716:tid 23797] [client 72.146.8.102:64389] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acx6nnVtFUg_mx-RYb6pgQAAAIk"]
[Wed Apr 01 09:53:34.895829 2026] [:error] [pid 23716:tid 23811] [client 72.146.8.102:63763] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acx6nnVtFUg_mx-RYb6phQAAAJc"]
[Wed Apr 01 09:53:35.386731 2026] [:error] [pid 23716:tid 23790] [client 72.146.8.102:64966] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "acx6n3VtFUg_mx-RYb6phwAAAII"]
[Wed Apr 01 09:53:35.855473 2026] [:error] [pid 23714:tid 23758] [client 72.146.8.102:64994] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "acx6n0HxDDU2ETcG9DRbYwAAABg"]
[Wed Apr 01 09:53:36.326141 2026] [:error] [pid 24314:tid 24339] [client 72.146.8.102:63222] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "acx6oJRF3FCzjmMUX5YNEAAAARU"]
[Wed Apr 01 09:53:36.793712 2026] [:error] [pid 23715:tid 23779] [client 72.146.8.102:63843] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "acx6oK-REzOruNbiT9yYyQAAAFI"]
[Wed Apr 01 09:53:37.268811 2026] [:error] [pid 24346:tid 24352] [client 72.146.8.102:64404] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "acx6obc1l8kg9MhGHIK6eQAAAUA"]
[Wed Apr 01 09:53:37.739708 2026] [:error] [pid 23714:tid 23736] [client 72.146.8.102:64412] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acx6oUHxDDU2ETcG9DRbaQAAAAI"]
[Wed Apr 01 09:53:38.207183 2026] [:error] [pid 23714:tid 23738] [client 72.146.8.102:64959] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acx6okHxDDU2ETcG9DRbawAAAAQ"]
[Wed Apr 01 09:53:38.674946 2026] [:error] [pid 24346:tid 24375] [client 72.146.8.102:64462] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acx6orc1l8kg9MhGHIK6ewAAAVc"]
[Wed Apr 01 09:53:39.142780 2026] [:error] [pid 24346:tid 24358] [client 72.146.8.102:64402] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "acx6o7c1l8kg9MhGHIK6fQAAAUY"]
[Wed Apr 01 09:53:39.608797 2026] [:error] [pid 23715:tid 23770] [client 72.146.8.102:64960] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yuzuru1.php"] [unique_id "acx6o6-REzOruNbiT9yYzAAAAEk"]
[Wed Apr 01 09:53:40.078304 2026] [:error] [pid 23714:tid 23747] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Wed Apr 01 09:53:40.315605 2026] [:error] [pid 23714:tid 23758] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Wed Apr 01 09:53:40.553298 2026] [:error] [pid 23714:tid 23740] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/sweg.php
[Wed Apr 01 09:53:40.789458 2026] [:error] [pid 23714:tid 23735] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/xpwer1.php
[Wed Apr 01 09:53:41.030636 2026] [:error] [pid 23714:tid 23749] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/ws40.php
[Wed Apr 01 09:53:41.269079 2026] [:error] [pid 23714:tid 23738] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Wed Apr 01 09:53:41.505267 2026] [:error] [pid 23714:tid 23747] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/awh.php
[Wed Apr 01 09:53:41.740917 2026] [:error] [pid 23714:tid 23751] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/shellerr.php
[Wed Apr 01 09:53:41.977349 2026] [:error] [pid 23714:tid 23740] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-scanner.php
[Wed Apr 01 09:53:42.214115 2026] [:error] [pid 23714:tid 23738] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Wed Apr 01 09:53:42.449772 2026] [:error] [pid 23714:tid 23756] [client 72.146.8.102:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/to.php
[Wed Apr 01 09:53:42.683701 2026] [:error] [pid 23714:tid 23741] [client 72.146.8.102:63819] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acx6pkHxDDU2ETcG9DRbiQAAAAc"]
[Wed Apr 01 09:53:43.149232 2026] [:error] [pid 23714:tid 23742] [client 72.146.8.102:64506] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acx6p0HxDDU2ETcG9DRbjwAAAAg"]
[Wed Apr 01 09:53:43.626793 2026] [:error] [pid 23716:tid 23812] [client 72.146.8.102:64433] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acx6p3VtFUg_mx-RYb6piQAAAJg"]
[Wed Apr 01 09:53:44.095274 2026] [:error] [pid 24346:tid 24357] [client 72.146.8.102:64487] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "acx6qLc1l8kg9MhGHIK6fwAAAUU"]
[Wed Apr 01 09:53:44.592674 2026] [:error] [pid 24348:tid 24398] [client 72.146.8.102:64990] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ant.php"] [unique_id "acx6qG0Vs69Y5nF1HA8gjwAAAZM"]
[Wed Apr 01 09:53:45.070600 2026] [:error] [pid 23716:tid 23794] [client 72.146.8.102:65000] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ant.php"] [unique_id "acx6qXVtFUg_mx-RYb6pjwAAAIY"]
[Wed Apr 01 09:53:45.538007 2026] [:error] [pid 23819:tid 23837] [client 72.146.8.102:64434] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ant.php"] [unique_id "acx6qddfUS_37wFAM74T6QAAAM8"]
[Wed Apr 01 09:53:46.005444 2026] [:error] [pid 23819:tid 23842] [client 72.146.8.102:63205] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ant.php"] [unique_id "acx6qtdfUS_37wFAM74T7QAAANQ"]
[Wed Apr 01 09:53:46.471935 2026] [:error] [pid 23714:tid 23752] [client 72.146.8.102:64406] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "acx6qkHxDDU2ETcG9DRbkgAAABI"]
[Wed Apr 01 09:53:46.950543 2026] [:error] [pid 23819:tid 23834] [client 72.146.8.102:64491] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "acx6qtdfUS_37wFAM74T8AAAAMw"]
[Wed Apr 01 09:53:47.462072 2026] [:error] [pid 23715:tid 23774] [client 72.146.8.102:65013] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "acx6q6-REzOruNbiT9yYzwAAAE0"]
[Wed Apr 01 09:53:47.934737 2026] [:error] [pid 23819:tid 23838] [client 72.146.8.102:63767] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "acx6q9dfUS_37wFAM74T9AAAANA"]
[Wed Apr 01 09:53:48.411339 2026] [:error] [pid 24346:tid 24354] [client 72.146.8.102:63812] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "acx6rLc1l8kg9MhGHIK6ggAAAUI"]
[Wed Apr 01 09:53:48.882032 2026] [:error] [pid 24346:tid 24376] [client 72.146.8.102:64409] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "acx6rLc1l8kg9MhGHIK6hAAAAVg"]
[Wed Apr 01 09:53:49.353510 2026] [:error] [pid 23714:tid 23757] [client 72.146.8.102:63832] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "acx6rUHxDDU2ETcG9DRbkwAAABc"]
[Wed Apr 01 09:53:49.823381 2026] [:error] [pid 23819:tid 23826] [client 72.146.8.102:63813] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "acx6rddfUS_37wFAM74T-AAAAMQ"]
[Wed Apr 01 09:53:50.295021 2026] [:error] [pid 23715:tid 23782] [client 72.146.8.102:64975] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xda.php"] [unique_id "acx6rq-REzOruNbiT9yY1gAAAFU"]
[Wed Apr 01 09:53:50.818196 2026] [:error] [pid 24314:tid 24324] [client 72.146.8.102:64947] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xda.php"] [unique_id "acx6rpRF3FCzjmMUX5YNGgAAAQY"]
[Wed Apr 01 09:53:51.288525 2026] [:error] [pid 23716:tid 23803] [client 72.146.8.102:64385] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xda.php"] [unique_id "acx6r3VtFUg_mx-RYb6pkwAAAI8"]
[Wed Apr 01 09:53:51.771973 2026] [:error] [pid 24348:tid 24390] [client 72.146.8.102:64482] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xda.php"] [unique_id "acx6r20Vs69Y5nF1HA8gnQAAAYs"]
[Wed Apr 01 09:53:52.248949 2026] [:error] [pid 24346:tid 24371] [client 72.146.8.102:63817] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classgoto24.php"] [unique_id "acx6sLc1l8kg9MhGHIK6jAAAAVM"]
[Wed Apr 01 09:53:52.721368 2026] [:error] [pid 24346:tid 24374] [client 72.146.8.102:64485] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classgoto24.php"] [unique_id "acx6sLc1l8kg9MhGHIK6jQAAAVY"]
[Wed Apr 01 09:53:53.190455 2026] [:error] [pid 24346:tid 24372] [client 72.146.8.102:64925] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classgoto24.php"] [unique_id "acx6sbc1l8kg9MhGHIK6kAAAAVQ"]
[Wed Apr 01 09:53:53.657829 2026] [:error] [pid 23715:tid 23767] [client 72.146.8.102:63835] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classgoto24.php"] [unique_id "acx6sa-REzOruNbiT9yY3wAAAEY"]
[Wed Apr 01 09:53:54.124368 2026] [:error] [pid 24348:tid 24388] [client 72.146.8.102:64941] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "acx6sm0Vs69Y5nF1HA8goAAAAYk"]
[Wed Apr 01 09:53:54.596876 2026] [:error] [pid 23715:tid 23763] [client 72.146.8.102:64494] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "acx6sq-REzOruNbiT9yY4wAAAEI"]
[Wed Apr 01 09:53:55.069719 2026] [:error] [pid 23715:tid 23779] [client 72.146.8.102:64500] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "acx6s6-REzOruNbiT9yY5QAAAFI"]
[Wed Apr 01 09:53:55.547953 2026] [:error] [pid 23716:tid 23800] [client 72.146.8.102:64495] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "acx6s3VtFUg_mx-RYb6plgAAAIw"]
[Wed Apr 01 09:53:56.017970 2026] [:error] [pid 24346:tid 24367] [client 72.146.8.102:63815] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws43.php"] [unique_id "acx6tLc1l8kg9MhGHIK6lQAAAU8"]
[Wed Apr 01 09:53:56.496942 2026] [:error] [pid 23715:tid 23769] [client 72.146.8.102:64971] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws43.php"] [unique_id "acx6tK-REzOruNbiT9yY7QAAAEg"]
[Wed Apr 01 09:53:56.980005 2026] [:error] [pid 24348:tid 24395] [client 72.146.8.102:64977] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws43.php"] [unique_id "acx6tG0Vs69Y5nF1HA8gogAAAZA"]
[Wed Apr 01 09:53:57.448318 2026] [:error] [pid 23714:tid 23739] [client 72.146.8.102:64906] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws43.php"] [unique_id "acx6tUHxDDU2ETcG9DRbnAAAAAU"]
[Wed Apr 01 09:53:57.927837 2026] [:error] [pid 23714:tid 23748] [client 72.146.8.102:63190] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gec.php"] [unique_id "acx6tUHxDDU2ETcG9DRbngAAAA4"]
[Wed Apr 01 09:53:58.395816 2026] [:error] [pid 23714:tid 23752] [client 72.146.8.102:64461] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gec.php"] [unique_id "acx6tkHxDDU2ETcG9DRbogAAABI"]
[Wed Apr 01 09:53:58.863521 2026] [:error] [pid 24348:tid 24387] [client 72.146.8.102:63847] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gec.php"] [unique_id "acx6tm0Vs69Y5nF1HA8gqAAAAYg"]
[Wed Apr 01 09:53:59.333955 2026] [:error] [pid 23716:tid 23792] [client 72.146.8.102:63206] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gec.php"] [unique_id "acx6t3VtFUg_mx-RYb6pnAAAAIQ"]
[Wed Apr 01 09:53:59.864882 2026] [:error] [pid 23714:tid 23747] [client 72.146.8.102:64901] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acx6t0HxDDU2ETcG9DRbqQAAAA0"]
[Wed Apr 01 09:54:00.336349 2026] [:error] [pid 23716:tid 23795] [client 72.146.8.102:65014] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acx6uHVtFUg_mx-RYb6pngAAAIc"]
[Wed Apr 01 09:54:00.875851 2026] [:error] [pid 23714:tid 23746] [client 72.146.8.102:64496] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acx6uEHxDDU2ETcG9DRbrAAAAAw"]
[Wed Apr 01 09:54:01.363130 2026] [:error] [pid 24348:tid 24397] [client 72.146.8.102:64909] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "acx6uW0Vs69Y5nF1HA8gtQAAAZI"]
[Wed Apr 01 09:54:01.835073 2026] [:error] [pid 24348:tid 24392] [client 72.146.8.102:63749] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acx6uW0Vs69Y5nF1HA8gtgAAAY0"]
[Wed Apr 01 09:54:02.310135 2026] [:error] [pid 23819:tid 23823] [client 72.146.8.102:64962] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acx6utdfUS_37wFAM74T_QAAAME"]
[Wed Apr 01 09:54:02.802608 2026] [:error] [pid 24314:tid 24327] [client 72.146.8.102:64443] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acx6upRF3FCzjmMUX5YNIQAAAQk"]
[Wed Apr 01 09:54:03.296917 2026] [:error] [pid 23819:tid 23841] [client 72.146.8.102:64390] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "acx6u9dfUS_37wFAM74T_wAAANM"]
[Wed Apr 01 09:54:03.781540 2026] [:error] [pid 23714:tid 23737] [client 72.146.8.102:63788] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/size.php"] [unique_id "acx6u0HxDDU2ETcG9DRbtQAAAAM"]
[Wed Apr 01 09:54:04.260964 2026] [:error] [pid 23714:tid 23747] [client 72.146.8.102:64993] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/size.php"] [unique_id "acx6vEHxDDU2ETcG9DRbtwAAAA0"]
[Wed Apr 01 09:54:04.731225 2026] [:error] [pid 23715:tid 23763] [client 72.146.8.102:64393] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/size.php"] [unique_id "acx6vK-REzOruNbiT9yY9AAAAEI"]
[Wed Apr 01 09:54:05.199580 2026] [:error] [pid 23716:tid 23788] [client 72.146.8.102:63791] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/size.php"] [unique_id "acx6vXVtFUg_mx-RYb6ppAAAAIA"]
[Wed Apr 01 09:54:05.670323 2026] [:error] [pid 23715:tid 23776] [client 72.146.8.102:64928] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acx6va-REzOruNbiT9yY9gAAAE8"]
[Wed Apr 01 09:54:06.137687 2026] [:error] [pid 23716:tid 23806] [client 72.146.8.102:65001] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acx6vnVtFUg_mx-RYb6ppwAAAJI"]
[Wed Apr 01 09:54:06.604343 2026] [:error] [pid 23819:tid 23846] [client 72.146.8.102:64898] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acx6vtdfUS_37wFAM74UAgAAANg"]
[Wed Apr 01 09:54:07.111802 2026] [:error] [pid 23819:tid 23826] [client 72.146.8.102:63804] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "acx6v9dfUS_37wFAM74UAwAAAMQ"]
[Wed Apr 01 09:54:07.580597 2026] [:error] [pid 23714:tid 23743] [client 72.146.8.102:64907] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "acx6v0HxDDU2ETcG9DRbvgAAAAk"]
[Wed Apr 01 09:54:08.051508 2026] [:error] [pid 23716:tid 23801] [client 72.146.8.102:63223] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "acx6wHVtFUg_mx-RYb6pqwAAAI0"]
[Wed Apr 01 09:54:08.525315 2026] [:error] [pid 23714:tid 23755] [client 72.146.8.102:63110] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "acx6wEHxDDU2ETcG9DRbwQAAABU"]
[Wed Apr 01 09:54:08.992584 2026] [:error] [pid 23716:tid 23804] [client 72.146.8.102:63121] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "acx6wHVtFUg_mx-RYb6prgAAAJA"]
[Wed Apr 01 09:54:09.461865 2026] [:error] [pid 23819:tid 23828] [client 72.146.8.102:64428] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acx6wddfUS_37wFAM74UBQAAAMY"]
[Wed Apr 01 09:54:09.935925 2026] [:error] [pid 23819:tid 23834] [client 72.146.8.102:64405] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acx6wddfUS_37wFAM74UCAAAAMw"]
[Wed Apr 01 09:54:10.402489 2026] [:error] [pid 23714:tid 23739] [client 72.146.8.102:63811] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acx6wkHxDDU2ETcG9DRbygAAAAU"]
[Wed Apr 01 09:54:10.874385 2026] [:error] [pid 23714:tid 23748] [client 72.146.8.102:65023] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/torsa1.php"] [unique_id "acx6wkHxDDU2ETcG9DRbywAAAA4"]
[Wed Apr 01 09:54:11.354225 2026] [:error] [pid 24346:tid 24370] [client 72.146.8.102:64416] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "acx6w7c1l8kg9MhGHIK6mgAAAVI"]
[Wed Apr 01 09:54:11.821588 2026] [:error] [pid 24348:tid 24390] [client 72.146.8.102:63765] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "acx6w20Vs69Y5nF1HA8gugAAAYs"]
[Wed Apr 01 09:54:12.298958 2026] [:error] [pid 23716:tid 23790] [client 72.146.8.102:64973] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "acx6xHVtFUg_mx-RYb6ptAAAAII"]
[Wed Apr 01 09:54:12.772090 2026] [:error] [pid 23715:tid 23762] [client 72.146.8.102:62551] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "acx6xK-REzOruNbiT9yY_QAAAEE"]
[Wed Apr 01 09:54:13.259298 2026] [:error] [pid 23715:tid 23768] [client 72.146.8.102:63838] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vaza.php"] [unique_id "acx6xa-REzOruNbiT9yY_wAAAEc"]
[Wed Apr 01 09:54:13.728233 2026] [:error] [pid 23714:tid 23753] [client 72.146.8.102:64952] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vaza.php"] [unique_id "acx6xUHxDDU2ETcG9DRb1gAAABM"]
[Wed Apr 01 09:54:14.195288 2026] [:error] [pid 23716:tid 23794] [client 72.146.8.102:64472] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vaza.php"] [unique_id "acx6xnVtFUg_mx-RYb6pwAAAAIY"]
[Wed Apr 01 09:54:14.665669 2026] [:error] [pid 23714:tid 23741] [client 72.146.8.102:63209] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vaza.php"] [unique_id "acx6xkHxDDU2ETcG9DRb2AAAAAc"]
[Wed Apr 01 09:54:15.136145 2026] [:error] [pid 23714:tid 23757] [client 72.146.8.102:64507] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acx6x0HxDDU2ETcG9DRb2wAAABc"]
[Wed Apr 01 09:54:15.605970 2026] [:error] [pid 23715:tid 23783] [client 72.146.8.102:64502] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acx6x6-REzOruNbiT9yZBQAAAFY"]
[Wed Apr 01 09:54:16.079182 2026] [:error] [pid 23714:tid 23737] [client 72.146.8.102:63214] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acx6yEHxDDU2ETcG9DRb4AAAAAM"]
[Wed Apr 01 09:54:16.585658 2026] [:error] [pid 23714:tid 23756] [client 72.146.8.102:63155] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "acx6yEHxDDU2ETcG9DRb4wAAABY"]
[Wed Apr 01 09:54:17.057599 2026] [:error] [pid 23714:tid 23754] [client 72.146.8.102:64931] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acx6yUHxDDU2ETcG9DRb5AAAABQ"]
[Wed Apr 01 09:54:17.530501 2026] [:error] [pid 23714:tid 23734] [client 72.146.8.102:63227] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acx6yUHxDDU2ETcG9DRb5wAAAAA"]
[Wed Apr 01 09:54:18.002438 2026] [:error] [pid 23715:tid 23767] [client 72.146.8.102:63759] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acx6yq-REzOruNbiT9yZDwAAAEY"]
[Wed Apr 01 09:54:18.504808 2026] [:error] [pid 24346:tid 24372] [client 72.146.8.102:63168] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acx6yrc1l8kg9MhGHIK6nQAAAVQ"]
[Wed Apr 01 09:54:18.977099 2026] [:error] [pid 24348:tid 24380] [client 72.146.8.102:63808] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc0252.php"] [unique_id "acx6ym0Vs69Y5nF1HA8gvgAAAYE"]
[Wed Apr 01 09:54:19.449743 2026] [:error] [pid 24348:tid 24388] [client 72.146.8.102:65003] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc0252.php"] [unique_id "acx6y20Vs69Y5nF1HA8gwAAAAYk"]
[Wed Apr 01 09:54:19.921463 2026] [:error] [pid 24348:tid 24391] [client 72.146.8.102:63220] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc0252.php"] [unique_id "acx6y20Vs69Y5nF1HA8gwgAAAYw"]
[Wed Apr 01 09:54:20.390307 2026] [:error] [pid 24348:tid 24392] [client 72.146.8.102:63118] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc0252.php"] [unique_id "acx6zG0Vs69Y5nF1HA8gwwAAAY0"]
[Wed Apr 01 09:54:20.861589 2026] [:error] [pid 23819:tid 23846] [client 72.146.8.102:63221] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "acx6zNdfUS_37wFAM74UEwAAANg"]
[Wed Apr 01 09:54:21.329226 2026] [:error] [pid 24348:tid 24403] [client 72.146.8.102:63814] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "acx6zW0Vs69Y5nF1HA8gxQAAAZg"]
[Wed Apr 01 09:54:21.804903 2026] [:error] [pid 23819:tid 23825] [client 72.146.8.102:64902] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "acx6zddfUS_37wFAM74UFgAAAMM"]
[Wed Apr 01 09:54:22.275959 2026] [:error] [pid 24314:tid 24335] [client 72.146.8.102:64419] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "acx6zpRF3FCzjmMUX5YNJQAAARE"]
[Wed Apr 01 09:54:22.774379 2026] [:error] [pid 23714:tid 23743] [client 72.146.8.102:63777] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "acx6zkHxDDU2ETcG9DRb9AAAAAk"]
[Wed Apr 01 09:54:23.272828 2026] [:error] [pid 23715:tid 23783] [client 72.146.8.102:64958] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "acx6z6-REzOruNbiT9yZFAAAAFY"]
[Wed Apr 01 09:54:23.739120 2026] [:error] [pid 24314:tid 24333] [client 72.146.8.102:64980] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "acx6z5RF3FCzjmMUX5YNJgAAAQ8"]
[Wed Apr 01 09:54:24.212326 2026] [:error] [pid 23716:tid 23794] [client 72.146.8.102:63859] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "acx60HVtFUg_mx-RYb6pxgAAAIY"]
[Wed Apr 01 09:54:24.684388 2026] [:error] [pid 23819:tid 23824] [client 72.146.8.102:64950] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acx60NdfUS_37wFAM74UHAAAAMI"]
[Wed Apr 01 09:54:25.153155 2026] [:error] [pid 23716:tid 23805] [client 72.146.8.102:64473] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acx60XVtFUg_mx-RYb6pygAAAJE"]
[Wed Apr 01 09:54:25.633017 2026] [:error] [pid 24346:tid 24358] [client 72.146.8.102:64426] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acx60bc1l8kg9MhGHIK6pgAAAUY"]
[Wed Apr 01 09:54:26.101493 2026] [:error] [pid 23819:tid 23837] [client 72.146.8.102:63787] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acx60tdfUS_37wFAM74UIQAAAM8"]
[Wed Apr 01 09:54:26.583144 2026] [:error] [pid 24348:tid 24398] [client 72.146.8.102:64970] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp3.php"] [unique_id "acx60m0Vs69Y5nF1HA8gywAAAZM"]
[Wed Apr 01 09:54:27.050714 2026] [:error] [pid 24348:tid 24383] [client 72.146.8.102:64972] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp3.php"] [unique_id "acx6020Vs69Y5nF1HA8gzAAAAYQ"]
[Wed Apr 01 09:54:27.518709 2026] [:error] [pid 23716:tid 23789] [client 72.146.8.102:65019] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp3.php"] [unique_id "acx603VtFUg_mx-RYb6p0QAAAIE"]
[Wed Apr 01 09:54:27.993671 2026] [:error] [pid 23716:tid 23799] [client 72.146.8.102:63848] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp3.php"] [unique_id "acx603VtFUg_mx-RYb6p1gAAAIs"]
[Wed Apr 01 09:54:28.459670 2026] [:error] [pid 23715:tid 23774] [client 72.146.8.102:64472] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "acx61K-REzOruNbiT9yZGwAAAE0"]
[Wed Apr 01 09:54:28.937179 2026] [:error] [pid 24348:tid 24389] [client 72.146.8.102:64430] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "acx61G0Vs69Y5nF1HA8gzgAAAYo"]
[Wed Apr 01 09:54:29.404563 2026] [:error] [pid 23714:tid 23738] [client 72.146.8.102:64483] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "acx61UHxDDU2ETcG9DRb-wAAAAQ"]
[Wed Apr 01 09:54:29.872327 2026] [:error] [pid 23819:tid 23844] [client 72.146.8.102:64968] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "acx61ddfUS_37wFAM74UKgAAANY"]
[Wed Apr 01 09:54:30.345426 2026] [:error] [pid 23819:tid 23841] [client 72.146.8.102:63781] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v.php"] [unique_id "acx61tdfUS_37wFAM74ULAAAANM"]
[Wed Apr 01 09:54:30.815773 2026] [:error] [pid 23819:tid 23835] [client 72.146.8.102:64447] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v.php"] [unique_id "acx61tdfUS_37wFAM74UMAAAAM0"]
[Wed Apr 01 09:54:31.286346 2026] [:error] [pid 24346:tid 24372] [client 72.146.8.102:64961] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v.php"] [unique_id "acx617c1l8kg9MhGHIK6qQAAAVQ"]
[Wed Apr 01 09:54:31.755494 2026] [:error] [pid 24346:tid 24362] [client 72.146.8.102:64899] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v.php"] [unique_id "acx617c1l8kg9MhGHIK6qwAAAUo"]
[Wed Apr 01 09:54:32.222302 2026] [:error] [pid 24348:tid 24392] [client 72.146.8.102:64908] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d2.php"] [unique_id "acx62G0Vs69Y5nF1HA8g0QAAAY0"]
[Wed Apr 01 09:54:32.697822 2026] [:error] [pid 23716:tid 23794] [client 72.146.8.102:63852] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d2.php"] [unique_id "acx62HVtFUg_mx-RYb6p3gAAAIY"]
[Wed Apr 01 09:54:33.164228 2026] [:error] [pid 24348:tid 24395] [client 72.146.8.102:63834] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d2.php"] [unique_id "acx62W0Vs69Y5nF1HA8g0wAAAZA"]
[Wed Apr 01 09:54:33.631622 2026] [:error] [pid 23714:tid 23746] [client 72.146.8.102:64448] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d2.php"] [unique_id "acx62UHxDDU2ETcG9DRcAAAAAAw"]
[Wed Apr 01 09:54:34.100924 2026] [:error] [pid 23715:tid 23772] [client 72.146.8.102:64400] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc.php"] [unique_id "acx62q-REzOruNbiT9yZIQAAAEs"]
[Wed Apr 01 09:54:34.566410 2026] [:error] [pid 23714:tid 23740] [client 72.146.8.102:64915] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc.php"] [unique_id "acx62kHxDDU2ETcG9DRcAwAAAAY"]
[Wed Apr 01 09:54:35.036312 2026] [:error] [pid 24346:tid 24356] [client 72.146.8.102:64509] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc.php"] [unique_id "acx627c1l8kg9MhGHIK6sQAAAUQ"]
[Wed Apr 01 09:54:35.538224 2026] [:error] [pid 24346:tid 24371] [client 72.146.8.102:63836] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc.php"] [unique_id "acx627c1l8kg9MhGHIK6sgAAAVM"]
[Wed Apr 01 09:54:36.006647 2026] [:error] [pid 24346:tid 24363] [client 72.146.8.102:63758] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "acx63Lc1l8kg9MhGHIK6tAAAAUs"]
[Wed Apr 01 09:54:36.478997 2026] [:error] [pid 24346:tid 24373] [client 72.146.8.102:63865] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "acx63Lc1l8kg9MhGHIK6tgAAAVU"]
[Wed Apr 01 09:54:36.959611 2026] [:error] [pid 24346:tid 24372] [client 72.146.8.102:64480] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "acx63Lc1l8kg9MhGHIK6uAAAAVQ"]
[Wed Apr 01 09:54:37.426240 2026] [:error] [pid 24346:tid 24354] [client 72.146.8.102:63772] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "acx63bc1l8kg9MhGHIK6uwAAAUI"]
[Wed Apr 01 09:54:37.900101 2026] [:error] [pid 23715:tid 23778] [client 72.146.8.102:64918] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "acx63a-REzOruNbiT9yZJAAAAFE"]
[Wed Apr 01 09:54:38.371916 2026] [:error] [pid 23715:tid 23765] [client 72.146.8.102:63170] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "acx63q-REzOruNbiT9yZJgAAAEQ"]
[Wed Apr 01 09:54:38.875533 2026] [:error] [pid 23714:tid 23754] [client 72.146.8.102:63841] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "acx63kHxDDU2ETcG9DRcCQAAABQ"]
[Wed Apr 01 09:54:39.346956 2026] [:error] [pid 24348:tid 24384] [client 72.146.8.102:64944] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "acx6320Vs69Y5nF1HA8g3gAAAYU"]
[Wed Apr 01 09:54:39.814505 2026] [:error] [pid 23714:tid 23746] [client 72.146.8.102:64440] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "acx630HxDDU2ETcG9DRcDQAAAAw"]
[Wed Apr 01 09:54:40.280869 2026] [:error] [pid 23714:tid 23757] [client 72.146.8.102:64408] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "acx64EHxDDU2ETcG9DRcEAAAABc"]
[Wed Apr 01 09:54:40.750996 2026] [:error] [pid 23714:tid 23740] [client 72.146.8.102:64949] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "acx64EHxDDU2ETcG9DRcEgAAAAY"]
[Wed Apr 01 09:54:41.220261 2026] [:error] [pid 23714:tid 23745] [client 72.146.8.102:64997] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "acx64UHxDDU2ETcG9DRcEwAAAAs"]
[Wed Apr 01 09:54:41.706553 2026] [:error] [pid 23714:tid 23744] [client 72.146.8.102:63867] [client 72.146.8.102] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/20.php"] [unique_id "acx64UHxDDU2ETcG9DRcGAAAAAo"]
[Wed Apr 01 09:54:42.179754 2026] [:error] [pid 23714:tid 23735] [client 72.146.8.102:63183] File does not exist: /usr/local/apache/htdocs/suspended-page/20.php
[Wed Apr 01 09:54:42.417662 2026] [:error] [pid 23714:tid 23758] [client 72.146.8.102:63183] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 01 09:54:42.656443 2026] [:error] [pid 23714:tid 23739] [client 72.146.8.102:63183] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Wed Apr 01 09:54:42.894038 2026] [:error] [pid 23714:tid 23746] [client 72.146.8.102:63183] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Wed Apr 01 09:54:43.132021 2026] [:error] [pid 23714:tid 23741] [client 72.146.8.102:63183] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Wed Apr 01 09:54:43.371632 2026] [:error] [pid 23714:tid 23751] [client 72.146.8.102:63183] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Wed Apr 01 19:39:40.153247 2026] [:error] [pid 8908:tid 8924] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Wed Apr 01 19:39:40.410910 2026] [:error] [pid 8908:tid 8917] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/8daf1238_1774208172.php
[Wed Apr 01 19:39:40.664008 2026] [:error] [pid 8908:tid 8915] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/0yellow.php
[Wed Apr 01 19:39:40.965596 2026] [:error] [pid 8908:tid 8919] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/dichku.php
[Wed Apr 01 19:39:41.230166 2026] [:error] [pid 8908:tid 8914] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 01 19:39:41.475934 2026] [:error] [pid 8908:tid 8928] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/gvg1bvpsgtot1rpklCdefault.php
[Wed Apr 01 19:39:41.729450 2026] [:error] [pid 8908:tid 8925] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Wed Apr 01 19:39:41.967134 2026] [:error] [pid 8908:tid 8926] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/a9.php
[Wed Apr 01 19:39:42.230471 2026] [:error] [pid 8908:tid 8927] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Wed Apr 01 19:39:42.499414 2026] [:error] [pid 8908:tid 8918] [client 4.233.57.137:35983] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Wed Apr 01 19:39:42.882418 2026] [:error] [pid 8908:tid 8923] [client 4.233.57.137:35983] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hnphq.php"] [unique_id "ac0D_vkmxtJXGnLdvgBg7wAAAIo"]
[Wed Apr 01 19:39:43.551482 2026] [:error] [pid 8909:tid 8958] [client 4.233.57.137:47786] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hnphq.php"] [unique_id "ac0D_zvP_a0662gDl6B9kgAAANE"]
[Wed Apr 01 19:39:44.286144 2026] [:error] [pid 8910:tid 8992] [client 4.233.57.137:45443] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hnphq.php"] [unique_id "ac0EAKJZINUcF3tYgExLCwAAARg"]
[Wed Apr 01 19:39:44.909895 2026] [:error] [pid 17856:tid 17873] [client 4.233.57.137:42293] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hnphq.php"] [unique_id "ac0EAD7Idlm5j9frhqT5gwAAAE8"]
[Wed Apr 01 19:39:45.986026 2026] [:error] [pid 8908:tid 8928] [client 4.233.57.137:19720] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0EAfkmxtJXGnLdvgBg9gAAAI8"]
[Wed Apr 01 19:39:47.975783 2026] [:error] [pid 8910:tid 8976] [client 4.233.57.137:47205] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0EA6JZINUcF3tYgExLEAAAAQg"]
[Wed Apr 01 19:39:48.708165 2026] [:error] [pid 17856:tid 17879] [client 4.233.57.137:45454] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0EBD7Idlm5j9frhqT5kAAAAFU"]
[Wed Apr 01 19:39:49.585242 2026] [:error] [pid 8995:tid 9016] [client 4.233.57.137:29334] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0EBeonaBjs3qxcReetmAAAABI"]
[Wed Apr 01 19:39:50.347997 2026] [:error] [pid 62559:tid 62566] [client 4.233.57.137:29338] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "ac0EBi7NKI8IaNKZFId-pwAAAUU"]
[Wed Apr 01 19:39:51.178123 2026] [:error] [pid 17856:tid 17870] [client 4.233.57.137:33523] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "ac0EBz7Idlm5j9frhqT5mAAAAEw"]
[Wed Apr 01 19:39:51.925126 2026] [:error] [pid 17856:tid 17859] [client 4.233.57.137:42279] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "ac0EBz7Idlm5j9frhqT5nQAAAEE"]
[Wed Apr 01 19:39:52.593345 2026] [:error] [pid 8908:tid 8930] [client 4.233.57.137:30486] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "ac0ECPkmxtJXGnLdvgBhCgAAAJE"]
[Wed Apr 01 19:39:54.189468 2026] [:error] [pid 17856:tid 17868] [client 4.233.57.137:19356] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "ac0ECj7Idlm5j9frhqT5pAAAAEo"]
[Wed Apr 01 19:39:56.774501 2026] [:error] [pid 17856:tid 17874] [client 4.233.57.137:27149] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "ac0EDD7Idlm5j9frhqT5pwAAAFA"]
[Wed Apr 01 19:39:59.574628 2026] [:error] [pid 17856:tid 17879] [client 4.233.57.137:3945] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "ac0EDz7Idlm5j9frhqT5rQAAAFU"]
[Wed Apr 01 19:40:01.358444 2026] [:error] [pid 8909:tid 8949] [client 4.233.57.137:31647] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "ac0EETvP_a0662gDl6B90wAAAMg"]
[Wed Apr 01 19:40:02.371287 2026] [:error] [pid 8909:tid 8951] [client 4.233.57.137:20508] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0EEjvP_a0662gDl6B92gAAAMo"]
[Wed Apr 01 19:40:03.157579 2026] [:error] [pid 8908:tid 8934] [client 4.233.57.137:19372] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0EE_kmxtJXGnLdvgBhEgAAAJU"]
[Wed Apr 01 19:40:04.565928 2026] [:error] [pid 8909:tid 8963] [client 4.233.57.137:19390] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0EFDvP_a0662gDl6B96gAAANY"]
[Wed Apr 01 19:40:05.456104 2026] [:error] [pid 8909:tid 8944] [client 4.233.57.137:33533] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0EFTvP_a0662gDl6B97wAAAMM"]
[Wed Apr 01 19:40:06.527163 2026] [:error] [pid 8909:tid 8962] [client 4.233.57.137:42277] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0EFjvP_a0662gDl6B99QAAANU"]
[Wed Apr 01 19:40:07.228826 2026] [:error] [pid 8909:tid 8955] [client 4.233.57.137:30494] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0EFzvP_a0662gDl6B9-wAAAM4"]
[Wed Apr 01 19:40:08.052459 2026] [:error] [pid 8909:tid 8958] [client 4.233.57.137:42267] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0EGDvP_a0662gDl6B-AgAAANE"]
[Wed Apr 01 19:40:08.659972 2026] [:error] [pid 17856:tid 17859] [client 4.233.57.137:42248] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0EGD7Idlm5j9frhqT5wAAAAEE"]
[Wed Apr 01 19:40:09.328631 2026] [:error] [pid 8909:tid 8957] [client 4.233.57.137:27670] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Okxob.php"] [unique_id "ac0EGTvP_a0662gDl6B-BQAAANA"]
[Wed Apr 01 19:40:09.885628 2026] [:error] [pid 17856:tid 17872] [client 4.233.57.137:20496] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Okxob.php"] [unique_id "ac0EGT7Idlm5j9frhqT5xQAAAE4"]
[Wed Apr 01 19:40:10.393290 2026] [:error] [pid 17856:tid 17882] [client 4.233.57.137:20530] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Okxob.php"] [unique_id "ac0EGj7Idlm5j9frhqT5yQAAAFg"]
[Wed Apr 01 19:40:10.997625 2026] [:error] [pid 8908:tid 8913] [client 4.233.57.137:36009] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Okxob.php"] [unique_id "ac0EGvkmxtJXGnLdvgBhGQAAAIA"]
[Wed Apr 01 19:40:11.734781 2026] [:error] [pid 8909:tid 8951] [client 4.233.57.137:50311] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0EGzvP_a0662gDl6B-DgAAAMo"]
[Wed Apr 01 19:40:12.407861 2026] [:error] [pid 8908:tid 8936] [client 4.233.57.137:26502] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0EHPkmxtJXGnLdvgBhHgAAAJc"]
[Wed Apr 01 19:40:12.980231 2026] [:error] [pid 62559:tid 62562] [client 4.233.57.137:30461] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0EHC7NKI8IaNKZFId-xwAAAUE"]
[Wed Apr 01 19:40:13.487942 2026] [:error] [pid 62559:tid 62570] [client 4.233.57.137:30451] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0EHS7NKI8IaNKZFId-yQAAAUk"]
[Wed Apr 01 19:40:14.007935 2026] [:error] [pid 8908:tid 8935] [client 4.233.57.137:31225] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac0EHvkmxtJXGnLdvgBhIQAAAJY"]
[Wed Apr 01 19:40:14.484001 2026] [:error] [pid 8909:tid 8953] [client 4.233.57.137:3461] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac0EHjvP_a0662gDl6B-EwAAAMw"]
[Wed Apr 01 19:40:15.276536 2026] [:error] [pid 8908:tid 8922] [client 4.233.57.137:31180] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac0EH_kmxtJXGnLdvgBhJAAAAIk"]
[Wed Apr 01 19:40:15.866230 2026] [:error] [pid 62559:tid 62579] [client 4.233.57.137:50367] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac0EHy7NKI8IaNKZFId-zQAAAVI"]
[Wed Apr 01 19:40:16.413726 2026] [:error] [pid 8908:tid 8917] [client 4.233.57.137:4070] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/only.php"] [unique_id "ac0EIPkmxtJXGnLdvgBhKAAAAIQ"]
[Wed Apr 01 19:40:16.964112 2026] [:error] [pid 8909:tid 8952] [client 4.233.57.137:3780] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/only.php"] [unique_id "ac0EIDvP_a0662gDl6B-GQAAAMs"]
[Wed Apr 01 19:40:17.919490 2026] [:error] [pid 8908:tid 8928] [client 4.233.57.137:36402] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/only.php"] [unique_id "ac0EIfkmxtJXGnLdvgBhLQAAAI8"]
[Wed Apr 01 19:40:18.569378 2026] [:error] [pid 8909:tid 8949] [client 4.233.57.137:36354] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/only.php"] [unique_id "ac0EIjvP_a0662gDl6B-HgAAAMg"]
[Wed Apr 01 19:40:19.785583 2026] [:error] [pid 8909:tid 8943] [client 4.233.57.137:32719] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/repurify.php"] [unique_id "ac0EIzvP_a0662gDl6B-KQAAAMI"]
[Wed Apr 01 19:40:20.411259 2026] [:error] [pid 8909:tid 8942] [client 4.233.57.137:22506] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/repurify.php"] [unique_id "ac0EJDvP_a0662gDl6B-LwAAAME"]
[Wed Apr 01 19:40:21.351890 2026] [:error] [pid 8910:tid 8989] [client 4.233.57.137:33192] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/repurify.php"] [unique_id "ac0EJaJZINUcF3tYgExLJgAAARU"]
[Wed Apr 01 19:40:23.066044 2026] [:error] [pid 8910:tid 8979] [client 4.233.57.137:33592] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/repurify.php"] [unique_id "ac0EJ6JZINUcF3tYgExLKgAAAQs"]
[Wed Apr 01 19:40:23.697080 2026] [:error] [pid 8908:tid 8916] [client 4.233.57.137:45955] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tdsaz.php"] [unique_id "ac0EJ_kmxtJXGnLdvgBhMAAAAIM"]
[Wed Apr 01 19:40:24.333631 2026] [:error] [pid 62559:tid 62562] [client 4.233.57.137:32413] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tdsaz.php"] [unique_id "ac0EKC7NKI8IaNKZFId-3gAAAUE"]
[Wed Apr 01 19:40:24.914172 2026] [:error] [pid 62559:tid 62574] [client 4.233.57.137:25621] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tdsaz.php"] [unique_id "ac0EKC7NKI8IaNKZFId-3wAAAU0"]
[Wed Apr 01 19:40:25.455155 2026] [:error] [pid 8995:tid 9009] [client 4.233.57.137:34605] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tdsaz.php"] [unique_id "ac0EKeonaBjs3qxcReetyAAAAAs"]
[Wed Apr 01 19:40:26.851161 2026] [:error] [pid 8908:tid 8934] [client 4.233.57.137:51542] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "ac0EKvkmxtJXGnLdvgBhPwAAAJU"]
[Wed Apr 01 19:40:28.961818 2026] [:error] [pid 8995:tid 9006] [client 4.233.57.137:37644] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "ac0ELOonaBjs3qxcReetzwAAAAg"]
[Wed Apr 01 19:40:31.275375 2026] [:error] [pid 8995:tid 9017] [client 4.233.57.137:56681] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "ac0EL-onaBjs3qxcReet4AAAABM"]
[Wed Apr 01 19:40:33.236142 2026] [:error] [pid 17856:tid 17862] [client 4.233.57.137:35332] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "ac0EMT7Idlm5j9frhqT59QAAAEQ"]
[Wed Apr 01 19:40:34.596093 2026] [:error] [pid 8909:tid 8941] [client 4.233.57.137:49480] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hfles.php"] [unique_id "ac0EMjvP_a0662gDl6B-TAAAAMA"]
[Wed Apr 01 19:40:35.906773 2026] [:error] [pid 8908:tid 8914] [client 4.233.57.137:40456] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hfles.php"] [unique_id "ac0EM_kmxtJXGnLdvgBhUgAAAIE"]
[Wed Apr 01 19:40:36.927105 2026] [:error] [pid 62559:tid 62584] [client 4.233.57.137:21907] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hfles.php"] [unique_id "ac0ENC7NKI8IaNKZFId-8wAAAVc"]
[Wed Apr 01 19:40:37.574673 2026] [:error] [pid 8910:tid 8968] [client 4.233.57.137:54082] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hfles.php"] [unique_id "ac0ENaJZINUcF3tYgExLQAAAAQA"]
[Wed Apr 01 19:40:38.221039 2026] [:error] [pid 8908:tid 8930] [client 4.233.57.137:24863] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac0ENvkmxtJXGnLdvgBhXAAAAJE"]
[Wed Apr 01 19:40:38.894625 2026] [:error] [pid 8909:tid 8963] [client 4.233.57.137:40448] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac0ENjvP_a0662gDl6B-VQAAANY"]
[Wed Apr 01 19:40:39.426736 2026] [:error] [pid 8909:tid 8951] [client 4.233.57.137:19190] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac0ENzvP_a0662gDl6B-WQAAAMo"]
[Wed Apr 01 19:40:40.337618 2026] [:error] [pid 8909:tid 8948] [client 4.233.57.137:30162] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac0EODvP_a0662gDl6B-WwAAAMc"]
[Wed Apr 01 19:40:42.951177 2026] [:error] [pid 8909:tid 8959] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Wed Apr 01 19:40:43.270543 2026] [:error] [pid 8909:tid 8959] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class-20260318122951.php
[Wed Apr 01 19:40:43.632335 2026] [:error] [pid 8909:tid 8942] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Wed Apr 01 19:40:43.871520 2026] [:error] [pid 8909:tid 8955] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-moonka.php
[Wed Apr 01 19:40:44.110464 2026] [:error] [pid 8909:tid 8953] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Wed Apr 01 19:40:44.400627 2026] [:error] [pid 8909:tid 8949] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Wed Apr 01 19:40:44.639585 2026] [:error] [pid 8909:tid 8948] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/irpl4xz4fmlzm4tlvvu4h1mCdefault.php
[Wed Apr 01 19:40:44.884547 2026] [:error] [pid 8909:tid 8945] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Wed Apr 01 19:40:46.407875 2026] [:error] [pid 8909:tid 8945] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Wed Apr 01 19:40:46.786627 2026] [:error] [pid 8909:tid 8955] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Wed Apr 01 19:40:47.071313 2026] [:error] [pid 8909:tid 8941] [client 4.233.57.137:29639] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Wed Apr 01 19:40:47.340765 2026] [:error] [pid 8909:tid 8953] [client 4.233.57.137:29639] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0EPzvP_a0662gDl6B-egAAAMw"]
[Wed Apr 01 19:40:48.399714 2026] [:error] [pid 62559:tid 62583] [client 4.233.57.137:26845] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0EQC7NKI8IaNKZFId_AAAAAVY"]
[Wed Apr 01 19:40:49.759252 2026] [:error] [pid 8910:tid 8989] [client 4.233.57.137:29640] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0EQaJZINUcF3tYgExLSQAAARU"]
[Wed Apr 01 19:40:51.101054 2026] [:error] [pid 8909:tid 8942] [client 4.233.57.137:36048] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0EQzvP_a0662gDl6B-hAAAAME"]
[Wed Apr 01 19:40:51.909898 2026] [:error] [pid 8909:tid 8941] [client 4.233.57.137:29633] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new3.php"] [unique_id "ac0EQzvP_a0662gDl6B-iAAAAMA"]
[Wed Apr 01 19:40:52.545744 2026] [:error] [pid 8908:tid 8922] [client 4.233.57.137:64299] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new3.php"] [unique_id "ac0ERPkmxtJXGnLdvgBhcQAAAIk"]
[Wed Apr 01 19:40:53.518951 2026] [:error] [pid 8909:tid 8952] [client 4.233.57.137:39874] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new3.php"] [unique_id "ac0ERTvP_a0662gDl6B-lAAAAMs"]
[Wed Apr 01 19:40:54.193465 2026] [:error] [pid 8910:tid 8974] [client 4.233.57.137:28907] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new3.php"] [unique_id "ac0ERqJZINUcF3tYgExLTwAAAQY"]
[Wed Apr 01 19:40:54.955844 2026] [:error] [pid 62559:tid 62580] [client 4.233.57.137:22895] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "ac0ERi7NKI8IaNKZFId_DQAAAVM"]
[Wed Apr 01 19:40:55.698838 2026] [:error] [pid 62559:tid 62576] [client 4.233.57.137:64237] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "ac0ERy7NKI8IaNKZFId_DgAAAU8"]
[Wed Apr 01 19:40:56.296201 2026] [:error] [pid 8909:tid 8941] [client 4.233.57.137:40451] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "ac0ESDvP_a0662gDl6B-oQAAAMA"]
[Wed Apr 01 19:40:57.535173 2026] [:error] [pid 62559:tid 62579] [client 4.233.57.137:24508] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "ac0ESS7NKI8IaNKZFId_FgAAAVI"]
[Wed Apr 01 19:40:58.579346 2026] [:error] [pid 62559:tid 62572] [client 4.233.57.137:40485] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rogsa.php"] [unique_id "ac0ESi7NKI8IaNKZFId_HQAAAUs"]
[Wed Apr 01 19:40:59.196644 2026] [:error] [pid 17856:tid 17867] [client 4.233.57.137:64252] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rogsa.php"] [unique_id "ac0ESz7Idlm5j9frhqT6SgAAAEk"]
[Wed Apr 01 19:41:00.175126 2026] [:error] [pid 8995:tid 9021] [client 4.233.57.137:22871] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rogsa.php"] [unique_id "ac0ETOonaBjs3qxcReeuAQAAABc"]
[Wed Apr 01 19:41:01.078100 2026] [:error] [pid 8909:tid 8959] [client 4.233.57.137:36083] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rogsa.php"] [unique_id "ac0ETTvP_a0662gDl6B-qAAAANI"]
[Wed Apr 01 19:41:01.760649 2026] [:error] [pid 8909:tid 8953] [client 4.233.57.137:40500] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htzevfl4k9ey5hoaywdwiCdefault.php"] [unique_id "ac0ETTvP_a0662gDl6B-qwAAAMw"]
[Wed Apr 01 19:41:03.418510 2026] [:error] [pid 8995:tid 9002] [client 4.233.57.137:31605] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htzevfl4k9ey5hoaywdwiCdefault.php"] [unique_id "ac0ET-onaBjs3qxcReeuBAAAAAQ"]
[Wed Apr 01 19:41:05.071571 2026] [:error] [pid 8909:tid 8964] [client 4.233.57.137:19184] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htzevfl4k9ey5hoaywdwiCdefault.php"] [unique_id "ac0EUTvP_a0662gDl6B-uwAAANc"]
[Wed Apr 01 19:41:05.761576 2026] [:error] [pid 8909:tid 8960] [client 4.233.57.137:31604] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htzevfl4k9ey5hoaywdwiCdefault.php"] [unique_id "ac0EUTvP_a0662gDl6B-wwAAANM"]
[Wed Apr 01 19:41:06.293091 2026] [:error] [pid 8909:tid 8962] [client 4.233.57.137:24461] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "ac0EUjvP_a0662gDl6B-xQAAANU"]
[Wed Apr 01 19:41:07.611165 2026] [:error] [pid 8909:tid 8956] [client 4.233.57.137:24464] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "ac0EUzvP_a0662gDl6B-0AAAAM8"]
[Wed Apr 01 19:41:08.411405 2026] [:error] [pid 17856:tid 17865] [client 4.233.57.137:30147] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "ac0EVD7Idlm5j9frhqT6XAAAAEc"]
[Wed Apr 01 19:41:09.403053 2026] [:error] [pid 17856:tid 17868] [client 4.233.57.137:22863] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "ac0EVT7Idlm5j9frhqT6YgAAAEo"]
[Wed Apr 01 19:41:10.772859 2026] [:error] [pid 62559:tid 62567] [client 4.233.57.137:25126] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "ac0EVi7NKI8IaNKZFId_MwAAAUY"]
[Wed Apr 01 19:41:11.488516 2026] [:error] [pid 17856:tid 17858] [client 4.233.57.137:29683] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "ac0EVz7Idlm5j9frhqT6ZwAAAEA"]
[Wed Apr 01 19:41:12.606659 2026] [:error] [pid 17856:tid 17867] [client 4.233.57.137:29632] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "ac0EWD7Idlm5j9frhqT6bAAAAEk"]
[Wed Apr 01 19:41:13.544768 2026] [:error] [pid 62559:tid 62584] [client 4.233.57.137:29656] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "ac0EWS7NKI8IaNKZFId_NwAAAVc"]
[Wed Apr 01 19:41:14.186835 2026] [:error] [pid 8909:tid 8954] [client 4.233.57.137:28068] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "ac0EWjvP_a0662gDl6B-6QAAAM0"]
[Wed Apr 01 19:41:14.787745 2026] [:error] [pid 8909:tid 8941] [client 4.233.57.137:24673] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "ac0EWjvP_a0662gDl6B-7gAAAMA"]
[Wed Apr 01 19:41:15.393037 2026] [:error] [pid 8909:tid 8942] [client 4.233.57.137:64711] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "ac0EWzvP_a0662gDl6B-9AAAAME"]
[Wed Apr 01 19:41:19.977293 2026] [:error] [pid 8910:tid 8981] [client 4.233.57.137:37360] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "ac0EX6JZINUcF3tYgExLXwAAAQ0"]
[Wed Apr 01 19:41:24.063859 2026] [:error] [pid 8910:tid 8991] [client 4.233.57.137:39467] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "ac0EZKJZINUcF3tYgExLZgAAARc"]
[Wed Apr 01 19:41:39.140360 2026] [:error] [pid 8908:tid 8926] [client 4.233.57.137:36814] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "ac0Ec_kmxtJXGnLdvgBhwQAAAI0"]
[Wed Apr 01 19:41:45.055178 2026] [:error] [pid 17856:tid 17858] [client 4.233.57.137:20811] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/CDX1.php"] [unique_id "ac0EeT7Idlm5j9frhqT6twAAAEA"]
[Wed Apr 01 19:41:54.318173 2026] [:error] [pid 8909:tid 8959] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Wed Apr 01 19:41:54.589192 2026] [:error] [pid 8909:tid 8953] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/ynjli.php
[Wed Apr 01 19:41:54.828380 2026] [:error] [pid 8909:tid 8954] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/a6.php
[Wed Apr 01 19:41:55.092198 2026] [:error] [pid 8909:tid 8951] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/mI35rZhMg1zJ1vuXdefault.php
[Wed Apr 01 19:41:55.361480 2026] [:error] [pid 8909:tid 8952] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Wed Apr 01 19:41:55.645872 2026] [:error] [pid 8909:tid 8958] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/hbvdoz7cy9k6xge9zhuvkvitCdefault.php
[Wed Apr 01 19:41:55.907987 2026] [:error] [pid 8909:tid 8954] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/wziar1.php
[Wed Apr 01 19:41:56.156422 2026] [:error] [pid 8909:tid 8943] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/fsgdjkl.php
[Wed Apr 01 19:41:56.409585 2026] [:error] [pid 8909:tid 8960] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/exhds0ucw0ju9vjgasxqCdefault.php
[Wed Apr 01 19:41:56.656910 2026] [:error] [pid 8909:tid 8962] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Wed Apr 01 19:41:56.895610 2026] [:error] [pid 8909:tid 8955] [client 4.233.57.137:25163] File does not exist: /usr/local/apache/htdocs/suspended-page/a8.php
[Wed Apr 01 19:41:57.131047 2026] [:error] [pid 8909:tid 8941] [client 4.233.57.137:25163] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0EhTvP_a0662gDl6B_iAAAAMA"]
[Wed Apr 01 19:41:58.641698 2026] [:error] [pid 8909:tid 8956] [client 4.233.57.137:3407] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0EhjvP_a0662gDl6B_jwAAAM8"]
[Wed Apr 01 19:41:59.277364 2026] [:error] [pid 8909:tid 8958] [client 4.233.57.137:65478] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0EhzvP_a0662gDl6B_lAAAANE"]
[Wed Apr 01 19:42:00.131599 2026] [:error] [pid 62559:tid 62572] [client 4.233.57.137:60022] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0EiC7NKI8IaNKZFId_ggAAAUs"]
[Wed Apr 01 19:42:00.623627 2026] [:error] [pid 8909:tid 8957] [client 4.233.57.137:46526] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0EiDvP_a0662gDl6B_nQAAANA"]
[Wed Apr 01 19:42:01.374666 2026] [:error] [pid 8909:tid 8941] [client 4.233.57.137:46493] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0EiTvP_a0662gDl6B_oQAAAMA"]
[Wed Apr 01 19:42:02.298550 2026] [:error] [pid 8995:tid 9019] [client 4.233.57.137:29700] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0EiuonaBjs3qxcReeuSQAAABU"]
[Wed Apr 01 19:42:03.355134 2026] [:error] [pid 8909:tid 8958] [client 4.233.57.137:50916] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0EizvP_a0662gDl6B_rAAAANE"]
[Wed Apr 01 19:42:04.415774 2026] [:error] [pid 8910:tid 8968] [client 4.233.57.137:59945] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "ac0EjKJZINUcF3tYgExLmwAAAQA"]
[Wed Apr 01 19:42:05.124544 2026] [:error] [pid 8908:tid 8927] [client 4.233.57.137:60439] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "ac0EjfkmxtJXGnLdvgBh4gAAAI4"]
[Wed Apr 01 19:42:05.851489 2026] [:error] [pid 8909:tid 8945] [client 4.233.57.137:60442] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "ac0EjTvP_a0662gDl6B_rgAAAMQ"]
[Wed Apr 01 19:42:06.408704 2026] [:error] [pid 8908:tid 8928] [client 4.233.57.137:44809] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "ac0EjvkmxtJXGnLdvgBh5gAAAI8"]
[Wed Apr 01 19:42:07.141993 2026] [:error] [pid 62559:tid 62563] [client 4.233.57.137:24409] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index-20260330022921.php"] [unique_id "ac0Ejy7NKI8IaNKZFId_kQAAAUI"]
[Wed Apr 01 19:42:07.997430 2026] [:error] [pid 8908:tid 8937] [client 4.233.57.137:47836] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index-20260330022921.php"] [unique_id "ac0Ej_kmxtJXGnLdvgBh6wAAAJg"]
[Wed Apr 01 19:42:08.633715 2026] [:error] [pid 8995:tid 8999] [client 4.233.57.137:24413] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index-20260330022921.php"] [unique_id "ac0EkOonaBjs3qxcReeuUgAAAAE"]
[Wed Apr 01 19:42:09.882065 2026] [:error] [pid 8909:tid 8959] [client 4.233.57.137:44822] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index-20260330022921.php"] [unique_id "ac0EkTvP_a0662gDl6B_tgAAANI"]
[Wed Apr 01 19:42:10.687987 2026] [:error] [pid 8908:tid 8921] [client 4.233.57.137:3579] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Geforce.php"] [unique_id "ac0EkvkmxtJXGnLdvgBh7gAAAIg"]
[Wed Apr 01 19:42:11.365510 2026] [:error] [pid 8910:tid 8972] [client 4.233.57.137:3449] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Geforce.php"] [unique_id "ac0Ek6JZINUcF3tYgExLpQAAAQQ"]
[Wed Apr 01 19:42:12.039743 2026] [:error] [pid 62559:tid 62580] [client 4.233.57.137:3454] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Geforce.php"] [unique_id "ac0ElC7NKI8IaNKZFId_mwAAAVM"]
[Wed Apr 01 19:42:12.717343 2026] [:error] [pid 8908:tid 8916] [client 4.233.57.137:59943] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Geforce.php"] [unique_id "ac0ElPkmxtJXGnLdvgBh8gAAAIM"]
[Wed Apr 01 19:42:13.388634 2026] [:error] [pid 8995:tid 9019] [client 4.233.57.137:50846] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "ac0EleonaBjs3qxcReeuYAAAABU"]
[Wed Apr 01 19:42:14.347093 2026] [:error] [pid 17856:tid 17870] [client 4.233.57.137:3532] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "ac0Elj7Idlm5j9frhqT63gAAAEw"]
[Wed Apr 01 19:42:15.160994 2026] [:error] [pid 17856:tid 17858] [client 4.233.57.137:3608] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "ac0Elz7Idlm5j9frhqT64QAAAEA"]
[Wed Apr 01 19:42:15.904570 2026] [:error] [pid 62559:tid 62577] [client 4.233.57.137:3536] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "ac0Ely7NKI8IaNKZFId_oAAAAVA"]
[Wed Apr 01 19:42:16.723998 2026] [:error] [pid 8995:tid 9001] [client 4.233.57.137:47869] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-ccv.php"] [unique_id "ac0EmOonaBjs3qxcReeuZgAAAAM"]
[Wed Apr 01 19:42:17.467717 2026] [:error] [pid 17856:tid 17879] [client 4.233.57.137:49457] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-ccv.php"] [unique_id "ac0EmT7Idlm5j9frhqT64wAAAFU"]
[Wed Apr 01 19:42:18.287716 2026] [:error] [pid 17856:tid 17873] [client 4.233.57.137:3621] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-ccv.php"] [unique_id "ac0Emj7Idlm5j9frhqT65wAAAE8"]
[Wed Apr 01 19:42:18.895834 2026] [:error] [pid 17856:tid 17872] [client 4.233.57.137:44850] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-ccv.php"] [unique_id "ac0Emj7Idlm5j9frhqT67AAAAE4"]
[Wed Apr 01 19:42:19.470706 2026] [:error] [pid 17856:tid 17865] [client 4.233.57.137:50898] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/luyuc.php"] [unique_id "ac0Emz7Idlm5j9frhqT68AAAAEc"]
[Wed Apr 01 19:42:19.956596 2026] [:error] [pid 8910:tid 8978] [client 4.233.57.137:47870] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/luyuc.php"] [unique_id "ac0Em6JZINUcF3tYgExLsgAAAQo"]
[Wed Apr 01 19:42:20.472193 2026] [:error] [pid 8909:tid 8946] [client 4.233.57.137:65483] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/luyuc.php"] [unique_id "ac0EnDvP_a0662gDl6B_wQAAAMU"]
[Wed Apr 01 19:42:21.039744 2026] [:error] [pid 17856:tid 17877] [client 4.233.57.137:65472] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/luyuc.php"] [unique_id "ac0EnT7Idlm5j9frhqT6_AAAAFM"]
[Wed Apr 01 19:42:21.681373 2026] [:error] [pid 8909:tid 8958] [client 4.233.57.137:3403] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "ac0EnTvP_a0662gDl6B_xAAAANE"]
[Wed Apr 01 19:42:22.392155 2026] [:error] [pid 8910:tid 8992] [client 4.233.57.137:22222] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "ac0EnqJZINUcF3tYgExLuQAAARg"]
[Wed Apr 01 19:42:23.210899 2026] [:error] [pid 8910:tid 8975] [client 4.233.57.137:49469] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "ac0En6JZINUcF3tYgExLwgAAAQc"]
[Wed Apr 01 19:42:23.983978 2026] [:error] [pid 17856:tid 17869] [client 4.233.57.137:37099] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "ac0Enz7Idlm5j9frhqT7AgAAAEs"]
[Wed Apr 01 19:42:24.808287 2026] [:error] [pid 8995:tid 9021] [client 4.233.57.137:21670] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htto.php"] [unique_id "ac0EoOonaBjs3qxcReeudAAAABc"]
[Wed Apr 01 19:42:25.613915 2026] [:error] [pid 8908:tid 8932] [client 4.233.57.137:50833] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htto.php"] [unique_id "ac0EofkmxtJXGnLdvgBiDQAAAJM"]
[Wed Apr 01 19:42:26.582867 2026] [:error] [pid 8908:tid 8930] [client 4.233.57.137:59915] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htto.php"] [unique_id "ac0EovkmxtJXGnLdvgBiDgAAAJE"]
[Wed Apr 01 19:42:28.457799 2026] [:error] [pid 8910:tid 8989] [client 4.233.57.137:50837] [client 4.233.57.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htto.php"] [unique_id "ac0EpKJZINUcF3tYgExL0AAAARU"]
[Wed Apr 01 22:36:14.165164 2026] [:error] [pid 62559:tid 62573] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 01 22:36:14.421744 2026] [:error] [pid 62559:tid 62570] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Wed Apr 01 22:36:14.683345 2026] [:error] [pid 62559:tid 62569] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 01 22:36:14.925606 2026] [:error] [pid 62559:tid 62584] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Wed Apr 01 22:36:15.192454 2026] [:error] [pid 62559:tid 62564] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/x1.php
[Wed Apr 01 22:36:15.437285 2026] [:error] [pid 62559:tid 62566] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Wed Apr 01 22:36:15.922856 2026] [:error] [pid 62559:tid 62573] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Wed Apr 01 22:36:16.182987 2026] [:error] [pid 62559:tid 62578] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/24.php
[Wed Apr 01 22:36:16.448031 2026] [:error] [pid 62559:tid 62581] [client 158.158.32.26:14923] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Wed Apr 01 22:36:16.686691 2026] [:error] [pid 62559:tid 62583] [client 158.158.32.26:14923] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ac0tYC7NKI8IaNKZFIfKIAAAAVY"]
[Wed Apr 01 22:36:17.195033 2026] [:error] [pid 8910:tid 8987] [client 158.158.32.26:14931] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ac0tYaJZINUcF3tYgEx3oAAAARM"]
[Wed Apr 01 22:36:17.690155 2026] [:error] [pid 17856:tid 17859] [client 158.158.32.26:64975] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ac0tYT7Idlm5j9frhqRq4AAAAEE"]
[Wed Apr 01 22:36:18.339058 2026] [:error] [pid 8908:tid 8930] [client 158.158.32.26:7365] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ac0tYvkmxtJXGnLdvgC01AAAAJE"]
[Wed Apr 01 22:36:18.827106 2026] [:error] [pid 8995:tid 8999] [client 158.158.32.26:65012] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fyiiz.php"] [unique_id "ac0tYuonaBjs3qxcRefj2wAAAAE"]
[Wed Apr 01 22:36:19.382749 2026] [:error] [pid 62559:tid 62562] [client 158.158.32.26:64968] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fyiiz.php"] [unique_id "ac0tYy7NKI8IaNKZFIfKJAAAAUE"]
[Wed Apr 01 22:36:19.878579 2026] [:error] [pid 62559:tid 62570] [client 158.158.32.26:7398] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fyiiz.php"] [unique_id "ac0tYy7NKI8IaNKZFIfKKAAAAUk"]
[Wed Apr 01 22:36:20.369808 2026] [:error] [pid 62559:tid 62580] [client 158.158.32.26:65010] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fyiiz.php"] [unique_id "ac0tZC7NKI8IaNKZFIfKKwAAAVM"]
[Wed Apr 01 22:36:20.907701 2026] [:error] [pid 8909:tid 8962] [client 158.158.32.26:7383] [client 158.158.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/app.php"] [unique_id "ac0tZDvP_a0662gDl6D7DwAAANU"]
[Wed Apr 01 22:36:21.420159 2026] [:error] [pid 8995:tid 9014] [client 158.158.32.26:65021] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0tZeonaBjs3qxcRefj4wAAABA"]
[Wed Apr 01 22:36:21.911464 2026] [:error] [pid 8908:tid 8925] [client 158.158.32.26:65439] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0tZfkmxtJXGnLdvgC03gAAAIw"]
[Wed Apr 01 22:36:22.423569 2026] [:error] [pid 8909:tid 8945] [client 158.158.32.26:7422] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0tZjvP_a0662gDl6D7EwAAAMQ"]
[Wed Apr 01 22:36:22.905150 2026] [:error] [pid 8908:tid 8932] [client 158.158.32.26:65452] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0tZvkmxtJXGnLdvgC05AAAAJM"]
[Wed Apr 01 22:36:23.429466 2026] [:error] [pid 8995:tid 9002] [client 158.158.32.26:64970] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "ac0tZ-onaBjs3qxcRefj6AAAAAQ"]
[Wed Apr 01 22:36:23.950296 2026] [:error] [pid 8995:tid 9000] [client 158.158.32.26:14920] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "ac0tZ-onaBjs3qxcRefj6wAAAAI"]
[Wed Apr 01 22:36:24.507362 2026] [:error] [pid 8995:tid 9021] [client 158.158.32.26:7400] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "ac0taOonaBjs3qxcRefj7QAAABc"]
[Wed Apr 01 22:36:25.072193 2026] [:error] [pid 62559:tid 62568] [client 158.158.32.26:64998] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "ac0taS7NKI8IaNKZFIfKMwAAAUc"]
[Wed Apr 01 22:36:25.586084 2026] [:error] [pid 62559:tid 62584] [client 158.158.32.26:14962] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0taS7NKI8IaNKZFIfKNgAAAVc"]
[Wed Apr 01 22:36:26.087818 2026] [:error] [pid 8908:tid 8927] [client 158.158.32.26:65447] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0tavkmxtJXGnLdvgC07wAAAI4"]
[Wed Apr 01 22:36:26.568874 2026] [:error] [pid 8909:tid 8948] [client 158.158.32.26:7406] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0tajvP_a0662gDl6D7FwAAAMc"]
[Wed Apr 01 22:36:27.060178 2026] [:error] [pid 8909:tid 8961] [client 158.158.32.26:14957] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0tazvP_a0662gDl6D7GAAAANQ"]
[Wed Apr 01 22:36:27.583048 2026] [:error] [pid 62559:tid 62566] [client 158.158.32.26:14952] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "ac0tay7NKI8IaNKZFIfKQgAAAUU"]
[Wed Apr 01 22:36:28.062707 2026] [:error] [pid 8908:tid 8916] [client 158.158.32.26:7363] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "ac0tbPkmxtJXGnLdvgC09AAAAIM"]
[Wed Apr 01 22:36:28.651493 2026] [:error] [pid 8908:tid 8922] [client 158.158.32.26:14963] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "ac0tbPkmxtJXGnLdvgC09QAAAIk"]
[Wed Apr 01 22:36:29.180082 2026] [:error] [pid 8908:tid 8923] [client 158.158.32.26:65435] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "ac0tbfkmxtJXGnLdvgC09gAAAIo"]
[Wed Apr 01 22:36:29.678848 2026] [:error] [pid 8909:tid 8946] [client 158.158.32.26:7382] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/index.php"] [unique_id "ac0tbTvP_a0662gDl6D7HAAAAMU"]
[Wed Apr 01 22:36:30.174954 2026] [:error] [pid 8908:tid 8933] [client 158.158.32.26:50370] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/index.php"] [unique_id "ac0tbvkmxtJXGnLdvgC09wAAAJQ"]
[Wed Apr 01 22:36:30.667660 2026] [:error] [pid 8995:tid 9022] [client 158.158.32.26:7414] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/index.php"] [unique_id "ac0tbuonaBjs3qxcRefj8wAAABg"]
[Wed Apr 01 22:36:31.196624 2026] [:error] [pid 62559:tid 62576] [client 158.158.32.26:14946] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/index.php"] [unique_id "ac0tby7NKI8IaNKZFIfKTwAAAU8"]
[Wed Apr 01 22:36:31.681559 2026] [:error] [pid 17856:tid 17860] [client 158.158.32.26:14964] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/erty.php"] [unique_id "ac0tbz7Idlm5j9frhqRq8QAAAEI"]
[Wed Apr 01 22:36:32.174836 2026] [:error] [pid 62559:tid 62572] [client 158.158.32.26:14912] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/erty.php"] [unique_id "ac0tcC7NKI8IaNKZFIfKVQAAAUs"]
[Wed Apr 01 22:36:32.656343 2026] [:error] [pid 8909:tid 8959] [client 158.158.32.26:65418] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/erty.php"] [unique_id "ac0tcDvP_a0662gDl6D7IQAAANI"]
[Wed Apr 01 22:36:33.150519 2026] [:error] [pid 62559:tid 62581] [client 158.158.32.26:65444] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/erty.php"] [unique_id "ac0tcS7NKI8IaNKZFIfKWwAAAVQ"]
[Wed Apr 01 22:36:33.738645 2026] [:error] [pid 8995:tid 9011] [client 158.158.32.26:65001] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0.php"] [unique_id "ac0tceonaBjs3qxcRefj-QAAAA0"]
[Wed Apr 01 22:36:34.230426 2026] [:error] [pid 62559:tid 62574] [client 158.158.32.26:7420] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0.php"] [unique_id "ac0tci7NKI8IaNKZFIfKYQAAAU0"]
[Wed Apr 01 22:36:34.752505 2026] [:error] [pid 8909:tid 8956] [client 158.158.32.26:14938] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0.php"] [unique_id "ac0tcjvP_a0662gDl6D7IgAAAM8"]
[Wed Apr 01 22:36:35.253472 2026] [:error] [pid 8909:tid 8942] [client 158.158.32.26:64999] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0.php"] [unique_id "ac0tczvP_a0662gDl6D7JQAAAME"]
[Wed Apr 01 22:36:35.763731 2026] [:error] [pid 8908:tid 8935] [client 158.158.32.26:65434] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "ac0tc_kmxtJXGnLdvgC0_wAAAJY"]
[Wed Apr 01 22:36:36.243375 2026] [:error] [pid 8908:tid 8929] [client 158.158.32.26:65015] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "ac0tdPkmxtJXGnLdvgC1AQAAAJA"]
[Wed Apr 01 22:36:36.720524 2026] [:error] [pid 8995:tid 9022] [client 158.158.32.26:65428] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "ac0tdOonaBjs3qxcRefkAAAAABg"]
[Wed Apr 01 22:36:37.218603 2026] [:error] [pid 62559:tid 62579] [client 158.158.32.26:7362] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "ac0tdS7NKI8IaNKZFIfKdAAAAVI"]
[Wed Apr 01 22:36:37.757185 2026] [:error] [pid 8910:tid 8990] [client 158.158.32.26:7376] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "ac0tdaJZINUcF3tYgEx3xwAAARY"]
[Wed Apr 01 22:36:38.294692 2026] [:error] [pid 62559:tid 62578] [client 158.158.32.26:65437] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "ac0tdi7NKI8IaNKZFIfKegAAAVE"]
[Wed Apr 01 22:36:38.889680 2026] [:error] [pid 8995:tid 9010] [client 158.158.32.26:7892] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "ac0tduonaBjs3qxcRefkAgAAAAw"]
[Wed Apr 01 22:36:39.412691 2026] [:error] [pid 17856:tid 17872] [client 158.158.32.26:14950] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "ac0tdz7Idlm5j9frhqRq-QAAAE4"]
[Wed Apr 01 22:36:39.975414 2026] [:error] [pid 8910:tid 8968] [client 158.158.32.26:7390] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "ac0td6JZINUcF3tYgEx3zAAAAQA"]
[Wed Apr 01 22:36:40.489869 2026] [:error] [pid 17856:tid 17882] [client 158.158.32.26:50369] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "ac0teD7Idlm5j9frhqRq-wAAAFg"]
[Wed Apr 01 22:36:41.223630 2026] [:error] [pid 8908:tid 8931] [client 158.158.32.26:14925] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "ac0tefkmxtJXGnLdvgC1EAAAAJI"]
[Wed Apr 01 22:36:41.710999 2026] [:error] [pid 62559:tid 62564] [client 158.158.32.26:7888] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "ac0teS7NKI8IaNKZFIfKhgAAAUM"]
[Wed Apr 01 22:36:42.230912 2026] [:error] [pid 8908:tid 8923] [client 158.158.32.26:14975] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "ac0tevkmxtJXGnLdvgC1GAAAAIo"]
[Wed Apr 01 22:36:42.716509 2026] [:error] [pid 8908:tid 8934] [client 158.158.32.26:64984] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "ac0tevkmxtJXGnLdvgC1HAAAAJU"]
[Wed Apr 01 22:36:43.329522 2026] [:error] [pid 62559:tid 62574] [client 158.158.32.26:14974] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "ac0tey7NKI8IaNKZFIfKkAAAAU0"]
[Wed Apr 01 22:36:43.866735 2026] [:error] [pid 62559:tid 62568] [client 158.158.32.26:14913] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "ac0tey7NKI8IaNKZFIfKlAAAAUc"]
[Wed Apr 01 22:36:44.352521 2026] [:error] [pid 17856:tid 17868] [client 158.158.32.26:64993] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwq13.php"] [unique_id "ac0tfD7Idlm5j9frhqRq_gAAAEo"]
[Wed Apr 01 22:36:44.840573 2026] [:error] [pid 8908:tid 8921] [client 158.158.32.26:14973] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwq13.php"] [unique_id "ac0tfPkmxtJXGnLdvgC1JAAAAIg"]
[Wed Apr 01 22:36:45.392983 2026] [:error] [pid 8908:tid 8926] [client 158.158.32.26:65468] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwq13.php"] [unique_id "ac0tffkmxtJXGnLdvgC1JgAAAI0"]
[Wed Apr 01 22:36:45.929422 2026] [:error] [pid 62559:tid 62567] [client 158.158.32.26:64974] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwq13.php"] [unique_id "ac0tfS7NKI8IaNKZFIfKoQAAAUY"]
[Wed Apr 01 22:36:46.468354 2026] [:error] [pid 8995:tid 9016] [client 158.158.32.26:7419] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aapig.php"] [unique_id "ac0tfuonaBjs3qxcRefkCAAAABI"]
[Wed Apr 01 22:36:46.968156 2026] [:error] [pid 62559:tid 62571] [client 158.158.32.26:64966] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aapig.php"] [unique_id "ac0tfi7NKI8IaNKZFIfKqAAAAUo"]
[Wed Apr 01 22:36:47.504218 2026] [:error] [pid 62559:tid 62574] [client 158.158.32.26:50407] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aapig.php"] [unique_id "ac0tfy7NKI8IaNKZFIfKqwAAAU0"]
[Wed Apr 01 22:36:48.056023 2026] [:error] [pid 62559:tid 62584] [client 158.158.32.26:64991] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aapig.php"] [unique_id "ac0tgC7NKI8IaNKZFIfKswAAAVc"]
[Wed Apr 01 22:36:48.547108 2026] [:error] [pid 8995:tid 9003] [client 158.158.32.26:7395] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/webadmin.php"] [unique_id "ac0tgOonaBjs3qxcRefkDAAAAAU"]
[Wed Apr 01 22:36:49.046696 2026] [:error] [pid 8908:tid 8913] [client 158.158.32.26:7387] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/webadmin.php"] [unique_id "ac0tgfkmxtJXGnLdvgC1KgAAAIA"]
[Wed Apr 01 22:36:49.551750 2026] [:error] [pid 8908:tid 8927] [client 158.158.32.26:14929] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/webadmin.php"] [unique_id "ac0tgfkmxtJXGnLdvgC1LQAAAI4"]
[Wed Apr 01 22:36:50.093767 2026] [:error] [pid 62559:tid 62572] [client 158.158.32.26:65423] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/webadmin.php"] [unique_id "ac0tgi7NKI8IaNKZFIfKwAAAAUs"]
[Wed Apr 01 22:36:50.630637 2026] [:error] [pid 8909:tid 8955] [client 158.158.32.26:65446] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc0252.php"] [unique_id "ac0tgjvP_a0662gDl6D7MQAAAM4"]
[Wed Apr 01 22:36:51.136703 2026] [:error] [pid 62559:tid 62583] [client 158.158.32.26:65014] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc0252.php"] [unique_id "ac0tgy7NKI8IaNKZFIfKyQAAAVY"]
[Wed Apr 01 22:36:51.676414 2026] [:error] [pid 62559:tid 62584] [client 158.158.32.26:14927] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc0252.php"] [unique_id "ac0tgy7NKI8IaNKZFIfKzwAAAVc"]
[Wed Apr 01 22:36:52.170578 2026] [:error] [pid 62559:tid 62567] [client 158.158.32.26:14947] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xc0252.php"] [unique_id "ac0thC7NKI8IaNKZFIfK0QAAAUY"]
[Wed Apr 01 22:36:52.655993 2026] [:error] [pid 17856:tid 17876] [client 158.158.32.26:14939] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "ac0thD7Idlm5j9frhqRrAwAAAFI"]
[Wed Apr 01 22:36:53.143226 2026] [:error] [pid 62559:tid 62582] [client 158.158.32.26:64986] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "ac0thS7NKI8IaNKZFIfK1QAAAVU"]
[Wed Apr 01 22:36:53.701429 2026] [:error] [pid 17856:tid 17882] [client 158.158.32.26:65410] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "ac0thT7Idlm5j9frhqRrCgAAAFg"]
[Wed Apr 01 22:36:54.183550 2026] [:error] [pid 62559:tid 62578] [client 158.158.32.26:7397] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "ac0thi7NKI8IaNKZFIfK2QAAAVE"]
[Wed Apr 01 22:36:54.713865 2026] [:error] [pid 62559:tid 62566] [client 158.158.32.26:50424] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sc.php"] [unique_id "ac0thi7NKI8IaNKZFIfK2wAAAUU"]
[Wed Apr 01 22:36:55.225883 2026] [:error] [pid 62559:tid 62570] [client 158.158.32.26:7401] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sc.php"] [unique_id "ac0thy7NKI8IaNKZFIfK3QAAAUk"]
[Wed Apr 01 22:36:55.723652 2026] [:error] [pid 62559:tid 62575] [client 158.158.32.26:14944] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sc.php"] [unique_id "ac0thy7NKI8IaNKZFIfK4QAAAU4"]
[Wed Apr 01 22:36:56.255084 2026] [:error] [pid 8908:tid 8913] [client 158.158.32.26:65456] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sc.php"] [unique_id "ac0tiPkmxtJXGnLdvgC1QwAAAIA"]
[Wed Apr 01 22:36:56.735049 2026] [:error] [pid 62559:tid 62561] [client 158.158.32.26:64997] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mis.php"] [unique_id "ac0tiC7NKI8IaNKZFIfK6QAAAUA"]
[Wed Apr 01 22:36:57.220176 2026] [:error] [pid 8908:tid 8933] [client 158.158.32.26:50373] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mis.php"] [unique_id "ac0tifkmxtJXGnLdvgC1RgAAAJQ"]
[Wed Apr 01 22:36:57.699305 2026] [:error] [pid 17856:tid 17878] [client 158.158.32.26:7368] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mis.php"] [unique_id "ac0tiT7Idlm5j9frhqRrEQAAAFQ"]
[Wed Apr 01 22:36:58.191284 2026] [:error] [pid 62559:tid 62585] [client 158.158.32.26:65416] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mis.php"] [unique_id "ac0tii7NKI8IaNKZFIfK8gAAAVg"]
[Wed Apr 01 22:36:58.726373 2026] [:error] [pid 8995:tid 9012] [client 158.158.32.26:14936] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "ac0tiuonaBjs3qxcRefkFQAAAA4"]
[Wed Apr 01 22:36:59.211181 2026] [:error] [pid 8909:tid 8958] [client 158.158.32.26:7391] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "ac0tizvP_a0662gDl6D7NAAAANE"]
[Wed Apr 01 22:36:59.710090 2026] [:error] [pid 17856:tid 17863] [client 158.158.32.26:7907] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "ac0tiz7Idlm5j9frhqRrGwAAAEU"]
[Wed Apr 01 22:37:00.233745 2026] [:error] [pid 8908:tid 8934] [client 158.158.32.26:7380] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "ac0tjPkmxtJXGnLdvgC1SQAAAJU"]
[Wed Apr 01 22:37:00.877807 2026] [:error] [pid 62559:tid 62584] [client 158.158.32.26:65009] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xvs.php"] [unique_id "ac0tjC7NKI8IaNKZFIfLAAAAAVc"]
[Wed Apr 01 22:37:01.393802 2026] [:error] [pid 8909:tid 8953] [client 158.158.32.26:7421] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xvs.php"] [unique_id "ac0tjTvP_a0662gDl6D7NQAAAMw"]
[Wed Apr 01 22:37:01.881197 2026] [:error] [pid 8909:tid 8954] [client 158.158.32.26:7381] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xvs.php"] [unique_id "ac0tjTvP_a0662gDl6D7NgAAAM0"]
[Wed Apr 01 22:37:02.366132 2026] [:error] [pid 8995:tid 9005] [client 158.158.32.26:65016] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xvs.php"] [unique_id "ac0tjuonaBjs3qxcRefkGwAAAAc"]
[Wed Apr 01 22:37:02.851824 2026] [:error] [pid 8909:tid 8956] [client 158.158.32.26:50405] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ac0tjjvP_a0662gDl6D7OwAAAM8"]
[Wed Apr 01 22:37:03.367798 2026] [:error] [pid 8909:tid 8963] [client 158.158.32.26:65412] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ac0tjzvP_a0662gDl6D7PAAAANY"]
[Wed Apr 01 22:37:03.864557 2026] [:error] [pid 17856:tid 17867] [client 158.158.32.26:7177] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ac0tjz7Idlm5j9frhqRrJQAAAEk"]
[Wed Apr 01 22:37:04.404911 2026] [:error] [pid 8995:tid 9011] [client 158.158.32.26:7361] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ac0tkOonaBjs3qxcRefkIwAAAA0"]
[Wed Apr 01 22:37:04.902928 2026] [:error] [pid 8910:tid 8990] [client 158.158.32.26:7891] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "ac0tkKJZINUcF3tYgEx4AwAAARY"]
[Wed Apr 01 22:37:05.406854 2026] [:error] [pid 8908:tid 8920] [client 158.158.32.26:7210] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "ac0tkfkmxtJXGnLdvgC1XAAAAIc"]
[Wed Apr 01 22:37:05.887805 2026] [:error] [pid 17856:tid 17880] [client 158.158.32.26:14932] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "ac0tkT7Idlm5j9frhqRrKwAAAFY"]
[Wed Apr 01 22:37:06.411962 2026] [:error] [pid 8995:tid 9020] [client 158.158.32.26:7882] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "ac0tkuonaBjs3qxcRefkJgAAABY"]
[Wed Apr 01 22:37:06.900467 2026] [:error] [pid 8995:tid 8998] [client 158.158.32.26:7372] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web.php"] [unique_id "ac0tkuonaBjs3qxcRefkKAAAAAA"]
[Wed Apr 01 22:37:07.383748 2026] [:error] [pid 62559:tid 62581] [client 158.158.32.26:65448] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web.php"] [unique_id "ac0tky7NKI8IaNKZFIfLCAAAAVQ"]
[Wed Apr 01 22:37:07.873688 2026] [:error] [pid 62559:tid 62578] [client 158.158.32.26:14933] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web.php"] [unique_id "ac0tky7NKI8IaNKZFIfLCwAAAVE"]
[Wed Apr 01 22:37:08.393823 2026] [:error] [pid 17856:tid 17877] [client 158.158.32.26:65460] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web.php"] [unique_id "ac0tlD7Idlm5j9frhqRrMQAAAFM"]
[Wed Apr 01 22:37:08.909639 2026] [:error] [pid 17856:tid 17860] [client 158.158.32.26:64972] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0tlD7Idlm5j9frhqRrMwAAAEI"]
[Wed Apr 01 22:37:09.392265 2026] [:error] [pid 8910:tid 8972] [client 158.158.32.26:50413] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0tlaJZINUcF3tYgEx4IgAAAQQ"]
[Wed Apr 01 22:37:09.932442 2026] [:error] [pid 8910:tid 8979] [client 158.158.32.26:14943] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0tlaJZINUcF3tYgEx4KAAAAQs"]
[Wed Apr 01 22:37:10.420069 2026] [:error] [pid 17856:tid 17880] [client 158.158.32.26:65413] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0tlj7Idlm5j9frhqRrNwAAAFY"]
[Wed Apr 01 22:37:10.928522 2026] [:error] [pid 8909:tid 8951] [client 158.158.32.26:64985] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lp6.php"] [unique_id "ac0tljvP_a0662gDl6D7SwAAAMo"]
[Wed Apr 01 22:37:11.429029 2026] [:error] [pid 8909:tid 8945] [client 158.158.32.26:65005] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lp6.php"] [unique_id "ac0tlzvP_a0662gDl6D7TQAAAMQ"]
[Wed Apr 01 22:37:11.945844 2026] [:error] [pid 8910:tid 8982] [client 158.158.32.26:65409] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lp6.php"] [unique_id "ac0tl6JZINUcF3tYgEx4MgAAAQ4"]
[Wed Apr 01 22:37:12.449638 2026] [:error] [pid 8909:tid 8953] [client 158.158.32.26:65020] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lp6.php"] [unique_id "ac0tmDvP_a0662gDl6D7UgAAAMw"]
[Wed Apr 01 22:37:12.985664 2026] [:error] [pid 8909:tid 8952] [client 158.158.32.26:7388] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/com.php"] [unique_id "ac0tmDvP_a0662gDl6D7UwAAAMs"]
[Wed Apr 01 22:37:13.470134 2026] [:error] [pid 8908:tid 8925] [client 158.158.32.26:65462] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/com.php"] [unique_id "ac0tmfkmxtJXGnLdvgC1YQAAAIw"]
[Wed Apr 01 22:37:13.995946 2026] [:error] [pid 62559:tid 62565] [client 158.158.32.26:65424] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/com.php"] [unique_id "ac0tmS7NKI8IaNKZFIfLJAAAAUQ"]
[Wed Apr 01 22:37:14.488081 2026] [:error] [pid 8909:tid 8947] [client 158.158.32.26:65436] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/com.php"] [unique_id "ac0tmjvP_a0662gDl6D7YgAAAMY"]
[Wed Apr 01 22:37:14.979291 2026] [:error] [pid 8908:tid 8922] [client 158.158.32.26:50374] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "ac0tmvkmxtJXGnLdvgC1aQAAAIk"]
[Wed Apr 01 22:37:15.488914 2026] [:error] [pid 17856:tid 17860] [client 158.158.32.26:64994] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "ac0tmz7Idlm5j9frhqRrOgAAAEI"]
[Wed Apr 01 22:37:15.990937 2026] [:error] [pid 8908:tid 8919] [client 158.158.32.26:14958] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "ac0tm_kmxtJXGnLdvgC1bAAAAIY"]
[Wed Apr 01 22:37:16.493398 2026] [:error] [pid 8995:tid 9012] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Apr 01 22:37:16.752693 2026] [:error] [pid 8995:tid 9020] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Wed Apr 01 22:37:16.995941 2026] [:error] [pid 8995:tid 9016] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Apr 01 22:37:17.256434 2026] [:error] [pid 8995:tid 9022] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 01 22:37:17.772890 2026] [:error] [pid 8995:tid 9009] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Wed Apr 01 22:37:18.016036 2026] [:error] [pid 8995:tid 9018] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Wed Apr 01 22:37:18.258598 2026] [:error] [pid 8995:tid 9010] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/to.php
[Wed Apr 01 22:37:18.504042 2026] [:error] [pid 8995:tid 9008] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/wqqs.php
[Wed Apr 01 22:37:18.762846 2026] [:error] [pid 8995:tid 9000] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Wed Apr 01 22:37:19.007368 2026] [:error] [pid 8995:tid 9013] [client 158.158.32.26:14930] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Wed Apr 01 22:37:19.260029 2026] [:error] [pid 8995:tid 9001] [client 158.158.32.26:14930] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aifa.php"] [unique_id "ac0tn-onaBjs3qxcRefkQgAAAAM"]
[Wed Apr 01 22:37:19.739493 2026] [:error] [pid 8908:tid 8930] [client 158.158.32.26:7386] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aifa.php"] [unique_id "ac0tn_kmxtJXGnLdvgC1cQAAAJE"]
[Wed Apr 01 22:37:20.253820 2026] [:error] [pid 8908:tid 8922] [client 158.158.32.26:7175] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aifa.php"] [unique_id "ac0toPkmxtJXGnLdvgC1dAAAAIk"]
[Wed Apr 01 22:37:20.753675 2026] [:error] [pid 17856:tid 17862] [client 158.158.32.26:50396] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aifa.php"] [unique_id "ac0toD7Idlm5j9frhqRrQwAAAEQ"]
[Wed Apr 01 22:37:21.257733 2026] [:error] [pid 8908:tid 8917] [client 158.158.32.26:65018] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "ac0tofkmxtJXGnLdvgC1eAAAAIQ"]
[Wed Apr 01 22:37:21.773001 2026] [:error] [pid 8908:tid 8934] [client 158.158.32.26:7813] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "ac0tofkmxtJXGnLdvgC1egAAAJU"]
[Wed Apr 01 22:37:22.272820 2026] [:error] [pid 8908:tid 8915] [client 158.158.32.26:7198] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "ac0tovkmxtJXGnLdvgC1fgAAAII"]
[Wed Apr 01 22:37:22.798328 2026] [:error] [pid 8908:tid 8916] [client 158.158.32.26:65451] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "ac0tovkmxtJXGnLdvgC1gAAAAIM"]
[Wed Apr 01 22:37:23.282944 2026] [:error] [pid 8908:tid 8928] [client 158.158.32.26:50427] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feokc.php"] [unique_id "ac0to_kmxtJXGnLdvgC1hAAAAI8"]
[Wed Apr 01 22:37:24.020390 2026] [:error] [pid 8908:tid 8917] [client 158.158.32.26:7932] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feokc.php"] [unique_id "ac0tpPkmxtJXGnLdvgC1jAAAAIQ"]
[Wed Apr 01 22:37:24.633386 2026] [:error] [pid 8908:tid 8924] [client 158.158.32.26:14959] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feokc.php"] [unique_id "ac0tpPkmxtJXGnLdvgC1jwAAAIs"]
[Wed Apr 01 22:37:25.157866 2026] [:error] [pid 8909:tid 8955] [client 158.158.32.26:65463] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/feokc.php"] [unique_id "ac0tpTvP_a0662gDl6D7ggAAAM4"]
[Wed Apr 01 22:37:25.665588 2026] [:error] [pid 8908:tid 8926] [client 158.158.32.26:7384] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "ac0tpfkmxtJXGnLdvgC1lAAAAI0"]
[Wed Apr 01 22:37:26.181696 2026] [:error] [pid 8908:tid 8935] [client 158.158.32.26:7858] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "ac0tpvkmxtJXGnLdvgC1mwAAAJY"]
[Wed Apr 01 22:37:26.710809 2026] [:error] [pid 62559:tid 62575] [client 158.158.32.26:65003] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "ac0tpi7NKI8IaNKZFIfLQgAAAU4"]
[Wed Apr 01 22:37:27.233827 2026] [:error] [pid 62559:tid 62574] [client 158.158.32.26:14949] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nc4.php"] [unique_id "ac0tpy7NKI8IaNKZFIfLRQAAAU0"]
[Wed Apr 01 22:37:27.753209 2026] [:error] [pid 62559:tid 62582] [client 158.158.32.26:65019] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "ac0tpy7NKI8IaNKZFIfLSwAAAVU"]
[Wed Apr 01 22:37:28.382609 2026] [:error] [pid 62559:tid 62573] [client 158.158.32.26:64989] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "ac0tqC7NKI8IaNKZFIfLTwAAAUw"]
[Wed Apr 01 22:37:28.871637 2026] [:error] [pid 17856:tid 17875] [client 158.158.32.26:7230] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "ac0tqD7Idlm5j9frhqRrUgAAAFE"]
[Wed Apr 01 22:37:29.387214 2026] [:error] [pid 8995:tid 9000] [client 158.158.32.26:50402] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "ac0tqeonaBjs3qxcRefkSAAAAAI"]
[Wed Apr 01 22:37:29.894977 2026] [:error] [pid 8995:tid 9013] [client 158.158.32.26:65445] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0tqeonaBjs3qxcRefkSQAAAA8"]
[Wed Apr 01 22:37:30.395992 2026] [:error] [pid 8910:tid 8988] [client 158.158.32.26:50387] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0tqqJZINUcF3tYgEx4UwAAARQ"]
[Wed Apr 01 22:37:30.899321 2026] [:error] [pid 8908:tid 8934] [client 158.158.32.26:65004] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0tqvkmxtJXGnLdvgC1pQAAAJU"]
[Wed Apr 01 22:37:31.391622 2026] [:error] [pid 8909:tid 8953] [client 158.158.32.26:65422] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0tqzvP_a0662gDl6D7kwAAAMw"]
[Wed Apr 01 22:37:31.872010 2026] [:error] [pid 8909:tid 8956] [client 158.158.32.26:7930] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "ac0tqzvP_a0662gDl6D7lwAAAM8"]
[Wed Apr 01 22:37:32.350547 2026] [:error] [pid 8909:tid 8963] [client 158.158.32.26:7197] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "ac0trDvP_a0662gDl6D7mQAAANY"]
[Wed Apr 01 22:37:32.838437 2026] [:error] [pid 8910:tid 8987] [client 158.158.32.26:65426] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "ac0trKJZINUcF3tYgEx4WgAAARM"]
[Wed Apr 01 22:37:33.328899 2026] [:error] [pid 8910:tid 8986] [client 158.158.32.26:7901] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "ac0traJZINUcF3tYgEx4XQAAARI"]
[Wed Apr 01 22:37:33.829718 2026] [:error] [pid 8910:tid 8972] [client 158.158.32.26:7409] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goat1.php"] [unique_id "ac0traJZINUcF3tYgEx4YgAAAQQ"]
[Wed Apr 01 22:37:34.344613 2026] [:error] [pid 8995:tid 9011] [client 158.158.32.26:7385] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goat1.php"] [unique_id "ac0truonaBjs3qxcRefkSwAAAA0"]
[Wed Apr 01 22:37:34.862160 2026] [:error] [pid 62559:tid 62569] [client 158.158.32.26:50385] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goat1.php"] [unique_id "ac0tri7NKI8IaNKZFIfLWAAAAUg"]
[Wed Apr 01 22:37:35.348266 2026] [:error] [pid 8909:tid 8961] [client 158.158.32.26:64971] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goat1.php"] [unique_id "ac0trzvP_a0662gDl6D7nAAAANQ"]
[Wed Apr 01 22:37:36.048500 2026] [:error] [pid 62559:tid 62582] [client 158.158.32.26:14948] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cron.php"] [unique_id "ac0tsC7NKI8IaNKZFIfLXgAAAVU"]
[Wed Apr 01 22:37:36.585682 2026] [:error] [pid 17856:tid 17871] [client 158.158.32.26:65431] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cron.php"] [unique_id "ac0tsD7Idlm5j9frhqRrXQAAAE0"]
[Wed Apr 01 22:37:37.090508 2026] [:error] [pid 17856:tid 17876] [client 158.158.32.26:7423] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cron.php"] [unique_id "ac0tsT7Idlm5j9frhqRrXwAAAFI"]
[Wed Apr 01 22:37:37.647750 2026] [:error] [pid 17856:tid 17865] [client 158.158.32.26:14924] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cron.php"] [unique_id "ac0tsT7Idlm5j9frhqRrYQAAAEc"]
[Wed Apr 01 22:37:38.129843 2026] [:error] [pid 8995:tid 9003] [client 158.158.32.26:7364] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yanz.php"] [unique_id "ac0tsuonaBjs3qxcRefkUwAAAAU"]
[Wed Apr 01 22:37:38.608318 2026] [:error] [pid 62559:tid 62566] [client 158.158.32.26:7188] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yanz.php"] [unique_id "ac0tsi7NKI8IaNKZFIfLYgAAAUU"]
[Wed Apr 01 22:37:39.087475 2026] [:error] [pid 62559:tid 62578] [client 158.158.32.26:65417] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yanz.php"] [unique_id "ac0tsy7NKI8IaNKZFIfLZQAAAVE"]
[Wed Apr 01 22:37:39.609631 2026] [:error] [pid 8995:tid 9018] [client 158.158.32.26:7903] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yanz.php"] [unique_id "ac0ts-onaBjs3qxcRefkVwAAABQ"]
[Wed Apr 01 22:37:40.180659 2026] [:error] [pid 8910:tid 8980] [client 158.158.32.26:7910] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "ac0ttKJZINUcF3tYgEx4bgAAAQw"]
[Wed Apr 01 22:37:40.695525 2026] [:error] [pid 8909:tid 8942] [client 158.158.32.26:64990] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "ac0ttDvP_a0662gDl6D7pgAAAME"]
[Wed Apr 01 22:37:41.193535 2026] [:error] [pid 8909:tid 8949] [client 158.158.32.26:7193] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "ac0ttTvP_a0662gDl6D7qAAAAMg"]
[Wed Apr 01 22:37:41.693676 2026] [:error] [pid 8909:tid 8962] [client 158.158.32.26:14918] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "ac0ttTvP_a0662gDl6D7qgAAANU"]
[Wed Apr 01 22:37:42.187497 2026] [:error] [pid 8909:tid 8964] [client 158.158.32.26:14870] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/network.php"] [unique_id "ac0ttjvP_a0662gDl6D7rAAAANc"]
[Wed Apr 01 22:37:42.672411 2026] [:error] [pid 17856:tid 17873] [client 158.158.32.26:7836] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/network.php"] [unique_id "ac0ttj7Idlm5j9frhqRraAAAAE8"]
[Wed Apr 01 22:37:43.156692 2026] [:error] [pid 62559:tid 62584] [client 158.158.32.26:65408] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/network.php"] [unique_id "ac0tty7NKI8IaNKZFIfLcQAAAVc"]
[Wed Apr 01 22:37:43.654674 2026] [:error] [pid 62559:tid 62575] [client 158.158.32.26:7918] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/network.php"] [unique_id "ac0tty7NKI8IaNKZFIfLdQAAAU4"]
[Wed Apr 01 22:37:44.137273 2026] [:error] [pid 62559:tid 62564] [client 158.158.32.26:64969] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-2019.php"] [unique_id "ac0tuC7NKI8IaNKZFIfLeAAAAUM"]
[Wed Apr 01 22:37:44.624220 2026] [:error] [pid 8910:tid 8984] [client 158.158.32.26:7826] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-2019.php"] [unique_id "ac0tuKJZINUcF3tYgEx4eAAAARA"]
[Wed Apr 01 22:37:45.143662 2026] [:error] [pid 8909:tid 8957] [client 158.158.32.26:50376] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-2019.php"] [unique_id "ac0tuTvP_a0662gDl6D7tQAAANA"]
[Wed Apr 01 22:37:45.677122 2026] [:error] [pid 62559:tid 62585] [client 158.158.32.26:50375] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-2019.php"] [unique_id "ac0tuS7NKI8IaNKZFIfLewAAAVg"]
[Wed Apr 01 22:37:46.157486 2026] [:error] [pid 17856:tid 17863] [client 158.158.32.26:14953] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bypass.php"] [unique_id "ac0tuj7Idlm5j9frhqRrbQAAAEU"]
[Wed Apr 01 22:37:46.639489 2026] [:error] [pid 8909:tid 8965] [client 158.158.32.26:65436] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bypass.php"] [unique_id "ac0tujvP_a0662gDl6D7twAAANg"]
[Wed Apr 01 22:37:47.134366 2026] [:error] [pid 62559:tid 62561] [client 158.158.32.26:64967] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bypass.php"] [unique_id "ac0tuy7NKI8IaNKZFIfLfwAAAUA"]
[Wed Apr 01 22:37:47.620331 2026] [:error] [pid 8909:tid 8960] [client 158.158.32.26:14951] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bypass.php"] [unique_id "ac0tuzvP_a0662gDl6D7vgAAANM"]
[Wed Apr 01 22:37:48.101196 2026] [:error] [pid 62559:tid 62579] [client 158.158.32.26:50409] [client 158.158.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ac0tvC7NKI8IaNKZFIfLhgAAAVI"]
[Wed Apr 01 22:37:48.590901 2026] [:error] [pid 62559:tid 62573] [client 158.158.32.26:7374] [client 158.158.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ac0tvC7NKI8IaNKZFIfLiQAAAUw"]
[Wed Apr 01 22:37:49.073690 2026] [:error] [pid 8995:tid 9003] [client 158.158.32.26:14968] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "ac0tveonaBjs3qxcRefkagAAAAU"]
[Wed Apr 01 22:37:49.565493 2026] [:error] [pid 62559:tid 62577] [client 158.158.32.26:65003] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "ac0tvS7NKI8IaNKZFIfLjQAAAVA"]
[Wed Apr 01 22:37:50.048770 2026] [:error] [pid 8908:tid 8936] [client 158.158.32.26:7898] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "ac0tvvkmxtJXGnLdvgC1twAAAJc"]
[Wed Apr 01 22:37:50.534131 2026] [:error] [pid 62559:tid 62579] [client 158.158.32.26:7201] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock.php"] [unique_id "ac0tvi7NKI8IaNKZFIfLkQAAAVI"]
[Wed Apr 01 22:37:51.022691 2026] [:error] [pid 8910:tid 8973] [client 158.158.32.26:65450] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock.php"] [unique_id "ac0tv6JZINUcF3tYgEx4jwAAAQU"]
[Wed Apr 01 22:37:51.525485 2026] [:error] [pid 17856:tid 17876] [client 158.158.32.26:7403] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock.php"] [unique_id "ac0tvz7Idlm5j9frhqRrcQAAAFI"]
[Wed Apr 01 22:37:52.045108 2026] [:error] [pid 8910:tid 8972] [client 158.158.32.26:50394] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock.php"] [unique_id "ac0twKJZINUcF3tYgEx4kgAAAQQ"]
[Wed Apr 01 22:37:52.549125 2026] [:error] [pid 8909:tid 8942] [client 158.158.32.26:58683] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mail.php"] [unique_id "ac0twDvP_a0662gDl6D7xAAAAME"]
[Wed Apr 01 22:37:53.045489 2026] [:error] [pid 17856:tid 17863] [client 158.158.32.26:65459] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mail.php"] [unique_id "ac0twT7Idlm5j9frhqRrdQAAAEU"]
[Wed Apr 01 22:37:53.586576 2026] [:error] [pid 17856:tid 17877] [client 158.158.32.26:65461] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mail.php"] [unique_id "ac0twT7Idlm5j9frhqRrdwAAAFM"]
[Wed Apr 01 22:37:54.095493 2026] [:error] [pid 8910:tid 8991] [client 158.158.32.26:50424] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mail.php"] [unique_id "ac0twqJZINUcF3tYgEx4ngAAARc"]
[Wed Apr 01 22:37:54.654200 2026] [:error] [pid 62559:tid 62583] [client 158.158.32.26:65454] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/marijuana.php"] [unique_id "ac0twi7NKI8IaNKZFIfLpAAAAVY"]
[Wed Apr 01 22:37:55.186399 2026] [:error] [pid 8910:tid 8988] [client 158.158.32.26:14967] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/marijuana.php"] [unique_id "ac0tw6JZINUcF3tYgEx4ogAAARQ"]
[Wed Apr 01 22:37:55.673951 2026] [:error] [pid 17856:tid 17871] [client 158.158.32.26:7407] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/marijuana.php"] [unique_id "ac0twz7Idlm5j9frhqRrfAAAAE0"]
[Wed Apr 01 22:37:56.215482 2026] [:error] [pid 62559:tid 62568] [client 158.158.32.26:7906] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/marijuana.php"] [unique_id "ac0txC7NKI8IaNKZFIfLswAAAUc"]
[Wed Apr 01 22:37:56.770502 2026] [:error] [pid 62559:tid 62576] [client 158.158.32.26:65427] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/333.php"] [unique_id "ac0txC7NKI8IaNKZFIfLtwAAAU8"]
[Wed Apr 01 22:37:57.265042 2026] [:error] [pid 62559:tid 62573] [client 158.158.32.26:7367] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/333.php"] [unique_id "ac0txS7NKI8IaNKZFIfLvQAAAUw"]
[Wed Apr 01 22:37:57.759453 2026] [:error] [pid 62559:tid 62585] [client 158.158.32.26:7916] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/333.php"] [unique_id "ac0txS7NKI8IaNKZFIfLvgAAAVg"]
[Wed Apr 01 22:37:58.276821 2026] [:error] [pid 62559:tid 62577] [client 158.158.32.26:50392] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/333.php"] [unique_id "ac0txi7NKI8IaNKZFIfLwwAAAVA"]
[Wed Apr 01 22:37:59.028122 2026] [:error] [pid 8910:tid 8987] [client 158.158.32.26:14937] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/444.php"] [unique_id "ac0tx6JZINUcF3tYgEx4pAAAARM"]
[Wed Apr 01 22:37:59.595791 2026] [:error] [pid 62559:tid 62563] [client 158.158.32.26:7921] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/444.php"] [unique_id "ac0txy7NKI8IaNKZFIfLzwAAAUI"]
[Wed Apr 01 22:38:00.104109 2026] [:error] [pid 8995:tid 9020] [client 158.158.32.26:7935] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/444.php"] [unique_id "ac0tyOonaBjs3qxcRefkcQAAABY"]
[Wed Apr 01 22:38:00.678116 2026] [:error] [pid 62559:tid 62578] [client 158.158.32.26:65017] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/444.php"] [unique_id "ac0tyC7NKI8IaNKZFIfL1AAAAVE"]
[Wed Apr 01 22:38:01.158584 2026] [:error] [pid 8909:tid 8965] [client 158.158.32.26:64965] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file9.php"] [unique_id "ac0tyTvP_a0662gDl6D7ywAAANg"]
[Wed Apr 01 22:38:01.645591 2026] [:error] [pid 8910:tid 8991] [client 158.158.32.26:50379] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file9.php"] [unique_id "ac0tyaJZINUcF3tYgEx4qAAAARc"]
[Wed Apr 01 22:38:02.216402 2026] [:error] [pid 8910:tid 8986] [client 158.158.32.26:7223] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file9.php"] [unique_id "ac0tyqJZINUcF3tYgEx4qQAAARI"]
[Wed Apr 01 22:38:02.706397 2026] [:error] [pid 17856:tid 17866] [client 158.158.32.26:14969] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file9.php"] [unique_id "ac0tyj7Idlm5j9frhqRrjwAAAEg"]
[Wed Apr 01 22:38:03.227605 2026] [:error] [pid 8908:tid 8933] [client 158.158.32.26:14886] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filesss.php"] [unique_id "ac0ty_kmxtJXGnLdvgC1xAAAAJQ"]
[Wed Apr 01 22:38:03.723475 2026] [:error] [pid 62559:tid 62573] [client 158.158.32.26:65441] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filesss.php"] [unique_id "ac0tyy7NKI8IaNKZFIfL3QAAAUw"]
[Wed Apr 01 22:38:04.208837 2026] [:error] [pid 8908:tid 8923] [client 158.158.32.26:64964] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filesss.php"] [unique_id "ac0tzPkmxtJXGnLdvgC1yAAAAIo"]
[Wed Apr 01 22:38:04.712034 2026] [:error] [pid 8909:tid 8960] [client 158.158.32.26:7392] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filesss.php"] [unique_id "ac0tzDvP_a0662gDl6D70gAAANM"]
[Wed Apr 01 22:38:05.212362 2026] [:error] [pid 17856:tid 17872] [client 158.158.32.26:7915] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file88.php"] [unique_id "ac0tzT7Idlm5j9frhqRrmwAAAE4"]
[Wed Apr 01 22:38:05.692117 2026] [:error] [pid 62559:tid 62576] [client 158.158.32.26:7886] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file88.php"] [unique_id "ac0tzS7NKI8IaNKZFIfL4QAAAU8"]
[Wed Apr 01 22:38:06.229348 2026] [:error] [pid 62559:tid 62564] [client 158.158.32.26:14915] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file88.php"] [unique_id "ac0tzi7NKI8IaNKZFIfL5gAAAUM"]
[Wed Apr 01 22:38:06.735367 2026] [:error] [pid 62559:tid 62581] [client 158.158.32.26:7405] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file88.php"] [unique_id "ac0tzi7NKI8IaNKZFIfL6QAAAVQ"]
[Wed Apr 01 22:38:07.224935 2026] [:error] [pid 8909:tid 8963] [client 158.158.32.26:7200] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/X7x.php"] [unique_id "ac0tzzvP_a0662gDl6D72QAAANY"]
[Wed Apr 01 22:38:07.724874 2026] [:error] [pid 8909:tid 8941] [client 158.158.32.26:50380] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/X7x.php"] [unique_id "ac0tzzvP_a0662gDl6D73AAAAMA"]
[Wed Apr 01 22:38:08.228871 2026] [:error] [pid 62559:tid 62572] [client 158.158.32.26:50386] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/X7x.php"] [unique_id "ac0t0C7NKI8IaNKZFIfL7wAAAUs"]
[Wed Apr 01 22:38:08.708777 2026] [:error] [pid 8909:tid 8954] [client 158.158.32.26:50372] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/X7x.php"] [unique_id "ac0t0DvP_a0662gDl6D74QAAAM0"]
[Wed Apr 01 22:38:09.196847 2026] [:error] [pid 8909:tid 8943] [client 158.158.32.26:64977] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admir.php"] [unique_id "ac0t0TvP_a0662gDl6D75AAAAMI"]
[Wed Apr 01 22:38:09.814492 2026] [:error] [pid 8909:tid 8949] [client 158.158.32.26:50410] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admir.php"] [unique_id "ac0t0TvP_a0662gDl6D75wAAAMg"]
[Wed Apr 01 22:38:10.295657 2026] [:error] [pid 8910:tid 8982] [client 158.158.32.26:58659] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admir.php"] [unique_id "ac0t0qJZINUcF3tYgEx4wgAAAQ4"]
[Wed Apr 01 22:38:10.778003 2026] [:error] [pid 62559:tid 62575] [client 158.158.32.26:7204] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admir.php"] [unique_id "ac0t0i7NKI8IaNKZFIfL-wAAAU4"]
[Wed Apr 01 22:38:11.263918 2026] [:error] [pid 8910:tid 8980] [client 158.158.32.26:7366] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj.php"] [unique_id "ac0t06JZINUcF3tYgEx4xgAAAQw"]
[Wed Apr 01 22:38:11.746889 2026] [:error] [pid 8908:tid 8926] [client 158.158.32.26:7416] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj.php"] [unique_id "ac0t0_kmxtJXGnLdvgC14QAAAI0"]
[Wed Apr 01 22:38:12.232314 2026] [:error] [pid 62559:tid 62573] [client 158.158.32.26:7929] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj.php"] [unique_id "ac0t1C7NKI8IaNKZFIfL_gAAAUw"]
[Wed Apr 01 22:38:12.713729 2026] [:error] [pid 8908:tid 8917] [client 158.158.32.26:7933] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj.php"] [unique_id "ac0t1PkmxtJXGnLdvgC15wAAAIQ"]
[Wed Apr 01 22:38:13.205853 2026] [:error] [pid 8909:tid 8944] [client 158.158.32.26:7404] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/opts.php"] [unique_id "ac0t1TvP_a0662gDl6D77gAAAMM"]
[Wed Apr 01 22:38:13.697709 2026] [:error] [pid 8909:tid 8961] [client 158.158.32.26:50417] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/opts.php"] [unique_id "ac0t1TvP_a0662gDl6D78AAAANQ"]
[Wed Apr 01 22:38:14.211080 2026] [:error] [pid 62559:tid 62568] [client 158.158.32.26:65432] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/opts.php"] [unique_id "ac0t1i7NKI8IaNKZFIfMBwAAAUc"]
[Wed Apr 01 22:38:14.690048 2026] [:error] [pid 62559:tid 62574] [client 158.158.32.26:7220] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/opts.php"] [unique_id "ac0t1i7NKI8IaNKZFIfMCwAAAU0"]
[Wed Apr 01 22:38:15.201319 2026] [:error] [pid 8995:tid 9013] [client 158.158.32.26:50422] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filer.php"] [unique_id "ac0t1-onaBjs3qxcRefkhwAAAA8"]
[Wed Apr 01 22:38:15.697231 2026] [:error] [pid 8995:tid 9020] [client 158.158.32.26:7412] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filer.php"] [unique_id "ac0t1-onaBjs3qxcRefkiAAAABY"]
[Wed Apr 01 22:38:16.204960 2026] [:error] [pid 8995:tid 9003] [client 158.158.32.26:65438] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filer.php"] [unique_id "ac0t2OonaBjs3qxcRefkigAAAAU"]
[Wed Apr 01 22:38:16.687400 2026] [:error] [pid 8910:tid 8982] [client 158.158.32.26:50371] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filer.php"] [unique_id "ac0t2KJZINUcF3tYgEx4zQAAAQ4"]
[Wed Apr 01 22:38:17.166652 2026] [:error] [pid 8908:tid 8916] [client 158.158.32.26:65443] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lites.php"] [unique_id "ac0t2fkmxtJXGnLdvgC19wAAAIM"]
[Wed Apr 01 22:38:17.657159 2026] [:error] [pid 17856:tid 17872] [client 158.158.32.26:8015] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lites.php"] [unique_id "ac0t2T7Idlm5j9frhqRrswAAAE4"]
[Wed Apr 01 22:38:18.163096 2026] [:error] [pid 8910:tid 8974] [client 158.158.32.26:65414] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lites.php"] [unique_id "ac0t2qJZINUcF3tYgEx40AAAAQY"]
[Wed Apr 01 22:38:18.655327 2026] [:error] [pid 17856:tid 17878] [client 158.158.32.26:65008] [client 158.158.32.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lites.php"] [unique_id "ac0t2j7Idlm5j9frhqRruAAAAFQ"]
[Wed Apr 01 22:38:19.139561 2026] [:error] [pid 17856:tid 17868] [client 158.158.32.26:7183] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Apr 01 22:38:19.383664 2026] [:error] [pid 17856:tid 17875] [client 158.158.32.26:7183] File does not exist: /usr/local/apache/htdocs/suspended-page/he.php
[Wed Apr 01 22:38:19.625945 2026] [:error] [pid 17856:tid 17880] [client 158.158.32.26:7183] File does not exist: /usr/local/apache/htdocs/suspended-page/aves.php
[Wed Apr 01 22:38:19.869156 2026] [:error] [pid 17856:tid 17870] [client 158.158.32.26:7183] File does not exist: /usr/local/apache/htdocs/suspended-page/gorila.php
[Wed Apr 01 22:38:20.111794 2026] [:error] [pid 17856:tid 17861] [client 158.158.32.26:7183] File does not exist: /usr/local/apache/htdocs/suspended-page/vanta.php
[Wed Apr 01 22:38:20.354636 2026] [:error] [pid 17856:tid 17877] [client 158.158.32.26:7183] File does not exist: /usr/local/apache/htdocs/suspended-page/sh3ll.php
[Wed Apr 01 22:38:20.604443 2026] [:error] [pid 17856:tid 17873] [client 158.158.32.26:7183] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Sat Apr 04 04:02:03.856550 2026] [:error] [pid 2459:tid 2532] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Apr 04 04:02:04.120255 2026] [:error] [pid 2459:tid 2544] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sat Apr 04 04:02:04.385530 2026] [:error] [pid 2459:tid 2547] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/taff.php
[Sat Apr 04 04:02:04.652065 2026] [:error] [pid 2459:tid 2539] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Sat Apr 04 04:02:04.921738 2026] [:error] [pid 2459:tid 2554] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sat Apr 04 04:02:05.190797 2026] [:error] [pid 2459:tid 2538] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sat Apr 04 04:02:05.457810 2026] [:error] [pid 2459:tid 2534] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sat Apr 04 04:02:05.723569 2026] [:error] [pid 2459:tid 2556] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/xxc.php
[Sat Apr 04 04:02:05.989870 2026] [:error] [pid 2459:tid 2543] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Sat Apr 04 04:02:06.255481 2026] [:error] [pid 2459:tid 2541] [client 20.91.195.29:47700] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sat Apr 04 04:02:06.517138 2026] [:error] [pid 2459:tid 2539] [client 20.91.195.29:47700] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55l453.php"] [unique_id "adAcvgefyCmu4LR_PlpBNgAAAIc"]
[Sat Apr 04 04:02:07.042878 2026] [:error] [pid 2459:tid 2536] [client 20.91.195.29:6667] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55l453.php"] [unique_id "adAcvwefyCmu4LR_PlpBNwAAAIU"]
[Sat Apr 04 04:02:07.567338 2026] [:error] [pid 2459:tid 2554] [client 20.91.195.29:42167] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55l453.php"] [unique_id "adAcvwefyCmu4LR_PlpBOgAAAJY"]
[Sat Apr 04 04:02:08.092764 2026] [:error] [pid 2567:tid 2579] [client 20.91.195.29:51580] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/55l453.php"] [unique_id "adAcwGJJmfRsTrAKjdQOqgAAAMU"]
[Sat Apr 04 04:02:08.620130 2026] [:error] [pid 2459:tid 2555] [client 20.91.195.29:38991] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xx.php"] [unique_id "adAcwAefyCmu4LR_PlpBPwAAAJc"]
[Sat Apr 04 04:02:09.145606 2026] [:error] [pid 2459:tid 2545] [client 20.91.195.29:35473] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xx.php"] [unique_id "adAcwQefyCmu4LR_PlpBQgAAAI0"]
[Sat Apr 04 04:02:09.669400 2026] [:error] [pid 2459:tid 2533] [client 20.91.195.29:42156] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xx.php"] [unique_id "adAcwQefyCmu4LR_PlpBRgAAAII"]
[Sat Apr 04 04:02:10.192802 2026] [:error] [pid 2458:tid 2525] [client 20.91.195.29:47704] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xx.php"] [unique_id "adAcwiNozic5SuWqclm6RwAAAFU"]
[Sat Apr 04 04:02:10.717916 2026] [:error] [pid 2458:tid 2519] [client 20.91.195.29:52210] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bkyac.php"] [unique_id "adAcwiNozic5SuWqclm6SQAAAE8"]
[Sat Apr 04 04:02:11.248002 2026] [:error] [pid 2459:tid 2533] [client 20.91.195.29:47703] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bkyac.php"] [unique_id "adAcwwefyCmu4LR_PlpBTQAAAII"]
[Sat Apr 04 04:02:11.772890 2026] [:error] [pid 2458:tid 2511] [client 20.91.195.29:42112] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bkyac.php"] [unique_id "adAcwyNozic5SuWqclm6TgAAAEc"]
[Sat Apr 04 04:02:12.296557 2026] [:error] [pid 2567:tid 2597] [client 20.91.195.29:35502] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bkyac.php"] [unique_id "adAcxGJJmfRsTrAKjdQOtgAAANc"]
[Sat Apr 04 04:02:12.821028 2026] [:error] [pid 2459:tid 2546] [client 20.91.195.29:39002] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "adAcxAefyCmu4LR_PlpBVQAAAI4"]
[Sat Apr 04 04:02:13.347144 2026] [:error] [pid 2567:tid 2580] [client 20.91.195.29:42114] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "adAcxWJJmfRsTrAKjdQOugAAAMY"]
[Sat Apr 04 04:02:13.872129 2026] [:error] [pid 2459:tid 2545] [client 20.91.195.29:11611] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "adAcxQefyCmu4LR_PlpBVgAAAI0"]
[Sat Apr 04 04:02:14.398673 2026] [:error] [pid 2567:tid 2596] [client 20.91.195.29:52193] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "adAcxmJJmfRsTrAKjdQOwAAAANY"]
[Sat Apr 04 04:02:14.926806 2026] [:error] [pid 2457:tid 2484] [client 20.91.195.29:60497] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "adAcxkmNHppaMd92Zpc3pwAAAAc"]
[Sat Apr 04 04:02:15.452628 2026] [:error] [pid 2457:tid 2488] [client 20.91.195.29:52162] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "adAcx0mNHppaMd92Zpc3qwAAAAs"]
[Sat Apr 04 04:02:15.984402 2026] [:error] [pid 2457:tid 2478] [client 20.91.195.29:52160] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "adAcx0mNHppaMd92Zpc3rgAAAAE"]
[Sat Apr 04 04:02:16.513701 2026] [:error] [pid 2459:tid 2553] [client 20.91.195.29:51536] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "adAcyAefyCmu4LR_PlpBXAAAAJU"]
[Sat Apr 04 04:02:17.040279 2026] [:error] [pid 2457:tid 2489] [client 20.91.195.29:52169] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/HLA-dd.php"] [unique_id "adAcyUmNHppaMd92Zpc3sgAAAAw"]
[Sat Apr 04 04:02:17.567186 2026] [:error] [pid 2459:tid 2547] [client 20.91.195.29:52166] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/HLA-dd.php"] [unique_id "adAcyQefyCmu4LR_PlpBYAAAAI8"]
[Sat Apr 04 04:02:18.094993 2026] [:error] [pid 2567:tid 2582] [client 20.91.195.29:51567] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/HLA-dd.php"] [unique_id "adAcymJJmfRsTrAKjdQOxwAAAMg"]
[Sat Apr 04 04:02:18.620012 2026] [:error] [pid 2458:tid 2517] [client 20.91.195.29:52183] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/HLA-dd.php"] [unique_id "adAcyiNozic5SuWqclm6XgAAAE0"]
[Sat Apr 04 04:02:19.143471 2026] [:error] [pid 2567:tid 2590] [client 20.91.195.29:42175] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsc.php"] [unique_id "adAcy2JJmfRsTrAKjdQOzAAAANA"]
[Sat Apr 04 04:02:19.669548 2026] [:error] [pid 2567:tid 2587] [client 20.91.195.29:60437] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsc.php"] [unique_id "adAcy2JJmfRsTrAKjdQO0QAAAM0"]
[Sat Apr 04 04:02:20.195727 2026] [:error] [pid 2567:tid 2597] [client 20.91.195.29:39034] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsc.php"] [unique_id "adAczGJJmfRsTrAKjdQO1AAAANc"]
[Sat Apr 04 04:02:20.720601 2026] [:error] [pid 2458:tid 2509] [client 20.91.195.29:42121] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wsc.php"] [unique_id "adAczCNozic5SuWqclm6YgAAAEU"]
[Sat Apr 04 04:02:21.245870 2026] [:error] [pid 2457:tid 2486] [client 20.91.195.29:11615] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-lvminl.php"] [unique_id "adAczUmNHppaMd92Zpc3uQAAAAk"]
[Sat Apr 04 04:02:21.769060 2026] [:error] [pid 2567:tid 2596] [client 20.91.195.29:39020] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-lvminl.php"] [unique_id "adAczWJJmfRsTrAKjdQO2QAAANY"]
[Sat Apr 04 04:02:22.296558 2026] [:error] [pid 2457:tid 2487] [client 20.91.195.29:11646] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-lvminl.php"] [unique_id "adAczkmNHppaMd92Zpc3ugAAAAo"]
[Sat Apr 04 04:02:22.823296 2026] [:error] [pid 2457:tid 2494] [client 20.91.195.29:35516] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-lvminl.php"] [unique_id "adAczkmNHppaMd92Zpc3vgAAABE"]
[Sat Apr 04 04:02:23.350655 2026] [:error] [pid 2457:tid 2480] [client 20.91.195.29:35487] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "adAcz0mNHppaMd92Zpc3wQAAAAM"]
[Sat Apr 04 04:02:23.876016 2026] [:error] [pid 2457:tid 2486] [client 20.91.195.29:11617] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "adAcz0mNHppaMd92Zpc3wwAAAAk"]
[Sat Apr 04 04:02:24.401032 2026] [:error] [pid 2459:tid 2535] [client 20.91.195.29:38982] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "adAc0AefyCmu4LR_PlpBaQAAAIQ"]
[Sat Apr 04 04:02:24.925725 2026] [:error] [pid 2458:tid 2520] [client 20.91.195.29:47686] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "adAc0CNozic5SuWqclm6ZwAAAFA"]
[Sat Apr 04 04:02:25.452515 2026] [:error] [pid 2459:tid 2536] [client 20.91.195.29:42116] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dczem.php"] [unique_id "adAc0QefyCmu4LR_PlpBcAAAAIU"]
[Sat Apr 04 04:02:25.980755 2026] [:error] [pid 2567:tid 2577] [client 20.91.195.29:51543] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dczem.php"] [unique_id "adAc0WJJmfRsTrAKjdQO4QAAAMM"]
[Sat Apr 04 04:02:26.508603 2026] [:error] [pid 2567:tid 2585] [client 20.91.195.29:35460] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dczem.php"] [unique_id "adAc0mJJmfRsTrAKjdQO4wAAAMs"]
[Sat Apr 04 04:02:27.035336 2026] [:error] [pid 2459:tid 2545] [client 20.91.195.29:51573] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dczem.php"] [unique_id "adAc0wefyCmu4LR_PlpBdwAAAI0"]
[Sat Apr 04 04:02:27.565682 2026] [:error] [pid 2457:tid 2489] [client 20.91.195.29:52199] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albrt.php"] [unique_id "adAc00mNHppaMd92Zpc3xwAAAAw"]
[Sat Apr 04 04:02:28.095955 2026] [:error] [pid 2567:tid 2587] [client 20.91.195.29:52219] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albrt.php"] [unique_id "adAc1GJJmfRsTrAKjdQO6AAAAM0"]
[Sat Apr 04 04:02:28.620829 2026] [:error] [pid 2567:tid 2585] [client 20.91.195.29:39018] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albrt.php"] [unique_id "adAc1GJJmfRsTrAKjdQO6wAAAMs"]
[Sat Apr 04 04:02:29.147454 2026] [:error] [pid 2459:tid 2555] [client 20.91.195.29:38977] [client 20.91.195.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albrt.php"] [unique_id "adAc1QefyCmu4LR_PlpBeQAAAJc"]
[Sat Apr 04 11:49:29.003299 2026] [:error] [pid 2567:tid 2592] [client 45.89.60.68:57777] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php, referer: www.google.com
[Sat Apr 04 11:49:30.036421 2026] [:error] [pid 2457:tid 2479] [client 45.89.60.68:58962] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php, referer: www.google.com
[Sun Apr 05 08:44:00.980189 2026] [:error] [pid 45303:tid 45321] [client 94.26.106.219:44728] [client 94.26.106.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.219, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "adGwULboQ9eViZ4hdnm6UwAAAAQ"]
[Sun Apr 05 08:44:00.983750 2026] [:error] [pid 45303:tid 45321] [client 94.26.106.219:44728] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Apr 06 19:28:09.824886 2026] [:error] [pid 9442:tid 9468] [client 62.197.144.100:43174] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Mon Apr 06 19:28:10.241943 2026] [:error] [pid 9442:tid 9459] [client 62.197.144.100:43174] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Mon Apr 06 19:28:10.655653 2026] [:error] [pid 9442:tid 9447] [client 62.197.144.100:43174] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Mon Apr 06 19:28:11.070534 2026] [:error] [pid 9442:tid 9448] [client 62.197.144.100:43174] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Apr 06 19:28:11.486585 2026] [:error] [pid 9442:tid 9444] [client 62.197.144.100:43174] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Apr 06 19:28:11.900562 2026] [:error] [pid 9442:tid 9457] [client 62.197.144.100:43174] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Apr 06 19:28:12.314622 2026] [:error] [pid 9442:tid 9455] [client 62.197.144.100:43174] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "adOYzEPsNnAJTnmz6sak4wAAAQs"]
[Mon Apr 06 19:28:13.137560 2026] [:error] [pid 10280:tid 10287] [client 62.197.144.100:43182] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "adOYzV8QUJkf8g-BFfPfcQAAAcQ"]
[Mon Apr 06 19:28:13.963304 2026] [:error] [pid 35688:tid 35751] [client 62.197.144.100:43192] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "adOYzeZ85qg4jLsRpQyMgwAAAIE"]
[Mon Apr 06 19:28:14.809905 2026] [:error] [pid 9442:tid 9459] [client 62.197.144.100:43202] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "adOYzkPsNnAJTnmz6sak9QAAAQ8"]
[Mon Apr 06 19:28:15.641614 2026] [:error] [pid 35688:tid 35757] [client 62.197.144.100:53880] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "adOYz-Z85qg4jLsRpQyMjgAAAIc"]
[Mon Apr 06 19:28:18.532870 2026] [:error] [pid 9442:tid 9446] [client 62.197.144.100:53894] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adOY0kPsNnAJTnmz6salGQAAAQI"]
[Mon Apr 06 19:28:19.351710 2026] [:error] [pid 35687:tid 35740] [client 62.197.144.100:53956] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adOY053LtDozV0i8Bitg2gAAAFE"]
[Mon Apr 06 19:28:20.175533 2026] [:error] [pid 9442:tid 9466] [client 62.197.144.100:53982] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adOY1EPsNnAJTnmz6salHgAAARY"]
[Mon Apr 06 19:28:20.990356 2026] [:error] [pid 9442:tid 9446] [client 62.197.144.100:53988] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adOY1EPsNnAJTnmz6salJwAAAQI"]
[Mon Apr 06 19:28:21.821352 2026] [:error] [pid 9442:tid 9451] [client 62.197.144.100:54008] [client 62.197.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adOY1UPsNnAJTnmz6salMgAAAQc"]
[Tue Apr 07 05:28:30.142632 2026] [:error] [pid 12948:tid 12958] [client 216.81.248.197:55200] [client 216.81.248.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "adQlfsbeSPAN8LvMqsb4ZgAAAQc"]
[Tue Apr 07 09:21:53.169984 2026] [:error] [pid 37719:tid 37738] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Apr 07 09:21:54.357088 2026] [:error] [pid 37719:tid 37738] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 07 09:21:54.616687 2026] [:error] [pid 37719:tid 37744] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Apr 07 09:21:54.876855 2026] [:error] [pid 37719:tid 37733] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Apr 07 09:21:55.137924 2026] [:error] [pid 37719:tid 37740] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Apr 07 09:21:55.398557 2026] [:error] [pid 37719:tid 37743] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 07 09:21:55.657646 2026] [:error] [pid 37719:tid 37745] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 07 09:21:55.918773 2026] [:error] [pid 37719:tid 37732] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 07 09:21:56.178481 2026] [:error] [pid 37719:tid 37725] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Apr 07 09:21:56.699304 2026] [:error] [pid 37719:tid 37723] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Apr 07 09:21:56.959430 2026] [:error] [pid 37719:tid 37726] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 07 09:21:57.219355 2026] [:error] [pid 37719:tid 37729] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 07 09:21:57.479066 2026] [:error] [pid 37719:tid 37737] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 07 09:21:57.738389 2026] [:error] [pid 37719:tid 37724] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 07 09:21:58.004532 2026] [:error] [pid 37719:tid 37744] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Apr 07 09:21:58.262999 2026] [:error] [pid 37719:tid 37730] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Apr 07 09:21:58.523251 2026] [:error] [pid 37719:tid 37745] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 07 09:21:58.782609 2026] [:error] [pid 37719:tid 37732] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 07 09:21:59.043147 2026] [:error] [pid 37719:tid 37734] [client 185.44.77.45:52828] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 07 09:22:02.709956 2026] [:error] [pid 37719:tid 37739] [client 185.44.77.45:52828] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adRcOk09Xv52u2xXGLCykwAAANE"]
[Tue Apr 07 09:22:04.004370 2026] [:error] [pid 12948:tid 12956] [client 185.44.77.45:49332] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adRcPMbeSPAN8LvMqsbgPwAAAQU"]
[Tue Apr 07 09:22:05.306028 2026] [:error] [pid 37597:tid 37634] [client 185.44.77.45:49336] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 07 09:22:06.083833 2026] [:error] [pid 37597:tid 37638] [client 185.44.77.45:49336] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adRcPg6uAY0QAy-8EEKciQAAAEQ"]
[Tue Apr 07 09:22:07.128932 2026] [:error] [pid 37597:tid 37646] [client 185.44.77.45:49348] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Apr 07 09:22:07.387418 2026] [:error] [pid 37597:tid 37657] [client 185.44.77.45:49348] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adRcPw6uAY0QAy-8EEKckQAAAFc"]
[Tue Apr 07 09:22:08.165904 2026] [:error] [pid 12948:tid 12956] [client 185.44.77.45:49364] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Apr 07 09:22:11.510566 2026] [:error] [pid 12948:tid 12971] [client 185.44.77.45:49364] [client 185.44.77.45] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "207.127.94.142_e5dea702f0b1ea6d3f20473cba7d04ac8ef31dfc"): Internal error (specific information not available) [hostname "windfc.windfarmcoolants.com.au"] [uri "/index.html"] [unique_id "adRcQMbeSPAN8LvMqsbgcAAAARQ"]
[Tue Apr 07 09:22:12.289815 2026] [:error] [pid 12948:tid 12975] [client 185.44.77.45:49364] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adRcRMbeSPAN8LvMqsbhBAAAARg"]
[Tue Apr 07 09:22:13.067401 2026] [:error] [pid 37719:tid 37740] [client 185.44.77.45:59178] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adRcRU09Xv52u2xXGLCysgAAANI"]
[Tue Apr 07 09:22:13.577815 2026] [:error] [pid 37719:tid 37741] [client 185.44.77.45:59192] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adRcRU09Xv52u2xXGLCyswAAANM"]
[Tue Apr 07 09:22:14.098170 2026] [:error] [pid 12948:tid 12956] [client 185.44.77.45:59200] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adRcRsbeSPAN8LvMqsbhJwAAAQU"]
[Tue Apr 07 09:22:14.618664 2026] [:error] [pid 12948:tid 12971] [client 185.44.77.45:59214] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adRcRsbeSPAN8LvMqsbhLwAAARQ"]
[Tue Apr 07 09:22:15.130332 2026] [:error] [pid 12948:tid 12962] [client 185.44.77.45:59216] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adRcR8beSPAN8LvMqsbhNgAAAQs"]
[Tue Apr 07 09:22:15.909940 2026] [:error] [pid 12948:tid 12975] [client 185.44.77.45:59226] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adRcR8beSPAN8LvMqsbhOwAAARg"]
[Tue Apr 07 09:22:16.430510 2026] [:error] [pid 12948:tid 12962] [client 185.44.77.45:59242] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue Apr 07 09:22:16.951426 2026] [:error] [pid 12948:tid 12963] [client 185.44.77.45:59242] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "adRcSMbeSPAN8LvMqsbhQwAAAQw"]
[Tue Apr 07 09:22:17.979641 2026] [:error] [pid 37719:tid 37735] [client 185.44.77.45:59254] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adRcSU09Xv52u2xXGLCyvQAAAM0"]
[Tue Apr 07 09:22:18.750465 2026] [:error] [pid 37597:tid 37636] [client 185.44.77.45:59256] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adRcSg6uAY0QAy-8EEKcpQAAAEI"]
[Tue Apr 07 09:22:19.266148 2026] [:error] [pid 12948:tid 12951] [client 185.44.77.45:59258] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Apr 07 09:22:20.582899 2026] [:error] [pid 12948:tid 12951] [client 185.44.77.45:59258] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adRcTMbeSPAN8LvMqsbhXAAAAQA"]
[Tue Apr 07 09:22:21.105193 2026] [:error] [pid 12948:tid 12970] [client 185.44.77.45:59266] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 07 09:22:23.029311 2026] [:error] [pid 12948:tid 12959] [client 185.44.77.45:59266] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 07 09:22:23.805120 2026] [:error] [pid 12948:tid 12959] [client 185.44.77.45:59266] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adRcT8beSPAN8LvMqsbhlAAAAQg"]
[Tue Apr 07 09:22:24.324296 2026] [:error] [pid 37719:tid 37725] [client 185.44.77.45:55554] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Apr 07 09:22:24.583208 2026] [:error] [pid 37719:tid 37739] [client 185.44.77.45:55554] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adRcUE09Xv52u2xXGLCyyQAAANE"]
[Tue Apr 07 09:22:25.118597 2026] [:error] [pid 12948:tid 12969] [client 185.44.77.45:55556] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Apr 07 09:22:25.638387 2026] [:error] [pid 12948:tid 12954] [client 185.44.77.45:55556] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adRcUcbeSPAN8LvMqsbhuQAAAQM"]
[Tue Apr 07 09:22:26.414865 2026] [:error] [pid 37719:tid 37740] [client 185.44.77.45:55570] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adRcUk09Xv52u2xXGLCy0AAAANI"]
[Tue Apr 07 09:22:27.187008 2026] [:error] [pid 37596:tid 37617] [client 185.44.77.45:35302] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Tue Apr 07 09:22:27.445100 2026] [:error] [pid 37596:tid 37629] [client 185.44.77.45:35302] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Apr 07 09:22:27.964985 2026] [:error] [pid 37596:tid 37627] [client 185.44.77.45:35302] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adRcU6paAOZHEjRWjP06IAAAABU"]
[Tue Apr 07 09:22:28.748222 2026] [:error] [pid 12948:tid 12969] [client 185.44.77.45:6993] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adRcVMbeSPAN8LvMqsbhywAAARI"]
[Tue Apr 07 09:22:29.526292 2026] [:error] [pid 37597:tid 37641] [client 185.44.77.45:55590] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adRcVQ6uAY0QAy-8EEKcsAAAAEc"]
[Tue Apr 07 09:22:30.035002 2026] [:error] [pid 12948:tid 12963] [client 185.44.77.45:55602] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adRcVsbeSPAN8LvMqsbhzwAAAQw"]
[Tue Apr 07 09:22:30.543598 2026] [:error] [pid 37597:tid 37658] [client 185.44.77.45:55610] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adRcVg6uAY0QAy-8EEKcswAAAFg"]
[Tue Apr 07 09:22:31.582819 2026] [:error] [pid 37719:tid 37737] [client 185.44.77.45:55622] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Apr 07 09:22:31.840143 2026] [:error] [pid 37719:tid 37724] [client 185.44.77.45:55622] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adRcV009Xv52u2xXGLCy3wAAAMI"]
[Tue Apr 07 09:22:32.351512 2026] [:error] [pid 12948:tid 12953] [client 185.44.77.45:55632] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adRcWMbeSPAN8LvMqsbh2AAAAQI"]
[Tue Apr 07 09:22:32.861428 2026] [:error] [pid 37598:tid 37670] [client 185.44.77.45:51294] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adRcWO9g7q_cV2WhPazj9QAAAIk"]
[Tue Apr 07 09:22:33.898322 2026] [:error] [pid 37598:tid 37681] [client 185.44.77.45:51308] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Apr 07 09:22:34.422289 2026] [:error] [pid 37598:tid 37685] [client 185.44.77.45:51308] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Apr 07 09:22:35.471398 2026] [:error] [pid 37598:tid 37666] [client 185.44.77.45:51308] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adRcW-9g7q_cV2WhPazkBgAAAIU"]
[Tue Apr 07 09:22:36.760003 2026] [:error] [pid 12948:tid 12961] [client 185.44.77.45:51324] [client 185.44.77.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.44.77.45, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adRcXMbeSPAN8LvMqsbh7AAAAQo"]
[Tue Apr 07 09:22:37.021483 2026] [:error] [pid 12948:tid 12966] [client 185.44.77.45:51324] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Apr 07 09:22:38.314000 2026] [:error] [pid 12948:tid 12951] [client 185.44.77.45:51324] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Apr 07 09:22:38.572752 2026] [:error] [pid 12948:tid 12969] [client 185.44.77.45:51324] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Apr 07 09:22:39.861335 2026] [:error] [pid 12948:tid 12965] [client 185.44.77.45:51324] [client 185.44.77.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adRcX8beSPAN8LvMqsbiAAAAAQ4"]
[Tue Apr 07 09:22:40.637059 2026] [:error] [pid 37719:tid 37739] [client 185.44.77.45:51326] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Apr 07 09:22:40.897033 2026] [:error] [pid 37719:tid 37725] [client 185.44.77.45:51326] [client 185.44.77.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.44.77.45, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adRcYE09Xv52u2xXGLCzAAAAAMM"]
[Tue Apr 07 09:22:46.708933 2026] [:error] [pid 37598:tid 37664] [client 138.199.29.151:11419] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "adRcZu9g7q_cV2WhPazkDQAAAIM"]
[Tue Apr 07 09:22:48.415954 2026] [:error] [pid 37598:tid 37682] [client 138.199.29.151:46854] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 07 09:22:48.986809 2026] [:error] [pid 37598:tid 37685] [client 138.199.29.151:46854] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Tue Apr 07 09:22:50.820904 2026] [:error] [pid 37598:tid 37664] [client 138.199.29.151:46854] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adRcau9g7q_cV2WhPazkIQAAAIM"]
[Tue Apr 07 09:22:51.377506 2026] [:error] [pid 37598:tid 37680] [client 138.199.29.151:46858] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 07 09:22:52.218773 2026] [:error] [pid 37598:tid 37683] [client 138.199.29.151:46858] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Tue Apr 07 09:22:52.787508 2026] [:error] [pid 37598:tid 37674] [client 138.199.29.151:46858] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Tue Apr 07 09:22:53.354171 2026] [:error] [pid 37598:tid 37680] [client 138.199.29.151:46858] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Apr 07 09:22:53.645197 2026] [:error] [pid 37598:tid 37666] [client 138.199.29.151:46858] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adRcbe9g7q_cV2WhPazkLwAAAIU"]
[Tue Apr 07 09:22:54.212986 2026] [:error] [pid 37597:tid 37639] [client 138.199.29.151:58970] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Tue Apr 07 09:22:54.496762 2026] [:error] [pid 37597:tid 37646] [client 138.199.29.151:58970] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Apr 07 09:22:54.775173 2026] [:error] [pid 37597:tid 37643] [client 138.199.29.151:58970] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adRcbg6uAY0QAy-8EEKc4AAAAEk"]
[Tue Apr 07 09:22:55.624094 2026] [:error] [pid 37598:tid 37684] [client 138.199.29.151:58980] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Apr 07 09:22:56.197354 2026] [:error] [pid 37598:tid 37661] [client 138.199.29.151:58980] [client 138.199.29.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.151, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adRccO9g7q_cV2WhPazkNAAAAIA"]
[Tue Apr 07 09:22:56.485125 2026] [:error] [pid 37598:tid 37679] [client 138.199.29.151:58980] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adRccO9g7q_cV2WhPazkNgAAAJI"]
[Tue Apr 07 09:23:01.293459 2026] [:error] [pid 37598:tid 37681] [client 138.199.29.151:58992] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Tue Apr 07 09:23:03.114522 2026] [:error] [pid 37598:tid 37671] [client 138.199.29.151:58992] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Apr 07 09:23:03.392610 2026] [:error] [pid 37598:tid 37685] [client 138.199.29.151:58992] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adRcd-9g7q_cV2WhPazkTQAAAJg"]
[Tue Apr 07 09:23:03.972103 2026] [:error] [pid 37719:tid 37746] [client 138.199.29.151:55724] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Apr 07 09:23:04.847932 2026] [:error] [pid 37719:tid 37737] [client 138.199.29.151:55724] [client 138.199.29.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.151, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adRceE09Xv52u2xXGLCzJgAAAM8"]
[Tue Apr 07 09:23:05.149631 2026] [:error] [pid 37719:tid 37732] [client 138.199.29.151:55724] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue Apr 07 09:23:05.442025 2026] [:error] [pid 37719:tid 37738] [client 138.199.29.151:55724] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue Apr 07 09:23:05.736128 2026] [:error] [pid 37719:tid 37742] [client 138.199.29.151:55724] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Tue Apr 07 09:23:07.331393 2026] [:error] [pid 37719:tid 37742] [client 138.199.29.151:55724] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adRce009Xv52u2xXGLCzLgAAANQ"]
[Tue Apr 07 09:23:07.890143 2026] [:error] [pid 37597:tid 37638] [client 138.199.29.151:55726] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Apr 07 09:23:08.170184 2026] [:error] [pid 37597:tid 37647] [client 138.199.29.151:55726] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adRcfA6uAY0QAy-8EEKc8gAAAE0"]
[Tue Apr 07 09:23:09.014106 2026] [:error] [pid 37598:tid 37680] [client 138.199.29.151:64332] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Apr 07 09:23:09.293847 2026] [:error] [pid 37598:tid 37665] [client 138.199.29.151:64332] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adRcfe9g7q_cV2WhPazkXgAAAIQ"]
[Tue Apr 07 09:23:10.457489 2026] [:error] [pid 37598:tid 37667] [client 138.199.29.151:55744] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue Apr 07 09:23:10.747372 2026] [:error] [pid 37598:tid 37674] [client 138.199.29.151:55744] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adRcfu9g7q_cV2WhPazkaQAAAI0"]
[Tue Apr 07 09:23:11.326719 2026] [:error] [pid 12948:tid 12966] [client 138.199.29.151:55748] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adRcf8beSPAN8LvMqsbibAAAAQ8"]
[Tue Apr 07 09:23:11.888844 2026] [:error] [pid 12948:tid 12959] [client 138.199.29.151:55754] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Tue Apr 07 09:23:12.171758 2026] [:error] [pid 12948:tid 12963] [client 138.199.29.151:55754] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Tue Apr 07 09:23:13.299672 2026] [:error] [pid 12948:tid 12957] [client 138.199.29.151:55754] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adRcgcbeSPAN8LvMqsbidQAAAQY"]
[Tue Apr 07 09:23:14.129954 2026] [:error] [pid 12948:tid 12968] [client 138.199.29.151:38882] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adRcgsbeSPAN8LvMqsbifgAAARE"]
[Tue Apr 07 09:23:15.531470 2026] [:error] [pid 37719:tid 37731] [client 138.199.29.151:38898] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adRcg009Xv52u2xXGLCzOQAAAMk"]
[Tue Apr 07 09:23:16.087877 2026] [:error] [pid 37598:tid 37673] [client 138.199.29.151:38908] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue Apr 07 09:23:16.646379 2026] [:error] [pid 37598:tid 37676] [client 138.199.29.151:38908] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Apr 07 09:23:16.922106 2026] [:error] [pid 37598:tid 37675] [client 138.199.29.151:38908] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adRchO9g7q_cV2WhPazkdwAAAI4"]
[Tue Apr 07 09:23:17.501197 2026] [:error] [pid 12948:tid 12964] [client 138.199.29.151:38912] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Apr 07 09:23:18.086736 2026] [:error] [pid 12948:tid 12963] [client 138.199.29.151:38912] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "adRchsbeSPAN8LvMqsbiiAAAAQw"]
[Tue Apr 07 09:23:19.489553 2026] [:error] [pid 37597:tid 37634] [client 138.199.29.151:38924] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adRchw6uAY0QAy-8EEKdBwAAAEA"]
[Tue Apr 07 09:23:20.456681 2026] [:error] [pid 37598:tid 37681] [client 138.199.29.151:38930] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 07 09:23:21.340541 2026] [:error] [pid 37598:tid 37685] [client 138.199.29.151:38930] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue Apr 07 09:23:21.903747 2026] [:error] [pid 37598:tid 37682] [client 138.199.29.151:38930] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 07 09:23:22.178816 2026] [:error] [pid 37598:tid 37670] [client 138.199.29.151:38930] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adRciu9g7q_cV2WhPazkhAAAAIk"]
[Tue Apr 07 09:23:22.736175 2026] [:error] [pid 37719:tid 37744] [client 138.199.29.151:49222] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adRcik09Xv52u2xXGLCzSgAAANY"]
[Tue Apr 07 09:23:23.299152 2026] [:error] [pid 12948:tid 12959] [client 138.199.29.151:8944] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adRci8beSPAN8LvMqsbilwAAAQg"]
[Tue Apr 07 09:23:23.872926 2026] [:error] [pid 37719:tid 37738] [client 138.199.29.151:49252] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adRci009Xv52u2xXGLCzTgAAANA"]
[Tue Apr 07 09:23:24.424066 2026] [:error] [pid 37719:tid 37739] [client 138.199.29.151:49254] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Tue Apr 07 09:23:24.698737 2026] [:error] [pid 37719:tid 37728] [client 138.199.29.151:49254] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adRcjE09Xv52u2xXGLCzVQAAAMY"]
[Tue Apr 07 09:23:25.257443 2026] [:error] [pid 12948:tid 12965] [client 138.199.29.151:49264] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adRcjcbeSPAN8LvMqsbinAAAAQ4"]
[Tue Apr 07 09:23:25.835446 2026] [:error] [pid 12948:tid 12960] [client 138.199.29.151:49280] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 07 09:23:26.412301 2026] [:error] [pid 12948:tid 12969] [client 138.199.29.151:49280] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adRcjsbeSPAN8LvMqsbinwAAARI"]
[Tue Apr 07 09:23:26.970708 2026] [:error] [pid 37719:tid 37736] [client 138.199.29.151:49296] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adRcjk09Xv52u2xXGLCzYQAAAM4"]
[Tue Apr 07 09:23:27.533864 2026] [:error] [pid 37598:tid 37666] [client 138.199.29.151:49298] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adRcj-9g7q_cV2WhPazkhwAAAIU"]
[Tue Apr 07 09:23:28.088876 2026] [:error] [pid 37596:tid 37625] [client 138.199.29.151:49310] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adRckKpaAOZHEjRWjP06eAAAABM"]
[Tue Apr 07 09:23:28.924909 2026] [:error] [pid 37596:tid 37615] [client 138.199.29.151:49322] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adRckKpaAOZHEjRWjP06fAAAAAk"]
[Tue Apr 07 09:23:30.036230 2026] [:error] [pid 12948:tid 12968] [client 138.199.29.151:49324] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adRcksbeSPAN8LvMqsbipAAAARE"]
[Tue Apr 07 09:23:32.272593 2026] [:error] [pid 12948:tid 12971] [client 138.199.29.151:49326] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Tue Apr 07 09:23:33.118935 2026] [:error] [pid 12948:tid 12961] [client 138.199.29.151:49326] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Tue Apr 07 09:23:33.397762 2026] [:error] [pid 12948:tid 12968] [client 138.199.29.151:49326] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adRclcbeSPAN8LvMqsbiuQAAARE"]
[Tue Apr 07 09:23:34.265387 2026] [:error] [pid 37719:tid 37727] [client 138.199.29.151:45408] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Apr 07 09:23:34.555929 2026] [:error] [pid 37719:tid 37726] [client 138.199.29.151:45408] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Apr 07 09:23:36.009825 2026] [:error] [pid 37719:tid 37737] [client 138.199.29.151:45408] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adRcmE09Xv52u2xXGLCzeQAAAM8"]
[Tue Apr 07 09:23:37.432878 2026] [:error] [pid 12948:tid 12964] [client 138.199.29.151:45412] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adRcmcbeSPAN8LvMqsbiwAAAAQ0"]
[Tue Apr 07 09:23:38.016592 2026] [:error] [pid 37719:tid 37722] [client 138.199.29.151:45422] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adRcmk09Xv52u2xXGLCzfAAAAMA"]
[Tue Apr 07 09:23:39.701086 2026] [:error] [pid 12948:tid 12968] [client 138.199.29.151:45428] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adRcm8beSPAN8LvMqsbizQAAARE"]
[Tue Apr 07 09:23:40.827590 2026] [:error] [pid 37719:tid 37737] [client 138.199.29.151:45432] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue Apr 07 09:23:41.108818 2026] [:error] [pid 37719:tid 37745] [client 138.199.29.151:45432] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Tue Apr 07 09:23:41.391394 2026] [:error] [pid 37719:tid 37744] [client 138.199.29.151:45432] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Tue Apr 07 09:23:41.671781 2026] [:error] [pid 37719:tid 37725] [client 138.199.29.151:45432] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Tue Apr 07 09:23:43.083699 2026] [:error] [pid 37719:tid 37737] [client 138.199.29.151:45432] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adRcn009Xv52u2xXGLCzkgAAAM8"]
[Tue Apr 07 09:23:43.646336 2026] [:error] [pid 12948:tid 12957] [client 138.199.29.151:33400] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adRcn8beSPAN8LvMqsbi2gAAAQY"]
[Tue Apr 07 09:23:44.224789 2026] [:error] [pid 37719:tid 37738] [client 138.199.29.151:33416] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adRcoE09Xv52u2xXGLCzlAAAANA"]
[Tue Apr 07 09:23:44.775981 2026] [:error] [pid 37598:tid 37674] [client 138.199.29.151:33418] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adRcoO9g7q_cV2WhPazknQAAAI0"]
[Tue Apr 07 09:23:45.352509 2026] [:error] [pid 37598:tid 37663] [client 138.199.29.151:33434] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adRcoe9g7q_cV2WhPazkngAAAII"]
[Tue Apr 07 09:23:45.928021 2026] [:error] [pid 37598:tid 37672] [client 138.199.29.151:33442] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adRcoe9g7q_cV2WhPazknwAAAIs"]
[Tue Apr 07 09:23:46.769720 2026] [:error] [pid 37719:tid 37733] [client 138.199.29.151:33454] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adRcok09Xv52u2xXGLCzlwAAAMs"]
[Tue Apr 07 09:23:47.323027 2026] [:error] [pid 37597:tid 37634] [client 138.199.29.151:33470] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adRcow6uAY0QAy-8EEKdKQAAAEA"]
[Tue Apr 07 09:23:47.878720 2026] [:error] [pid 37597:tid 37640] [client 138.199.29.151:33474] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adRcow6uAY0QAy-8EEKdKgAAAEY"]
[Tue Apr 07 09:23:48.449916 2026] [:error] [pid 37597:tid 37641] [client 138.199.29.151:33490] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adRcpA6uAY0QAy-8EEKdLAAAAEc"]
[Tue Apr 07 09:23:49.575668 2026] [:error] [pid 37596:tid 37619] [client 138.199.29.151:33496] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adRcpapaAOZHEjRWjP06kQAAAA0"]
[Tue Apr 07 09:23:50.423074 2026] [:error] [pid 37598:tid 37673] [client 138.199.29.151:33498] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adRcpu9g7q_cV2WhPazkqwAAAIw"]
[Tue Apr 07 09:23:50.980427 2026] [:error] [pid 37597:tid 37657] [client 138.199.29.151:33514] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Apr 07 09:23:51.536367 2026] [:error] [pid 37597:tid 37642] [client 138.199.29.151:33514] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adRcpw6uAY0QAy-8EEKdNQAAAEg"]
[Tue Apr 07 09:23:52.656305 2026] [:error] [pid 12948:tid 12960] [client 138.199.29.151:33518] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "adRcqMbeSPAN8LvMqsbi7AAAAQk"]
[Tue Apr 07 09:23:53.767866 2026] [:error] [pid 12948:tid 12970] [client 138.199.29.151:35550] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Apr 07 09:23:54.043163 2026] [:error] [pid 12948:tid 12957] [client 138.199.29.151:35550] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adRcqsbeSPAN8LvMqsbi9gAAAQY"]
[Tue Apr 07 09:23:54.902955 2026] [:error] [pid 37598:tid 37676] [client 138.199.29.151:35558] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Apr 07 09:23:55.186784 2026] [:error] [pid 37598:tid 37668] [client 138.199.29.151:35558] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Tue Apr 07 09:23:55.476915 2026] [:error] [pid 37598:tid 37666] [client 138.199.29.151:35558] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Apr 07 09:23:55.755943 2026] [:error] [pid 37598:tid 37663] [client 138.199.29.151:35558] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adRcq-9g7q_cV2WhPazkuQAAAII"]
[Tue Apr 07 09:23:56.316196 2026] [:error] [pid 37719:tid 37723] [client 138.199.29.151:35560] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue Apr 07 09:23:56.631822 2026] [:error] [pid 37719:tid 37745] [client 138.199.29.151:35560] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adRcrE09Xv52u2xXGLCzqQAAANc"]
[Tue Apr 07 09:23:57.801743 2026] [:error] [pid 37596:tid 37606] [client 138.199.29.151:35568] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Apr 07 09:23:58.089934 2026] [:error] [pid 37596:tid 37613] [client 138.199.29.151:35568] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Apr 07 09:23:58.375415 2026] [:error] [pid 37596:tid 37625] [client 138.199.29.151:35568] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Tue Apr 07 09:23:59.812565 2026] [:error] [pid 37596:tid 37616] [client 138.199.29.151:35568] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 07 09:24:00.097327 2026] [:error] [pid 37596:tid 37624] [client 138.199.29.151:35568] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Tue Apr 07 09:24:00.675043 2026] [:error] [pid 37596:tid 37606] [client 138.199.29.151:35568] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Tue Apr 07 09:24:01.535520 2026] [:error] [pid 37596:tid 37611] [client 138.199.29.151:35568] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Apr 07 09:24:01.816553 2026] [:error] [pid 37596:tid 37607] [client 138.199.29.151:35568] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adRcsapaAOZHEjRWjP06uQAAAAE"]
[Tue Apr 07 09:24:02.374761 2026] [:error] [pid 37598:tid 37679] [client 138.199.29.151:35572] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adRcsu9g7q_cV2WhPazkvwAAAJI"]
[Tue Apr 07 09:24:04.545006 2026] [:error] [pid 37719:tid 37727] [client 138.199.29.151:54824] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Tue Apr 07 09:24:04.826778 2026] [:error] [pid 37719:tid 37741] [client 138.199.29.151:54824] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adRctE09Xv52u2xXGLCzyQAAANM"]
[Tue Apr 07 09:24:05.672313 2026] [:error] [pid 12948:tid 12967] [client 138.199.29.151:54840] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Apr 07 09:24:05.954482 2026] [:error] [pid 12948:tid 12974] [client 138.199.29.151:54840] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adRctcbeSPAN8LvMqsbjAAAAARc"]
[Tue Apr 07 09:24:06.509309 2026] [:error] [pid 37598:tid 37671] [client 138.199.29.151:54852] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adRctu9g7q_cV2WhPazkyAAAAIo"]
[Tue Apr 07 09:24:08.220674 2026] [:error] [pid 37597:tid 37639] [client 138.199.29.151:54866] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adRcuA6uAY0QAy-8EEKdRwAAAEU"]
[Tue Apr 07 09:24:08.799100 2026] [:error] [pid 37719:tid 37740] [client 138.199.29.151:54870] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "adRcuE09Xv52u2xXGLCz4AAAANI"]
[Tue Apr 07 09:24:10.215654 2026] [:error] [pid 37719:tid 37739] [client 138.199.29.151:54876] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Apr 07 09:24:10.803672 2026] [:error] [pid 37719:tid 37725] [client 138.199.29.151:54876] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adRcuk09Xv52u2xXGLCz7gAAAMM"]
[Tue Apr 07 09:24:11.679277 2026] [:error] [pid 37719:tid 37733] [client 138.199.29.151:54884] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Tue Apr 07 09:24:12.231593 2026] [:error] [pid 37719:tid 37741] [client 138.199.29.151:54884] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/function.php"] [unique_id "adRcvE09Xv52u2xXGLCz9gAAANM"]
[Tue Apr 07 09:24:12.781439 2026] [:error] [pid 37598:tid 37685] [client 138.199.29.151:54774] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "adRcvO9g7q_cV2WhPazk1AAAAJg"]
[Tue Apr 07 09:24:13.634179 2026] [:error] [pid 37596:tid 37607] [client 138.199.29.151:54786] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Tue Apr 07 09:24:13.915329 2026] [:error] [pid 37596:tid 37625] [client 138.199.29.151:54786] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adRcvapaAOZHEjRWjP06xAAAABM"]
[Tue Apr 07 09:24:14.475892 2026] [:error] [pid 37596:tid 37629] [client 138.199.29.151:54790] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adRcvqpaAOZHEjRWjP06xQAAABc"]
[Tue Apr 07 09:24:15.611196 2026] [:error] [pid 12948:tid 12975] [client 138.199.29.151:54798] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Tue Apr 07 09:24:15.897485 2026] [:error] [pid 12948:tid 12961] [client 138.199.29.151:54798] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Tue Apr 07 09:24:16.473268 2026] [:error] [pid 12948:tid 12974] [client 138.199.29.151:54798] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Tue Apr 07 09:24:17.037440 2026] [:error] [pid 12948:tid 12959] [client 138.199.29.151:54798] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adRcwcbeSPAN8LvMqsbjpAAAAQg"]
[Tue Apr 07 09:24:17.598032 2026] [:error] [pid 37598:tid 37681] [client 138.199.29.151:54802] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adRcwe9g7q_cV2WhPazk2wAAAJQ"]
[Tue Apr 07 09:24:19.041425 2026] [:error] [pid 37719:tid 37729] [client 138.199.29.151:54808] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 07 09:24:19.335780 2026] [:error] [pid 37719:tid 37738] [client 138.199.29.151:54808] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/index.php"] [unique_id "adRcw009Xv52u2xXGLC0FAAAANA"]
[Tue Apr 07 09:24:19.891796 2026] [:error] [pid 12948:tid 12964] [client 138.199.29.151:54816] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adRcw8beSPAN8LvMqsbjrAAAAQ0"]
[Tue Apr 07 09:24:20.450398 2026] [:error] [pid 12948:tid 12961] [client 138.199.29.151:54832] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adRcxMbeSPAN8LvMqsbjsAAAAQo"]
[Tue Apr 07 09:24:22.135623 2026] [:error] [pid 37597:tid 37644] [client 138.199.29.151:54836] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Tue Apr 07 09:24:22.412939 2026] [:error] [pid 37597:tid 37648] [client 138.199.29.151:54836] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adRcxg6uAY0QAy-8EEKdZwAAAE4"]
[Tue Apr 07 09:24:23.280488 2026] [:error] [pid 12948:tid 12975] [client 138.199.29.151:45476] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adRcx8beSPAN8LvMqsbjyAAAARg"]
[Tue Apr 07 09:24:23.862642 2026] [:error] [pid 12948:tid 12955] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 07 09:24:24.154380 2026] [:error] [pid 12948:tid 12970] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Apr 07 09:24:24.744243 2026] [:error] [pid 12948:tid 12956] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Tue Apr 07 09:24:25.917074 2026] [:error] [pid 12948:tid 12966] [client 138.199.29.151:45486] [client 138.199.29.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.151, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/wp-login.php"] [unique_id "adRcycbeSPAN8LvMqsbj3QAAAQ8"]
[Tue Apr 07 09:24:26.507660 2026] [:error] [pid 12948:tid 12955] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Tue Apr 07 09:24:26.800538 2026] [:error] [pid 12948:tid 12957] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Tue Apr 07 09:24:27.092932 2026] [:error] [pid 12948:tid 12971] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Tue Apr 07 09:24:27.674214 2026] [:error] [pid 12948:tid 12962] [client 138.199.29.151:45486] [client 138.199.29.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.151, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adRcy8beSPAN8LvMqsbj5QAAAQs"]
[Tue Apr 07 09:24:28.555889 2026] [:error] [pid 12948:tid 12968] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Apr 07 09:24:28.848304 2026] [:error] [pid 12948:tid 12954] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Tue Apr 07 09:24:29.432802 2026] [:error] [pid 12948:tid 12953] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Tue Apr 07 09:24:30.019966 2026] [:error] [pid 12948:tid 12974] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Apr 07 09:24:30.900967 2026] [:error] [pid 12948:tid 12951] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Tue Apr 07 09:24:32.952647 2026] [:error] [pid 12948:tid 12963] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 07 09:24:33.245870 2026] [:error] [pid 12948:tid 12952] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Tue Apr 07 09:24:34.723271 2026] [:error] [pid 12948:tid 12971] [client 138.199.29.151:45486] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Tue Apr 07 09:24:35.311165 2026] [:error] [pid 12948:tid 12951] [client 138.199.29.151:45486] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adRc08beSPAN8LvMqsbkNgAAAQA"]
[Tue Apr 07 09:24:36.469439 2026] [:error] [pid 37597:tid 37656] [client 138.199.29.151:51374] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Apr 07 09:24:36.755401 2026] [:error] [pid 37597:tid 37651] [client 138.199.29.151:51374] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adRc1A6uAY0QAy-8EEKdgwAAAFE"]
[Tue Apr 07 09:24:37.627183 2026] [:error] [pid 37596:tid 37616] [client 138.199.29.151:51376] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Tue Apr 07 09:24:37.921309 2026] [:error] [pid 37596:tid 37619] [client 138.199.29.151:51376] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adRc1apaAOZHEjRWjP066wAAAA0"]
[Tue Apr 07 09:24:39.054791 2026] [:error] [pid 12948:tid 12951] [client 138.199.29.151:51384] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Tue Apr 07 09:24:39.624710 2026] [:error] [pid 12948:tid 12954] [client 138.199.29.151:51384] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Tue Apr 07 09:24:40.204134 2026] [:error] [pid 12948:tid 12966] [client 138.199.29.151:51384] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Tue Apr 07 09:24:40.487707 2026] [:error] [pid 12948:tid 12954] [client 138.199.29.151:51384] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Tue Apr 07 09:24:41.052185 2026] [:error] [pid 12948:tid 12961] [client 138.199.29.151:51384] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adRc2cbeSPAN8LvMqsbkUQAAAQo"]
[Tue Apr 07 09:24:41.615645 2026] [:error] [pid 12948:tid 12973] [client 138.199.29.151:51390] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Tue Apr 07 09:24:41.896163 2026] [:error] [pid 12948:tid 12952] [client 138.199.29.151:51390] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Tue Apr 07 09:24:42.173982 2026] [:error] [pid 12948:tid 12975] [client 138.199.29.151:51390] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adRc2sbeSPAN8LvMqsbkVwAAARg"]
[Tue Apr 07 09:24:43.042169 2026] [:error] [pid 37596:tid 37607] [client 138.199.29.151:53296] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adRc26paAOZHEjRWjP068gAAAAE"]
[Tue Apr 07 09:24:43.891250 2026] [:error] [pid 37596:tid 37613] [client 138.199.29.151:53306] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Apr 07 09:24:44.749476 2026] [:error] [pid 37596:tid 37612] [client 138.199.29.151:53306] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Tue Apr 07 09:24:45.034327 2026] [:error] [pid 37596:tid 37611] [client 138.199.29.151:53306] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Tue Apr 07 09:24:45.315738 2026] [:error] [pid 37596:tid 37629] [client 138.199.29.151:53306] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adRc3apaAOZHEjRWjP06_gAAABc"]
[Tue Apr 07 09:24:45.879295 2026] [:error] [pid 12948:tid 12975] [client 138.199.29.151:53320] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adRc3cbeSPAN8LvMqsbkZAAAARg"]
[Tue Apr 07 09:24:47.837802 2026] [:error] [pid 37719:tid 37745] [client 138.199.29.151:53330] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Tue Apr 07 09:24:48.393305 2026] [:error] [pid 37719:tid 37724] [client 138.199.29.151:53330] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adRc4E09Xv52u2xXGLC0ZwAAAMI"]
[Tue Apr 07 09:24:49.229996 2026] [:error] [pid 37719:tid 37740] [client 138.199.29.151:53334] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "adRc4U09Xv52u2xXGLC0cQAAANI"]
[Tue Apr 07 09:24:50.068280 2026] [:error] [pid 37719:tid 37736] [client 138.199.29.151:53350] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Apr 07 09:24:50.351031 2026] [:error] [pid 37719:tid 37725] [client 138.199.29.151:53350] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Tue Apr 07 09:24:50.628180 2026] [:error] [pid 37719:tid 37722] [client 138.199.29.151:53350] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adRc4k09Xv52u2xXGLC0eAAAAMA"]
[Tue Apr 07 09:24:51.500494 2026] [:error] [pid 12948:tid 12973] [client 138.199.29.151:53356] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Tue Apr 07 09:24:51.793470 2026] [:error] [pid 12948:tid 12954] [client 138.199.29.151:53356] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Tue Apr 07 09:24:52.381611 2026] [:error] [pid 12948:tid 12958] [client 138.199.29.151:53356] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Tue Apr 07 09:24:53.260665 2026] [:error] [pid 12948:tid 12951] [client 138.199.29.151:53356] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adRc5cbeSPAN8LvMqsbkfgAAAQA"]
[Tue Apr 07 09:24:53.823141 2026] [:error] [pid 37597:tid 37649] [client 138.199.29.151:58430] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Tue Apr 07 09:24:54.664883 2026] [:error] [pid 37597:tid 37647] [client 138.199.29.151:58430] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adRc5g6uAY0QAy-8EEKdmgAAAE0"]
[Tue Apr 07 09:24:55.503349 2026] [:error] [pid 12948:tid 12971] [client 138.199.29.151:58434] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Tue Apr 07 09:24:56.353416 2026] [:error] [pid 12948:tid 12975] [client 138.199.29.151:58434] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Tue Apr 07 09:24:56.635609 2026] [:error] [pid 12948:tid 12967] [client 138.199.29.151:58434] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Apr 07 09:24:57.197761 2026] [:error] [pid 12948:tid 12973] [client 138.199.29.151:58434] [client 138.199.29.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.151, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adRc6cbeSPAN8LvMqsbkmgAAARY"]
[Tue Apr 07 09:24:58.610163 2026] [:error] [pid 12948:tid 12961] [client 138.199.29.151:58434] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adRc6sbeSPAN8LvMqsbkoQAAAQo"]
[Tue Apr 07 09:24:59.175541 2026] [:error] [pid 12948:tid 12970] [client 138.199.29.151:58438] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Tue Apr 07 09:24:59.456438 2026] [:error] [pid 12948:tid 12955] [client 138.199.29.151:58438] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adRc68beSPAN8LvMqsbkpwAAAQQ"]
[Tue Apr 07 09:25:00.015010 2026] [:error] [pid 37719:tid 37737] [client 138.199.29.151:58450] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Tue Apr 07 09:25:00.579962 2026] [:error] [pid 37719:tid 37735] [client 138.199.29.151:58450] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Tue Apr 07 09:25:01.140763 2026] [:error] [pid 37719:tid 37731] [client 138.199.29.151:58450] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adRc7U09Xv52u2xXGLC0iQAAAMk"]
[Tue Apr 07 09:25:01.997558 2026] [:error] [pid 37596:tid 37608] [client 138.199.29.151:58458] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Tue Apr 07 09:25:02.331288 2026] [:error] [pid 37596:tid 37611] [client 138.199.29.151:58458] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Tue Apr 07 09:25:02.655579 2026] [:error] [pid 37596:tid 37607] [client 138.199.29.151:58458] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adRc7qpaAOZHEjRWjP07FwAAAAE"]
[Tue Apr 07 09:25:03.228075 2026] [:error] [pid 37598:tid 37673] [client 138.199.29.151:53188] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adRc7-9g7q_cV2WhPazlDwAAAIw"]
[Tue Apr 07 09:25:03.833263 2026] [:error] [pid 37597:tid 37640] [client 138.199.29.151:53196] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Tue Apr 07 09:25:04.115040 2026] [:error] [pid 37597:tid 37643] [client 138.199.29.151:53196] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Tue Apr 07 09:25:04.684374 2026] [:error] [pid 37597:tid 37657] [client 138.199.29.151:53196] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adRc8A6uAY0QAy-8EEKdogAAAFc"]
[Tue Apr 07 09:25:05.237508 2026] [:error] [pid 37598:tid 37671] [client 138.199.29.151:53204] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Tue Apr 07 09:25:05.796531 2026] [:error] [pid 37598:tid 37682] [client 138.199.29.151:53204] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Tue Apr 07 09:25:06.072827 2026] [:error] [pid 37598:tid 37672] [client 138.199.29.151:53204] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adRc8u9g7q_cV2WhPazlGgAAAIs"]
[Tue Apr 07 09:25:06.944913 2026] [:error] [pid 37598:tid 37663] [client 138.199.29.151:53214] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/db.php"] [unique_id "adRc8u9g7q_cV2WhPazlHwAAAII"]
[Tue Apr 07 09:25:07.522506 2026] [:error] [pid 12948:tid 12965] [client 138.199.29.151:53226] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adRc88beSPAN8LvMqsbkxQAAAQ4"]
[Tue Apr 07 09:25:08.079763 2026] [:error] [pid 12948:tid 12973] [client 138.199.29.151:53234] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adRc9MbeSPAN8LvMqsbkxgAAARY"]
[Tue Apr 07 09:25:08.636385 2026] [:error] [pid 12948:tid 12957] [client 138.199.29.151:53242] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adRc9MbeSPAN8LvMqsbkywAAAQY"]
[Tue Apr 07 09:25:09.196620 2026] [:error] [pid 37598:tid 37672] [client 138.199.29.151:53254] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adRc9e9g7q_cV2WhPazlIQAAAIs"]
[Tue Apr 07 09:25:09.749648 2026] [:error] [pid 37719:tid 37733] [client 138.199.29.151:53264] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adRc9U09Xv52u2xXGLC0mAAAAMs"]
[Tue Apr 07 09:25:10.882204 2026] [:error] [pid 37597:tid 37655] [client 138.199.29.151:53278] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adRc9g6uAY0QAy-8EEKdqAAAAFU"]
[Tue Apr 07 09:25:11.434713 2026] [:error] [pid 37597:tid 37652] [client 138.199.29.151:53286] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adRc9w6uAY0QAy-8EEKdqgAAAFI"]
[Tue Apr 07 09:25:11.993513 2026] [:error] [pid 12948:tid 12971] [client 138.199.29.151:53302] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adRc98beSPAN8LvMqsbk0wAAARQ"]
[Tue Apr 07 09:25:12.549015 2026] [:error] [pid 37719:tid 37731] [client 138.199.29.151:44426] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adRc-E09Xv52u2xXGLC0owAAAMk"]
[Tue Apr 07 09:25:13.120873 2026] [:error] [pid 37596:tid 37619] [client 138.199.29.151:44436] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "adRc-apaAOZHEjRWjP07IAAAAA0"]
[Tue Apr 07 09:25:13.681536 2026] [:error] [pid 37596:tid 37625] [client 138.199.29.151:44446] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Tue Apr 07 09:25:14.523858 2026] [:error] [pid 37596:tid 37621] [client 138.199.29.151:44446] [client 138.199.29.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.151, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adRc-qpaAOZHEjRWjP07JwAAAA8"]
[Tue Apr 07 09:25:15.931926 2026] [:error] [pid 37596:tid 37620] [client 138.199.29.151:44446] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adRc-6paAOZHEjRWjP07MQAAAA4"]
[Tue Apr 07 09:25:17.896853 2026] [:error] [pid 12948:tid 12966] [client 138.199.29.151:44460] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Tue Apr 07 09:25:18.179027 2026] [:error] [pid 12948:tid 12955] [client 138.199.29.151:44460] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Tue Apr 07 09:25:19.318146 2026] [:error] [pid 12948:tid 12966] [client 138.199.29.151:44460] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Tue Apr 07 09:25:19.600557 2026] [:error] [pid 12948:tid 12953] [client 138.199.29.151:44460] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Tue Apr 07 09:25:20.727313 2026] [:error] [pid 12948:tid 12967] [client 138.199.29.151:44460] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Tue Apr 07 09:25:21.008912 2026] [:error] [pid 12948:tid 12957] [client 138.199.29.151:44460] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Tue Apr 07 09:25:21.290147 2026] [:error] [pid 12948:tid 12959] [client 138.199.29.151:44460] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Tue Apr 07 09:25:21.571674 2026] [:error] [pid 12948:tid 12963] [client 138.199.29.151:44460] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Tue Apr 07 09:25:21.853330 2026] [:error] [pid 12948:tid 12970] [client 138.199.29.151:44460] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adRdAcbeSPAN8LvMqsblAAAAARM"]
[Tue Apr 07 09:25:22.428374 2026] [:error] [pid 37596:tid 37613] [client 138.199.29.151:44476] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adRdAqpaAOZHEjRWjP07NwAAAAc"]
[Tue Apr 07 09:25:23.007600 2026] [:error] [pid 37596:tid 37612] [client 138.199.29.151:47188] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adRdA6paAOZHEjRWjP07OAAAAAY"]
[Tue Apr 07 09:25:23.848705 2026] [:error] [pid 37719:tid 37730] [client 138.199.29.151:47198] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Tue Apr 07 09:25:24.129527 2026] [:error] [pid 37719:tid 37725] [client 138.199.29.151:47198] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Tue Apr 07 09:25:24.688571 2026] [:error] [pid 37719:tid 37728] [client 138.199.29.151:47198] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Tue Apr 07 09:25:25.248252 2026] [:error] [pid 37719:tid 37727] [client 138.199.29.151:47198] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adRdBU09Xv52u2xXGLC0xgAAAMU"]
[Tue Apr 07 09:25:25.807135 2026] [:error] [pid 37596:tid 37623] [client 138.199.29.151:47200] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adRdBapaAOZHEjRWjP07OwAAABE"]
[Tue Apr 07 09:25:26.366593 2026] [:error] [pid 12948:tid 12975] [client 138.199.29.151:47204] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adRdBsbeSPAN8LvMqsblEQAAARg"]
[Tue Apr 07 09:25:28.084184 2026] [:error] [pid 37598:tid 37680] [client 138.199.29.151:47218] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adRdCO9g7q_cV2WhPazlOwAAAJM"]
[Tue Apr 07 09:25:28.950690 2026] [:error] [pid 37719:tid 37724] [client 138.199.29.151:47224] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adRdCE09Xv52u2xXGLC00QAAAMI"]
[Tue Apr 07 09:25:30.099075 2026] [:error] [pid 12948:tid 12960] [client 138.199.29.151:47232] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adRdCsbeSPAN8LvMqsblGwAAAQk"]
[Tue Apr 07 09:25:35.169573 2026] [:error] [pid 37719:tid 37730] [client 138.199.29.151:47240] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "adRdD009Xv52u2xXGLC07QAAAMg"]
[Tue Apr 07 09:25:35.728732 2026] [:error] [pid 37596:tid 37627] [client 138.199.29.151:60428] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Tue Apr 07 09:25:36.006372 2026] [:error] [pid 37596:tid 37619] [client 138.199.29.151:60428] [client 138.199.29.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/about.php"] [unique_id "adRdEKpaAOZHEjRWjP07QQAAAA0"]
[Tue Apr 07 09:25:36.561777 2026] [:error] [pid 12948:tid 12956] [client 138.199.29.151:60430] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/install.php"] [unique_id "adRdEMbeSPAN8LvMqsblMQAAAQU"]
[Tue Apr 07 09:25:37.118049 2026] [:error] [pid 37598:tid 37675] [client 138.199.29.151:60446] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/install.php"] [unique_id "adRdEe9g7q_cV2WhPazlQgAAAI4"]
[Tue Apr 07 09:25:37.675697 2026] [:error] [pid 12948:tid 12953] [client 138.199.29.151:60454] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/install.php"] [unique_id "adRdEcbeSPAN8LvMqsblNQAAAQI"]
[Tue Apr 07 09:25:38.237156 2026] [:error] [pid 12948:tid 12967] [client 138.199.29.151:60460] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/install.php"] [unique_id "adRdEsbeSPAN8LvMqsblOAAAARA"]
[Tue Apr 07 09:25:44.427497 2026] [:error] [pid 12948:tid 12961] [client 138.199.29.151:60470] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/pki-validation/"] [unique_id "adRdGMbeSPAN8LvMqsblYQAAAQo"]
[Tue Apr 07 09:25:44.981831 2026] [:error] [pid 37598:tid 37682] [client 138.199.29.151:53720] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/pki-validation/"] [unique_id "adRdGO9g7q_cV2WhPazlSgAAAJU"]
[Tue Apr 07 09:25:45.538852 2026] [:error] [pid 37597:tid 37646] [client 138.199.29.151:53732] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/pki-validation/"] [unique_id "adRdGQ6uAY0QAy-8EEKdygAAAEw"]
[Tue Apr 07 09:25:46.093059 2026] [:error] [pid 37598:tid 37678] [client 138.199.29.151:53748] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/pki-validation/"] [unique_id "adRdGu9g7q_cV2WhPazlTwAAAJE"]
[Tue Apr 07 09:25:46.648275 2026] [:error] [pid 12948:tid 12975] [client 138.199.29.151:53760] [client 138.199.29.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/pki-validation/"] [unique_id "adRdGsbeSPAN8LvMqsblZAAAARg"]
[Tue Apr 07 18:34:20.236571 2026] [:error] [pid 37597:tid 37652] [client 13.200.242.16:38662] [client 13.200.242.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "adTdrA6uAY0QAy-8EEIYVAAAAFI"]
[Tue Apr 07 18:34:20.858896 2026] [:error] [pid 59804:tid 59813] [client 13.200.242.16:38720] [client 13.200.242.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "adTdrHYVIXiPh5_eJTl9ygAAAgc"]
[Tue Apr 07 18:34:21.490116 2026] [:error] [pid 59804:tid 59822] [client 13.200.242.16:40992] [client 13.200.242.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "adTdrXYVIXiPh5_eJTl9ywAAAhA"]
[Tue Apr 07 18:34:22.116710 2026] [:error] [pid 59551:tid 59570] [client 13.200.242.16:41044] [client 13.200.242.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "adTdrl7LN7Ubyqs-sVvVoQAAAZE"]
[Tue Apr 07 18:34:22.743154 2026] [:error] [pid 37596:tid 37613] [client 13.200.242.16:41090] [client 13.200.242.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "adTdrqpaAOZHEjRWjP2M_AAAAAc"]
[Tue Apr 07 23:00:44.588610 2026] [:error] [pid 59660:tid 59683] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 07 23:00:44.857802 2026] [:error] [pid 59660:tid 59664] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Apr 07 23:00:45.127756 2026] [:error] [pid 59660:tid 59663] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Apr 07 23:00:45.398147 2026] [:error] [pid 59660:tid 59672] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Apr 07 23:00:45.669963 2026] [:error] [pid 59660:tid 59680] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 07 23:00:45.941175 2026] [:error] [pid 59660:tid 59676] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 07 23:00:46.212210 2026] [:error] [pid 59660:tid 59675] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 07 23:00:46.481810 2026] [:error] [pid 59660:tid 59662] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Apr 07 23:00:47.023498 2026] [:error] [pid 59660:tid 59667] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Apr 07 23:00:47.294273 2026] [:error] [pid 59660:tid 59684] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 07 23:00:47.564008 2026] [:error] [pid 59660:tid 59666] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 07 23:00:47.838319 2026] [:error] [pid 59660:tid 59670] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 07 23:00:48.110345 2026] [:error] [pid 59660:tid 59665] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 07 23:00:48.385061 2026] [:error] [pid 59660:tid 59673] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Apr 07 23:00:48.654645 2026] [:error] [pid 59660:tid 59682] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Apr 07 23:00:48.926731 2026] [:error] [pid 59660:tid 59674] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 07 23:00:49.196484 2026] [:error] [pid 59660:tid 59677] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 07 23:00:49.467292 2026] [:error] [pid 59660:tid 59668] [client 195.86.5.3:60740] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 07 23:00:54.465057 2026] [:error] [pid 59660:tid 59670] [client 195.86.5.3:60740] [client 195.86.5.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adUcJjp3-oiX2o5bTswpjQAAAcg"]
[Tue Apr 07 23:00:55.844689 2026] [:error] [pid 37597:tid 37634] [client 195.86.5.3:53266] [client 195.86.5.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adUcJw6uAY0QAy-8EELQowAAAEA"]
[Tue Apr 07 23:01:02.456024 2026] [:error] [pid 59551:tid 59557] [client 195.86.5.15:53280] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 07 23:01:03.269058 2026] [:error] [pid 59551:tid 59575] [client 195.86.5.15:53280] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adUcL17LN7Ubyqs-sVs7-QAAAZY"]
[Tue Apr 07 23:01:04.347025 2026] [:error] [pid 59551:tid 59573] [client 195.86.5.15:53288] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Apr 07 23:01:04.613558 2026] [:error] [pid 59551:tid 59557] [client 195.86.5.15:53288] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adUcMF7LN7Ubyqs-sVs8AQAAAYQ"]
[Tue Apr 07 23:01:05.422760 2026] [:error] [pid 37596:tid 37613] [client 195.86.5.15:55048] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Apr 07 23:01:06.788482 2026] [:error] [pid 37596:tid 37625] [client 195.86.5.15:55048] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adUcMqpaAOZHEjRWjP2tHgAAABM"]
[Tue Apr 07 23:01:07.624092 2026] [:error] [pid 37719:tid 37733] [client 195.86.5.15:55058] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adUcM009Xv52u2xXGLBczQAAAMs"]
[Tue Apr 07 23:01:08.153725 2026] [:error] [pid 59804:tid 59811] [client 195.86.5.15:55074] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adUcNHYVIXiPh5_eJTn0zQAAAgU"]
[Tue Apr 07 23:01:08.683686 2026] [:error] [pid 59804:tid 59829] [client 195.86.5.15:55088] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adUcNHYVIXiPh5_eJTn00gAAAhc"]
[Tue Apr 07 23:01:09.205960 2026] [:error] [pid 59551:tid 59561] [client 195.86.5.15:55092] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adUcNV7LN7Ubyqs-sVs8CQAAAYg"]
[Tue Apr 07 23:01:09.727322 2026] [:error] [pid 37597:tid 37648] [client 195.86.5.15:55094] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adUcNQ6uAY0QAy-8EELQpwAAAE4"]
[Tue Apr 07 23:01:10.530428 2026] [:error] [pid 37597:tid 37651] [client 195.86.5.15:55104] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adUcNg6uAY0QAy-8EELQrwAAAFE"]
[Tue Apr 07 23:01:11.063301 2026] [:error] [pid 37719:tid 37738] [client 195.86.5.15:55120] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue Apr 07 23:01:11.592120 2026] [:error] [pid 37719:tid 37732] [client 195.86.5.15:55120] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "adUcN009Xv52u2xXGLBc0gAAAMo"]
[Tue Apr 07 23:01:12.673845 2026] [:error] [pid 59551:tid 59560] [client 195.86.5.15:55136] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adUcOF7LN7Ubyqs-sVs8DgAAAYc"]
[Tue Apr 07 23:01:13.478385 2026] [:error] [pid 37598:tid 37671] [client 195.86.5.15:55138] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adUcOe9g7q_cV2WhPazeUwAAAIo"]
[Tue Apr 07 23:01:14.012494 2026] [:error] [pid 12948:tid 12969] [client 195.86.5.15:43324] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Apr 07 23:01:14.276498 2026] [:error] [pid 12948:tid 12960] [client 195.86.5.15:43324] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adUcOsbeSPAN8LvMqsbKuwAAAQk"]
[Tue Apr 07 23:01:14.827806 2026] [:error] [pid 59660:tid 59662] [client 195.86.5.15:43330] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 07 23:01:15.672783 2026] [:error] [pid 59660:tid 59684] [client 195.86.5.15:43330] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 07 23:01:16.519964 2026] [:error] [pid 59660:tid 59670] [client 195.86.5.15:43330] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adUcPDp3-oiX2o5bTswpnAAAAcg"]
[Tue Apr 07 23:01:17.050953 2026] [:error] [pid 59490:tid 59500] [client 195.86.5.15:43332] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Apr 07 23:01:17.316477 2026] [:error] [pid 59490:tid 59509] [client 195.86.5.15:43332] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adUcPUcw8OFbiUZ7Rx18XwAAAVE"]
[Tue Apr 07 23:01:17.842551 2026] [:error] [pid 59660:tid 59682] [client 195.86.5.15:43336] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Apr 07 23:01:18.368995 2026] [:error] [pid 59660:tid 59686] [client 195.86.5.15:43336] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adUcPjp3-oiX2o5bTswpnwAAAdg"]
[Tue Apr 07 23:01:19.162889 2026] [:error] [pid 59660:tid 59668] [client 195.86.5.15:43344] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adUcPzp3-oiX2o5bTswpogAAAcY"]
[Tue Apr 07 23:01:19.991285 2026] [:error] [pid 12948:tid 12957] [client 195.86.5.15:43360] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Tue Apr 07 23:01:21.446547 2026] [:error] [pid 12948:tid 12957] [client 195.86.5.15:43360] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Apr 07 23:01:21.996788 2026] [:error] [pid 12948:tid 12960] [client 195.86.5.15:43360] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adUcQcbeSPAN8LvMqsbKyAAAAQk"]
[Tue Apr 07 23:01:22.813319 2026] [:error] [pid 59804:tid 59821] [client 195.86.5.15:43372] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adUcQnYVIXiPh5_eJTn03QAAAg8"]
[Tue Apr 07 23:01:23.645170 2026] [:error] [pid 59804:tid 59809] [client 195.86.5.15:43388] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adUcQ3YVIXiPh5_eJTn04gAAAgM"]
[Tue Apr 07 23:01:24.179810 2026] [:error] [pid 12948:tid 12973] [client 195.86.5.15:60852] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adUcRMbeSPAN8LvMqsbKygAAARY"]
[Tue Apr 07 23:01:24.714033 2026] [:error] [pid 12948:tid 12970] [client 195.86.5.15:60856] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adUcRMbeSPAN8LvMqsbKzQAAARM"]
[Tue Apr 07 23:01:25.807649 2026] [:error] [pid 59551:tid 59572] [client 195.86.5.15:60872] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Apr 07 23:01:26.075594 2026] [:error] [pid 59551:tid 59563] [client 195.86.5.15:60872] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adUcRl7LN7Ubyqs-sVs8FQAAAYo"]
[Tue Apr 07 23:01:26.629715 2026] [:error] [pid 12948:tid 12953] [client 195.86.5.15:60886] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adUcRsbeSPAN8LvMqsbK0wAAAQI"]
[Tue Apr 07 23:01:27.159833 2026] [:error] [pid 37598:tid 37670] [client 195.86.5.15:60900] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adUcR-9g7q_cV2WhPazeWAAAAIk"]
[Tue Apr 07 23:01:30.151579 2026] [:error] [pid 59660:tid 59681] [client 195.86.5.15:60914] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Apr 07 23:01:30.696096 2026] [:error] [pid 59660:tid 59684] [client 195.86.5.15:60914] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Apr 07 23:01:31.775442 2026] [:error] [pid 59660:tid 59682] [client 195.86.5.15:60914] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adUcSzp3-oiX2o5bTswprwAAAdQ"]
[Tue Apr 07 23:01:33.154166 2026] [:error] [pid 37598:tid 37661] [client 195.86.5.15:60922] [client 195.86.5.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.86.5.15, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adUcTe9g7q_cV2WhPazeXQAAAIA"]
[Tue Apr 07 23:01:33.435151 2026] [:error] [pid 37598:tid 37666] [client 195.86.5.15:60922] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Apr 07 23:01:34.819765 2026] [:error] [pid 37598:tid 37672] [client 195.86.5.15:60922] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Apr 07 23:01:35.095631 2026] [:error] [pid 37598:tid 37685] [client 195.86.5.15:60922] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Apr 07 23:01:36.478638 2026] [:error] [pid 37598:tid 37680] [client 195.86.5.15:60922] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adUcUO9g7q_cV2WhPazebAAAAJM"]
[Tue Apr 07 23:01:37.303152 2026] [:error] [pid 37597:tid 37638] [client 195.86.5.15:20967] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Apr 07 23:01:37.576628 2026] [:error] [pid 37597:tid 37652] [client 195.86.5.15:20967] [client 195.86.5.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.86.5.15, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adUcUQ6uAY0QAy-8EELQvgAAAFI"]
[Tue Apr 07 23:01:38.130949 2026] [:error] [pid 37597:tid 37640] [client 195.86.5.15:20967] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "adUcUg6uAY0QAy-8EELQwAAAAEY"]
[Tue Apr 07 23:01:39.726331 2026] [:error] [pid 59804:tid 59813] [client 195.86.5.15:44534] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 07 23:01:40.256687 2026] [:error] [pid 59804:tid 59822] [client 195.86.5.15:44534] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Tue Apr 07 23:01:40.784897 2026] [:error] [pid 59804:tid 59809] [client 195.86.5.15:44534] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adUcVHYVIXiPh5_eJTn1DQAAAgM"]
[Tue Apr 07 23:01:41.317427 2026] [:error] [pid 37597:tid 37650] [client 195.86.5.15:44540] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 07 23:01:42.120702 2026] [:error] [pid 37597:tid 37651] [client 195.86.5.15:44540] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Tue Apr 07 23:01:42.656617 2026] [:error] [pid 37597:tid 37657] [client 195.86.5.15:44540] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Tue Apr 07 23:01:43.195742 2026] [:error] [pid 37597:tid 37634] [client 195.86.5.15:44540] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Apr 07 23:01:43.459864 2026] [:error] [pid 37597:tid 37637] [client 195.86.5.15:44540] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adUcVw6uAY0QAy-8EELQzAAAAEM"]
[Tue Apr 07 23:01:43.986293 2026] [:error] [pid 37598:tid 37674] [client 195.86.5.15:53614] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Tue Apr 07 23:01:44.252847 2026] [:error] [pid 37598:tid 37672] [client 195.86.5.15:53614] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Apr 07 23:01:44.513782 2026] [:error] [pid 37598:tid 37667] [client 195.86.5.15:53614] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adUcWO9g7q_cV2WhPazedQAAAIY"]
[Tue Apr 07 23:01:45.318186 2026] [:error] [pid 59804:tid 59814] [client 195.86.5.15:53618] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Apr 07 23:01:46.990873 2026] [:error] [pid 59804:tid 59816] [client 195.86.5.15:53618] [client 195.86.5.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.86.5.15, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adUcWnYVIXiPh5_eJTn1GAAAAgo"]
[Tue Apr 07 23:01:47.258919 2026] [:error] [pid 59804:tid 59809] [client 195.86.5.15:53618] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adUcW3YVIXiPh5_eJTn1GQAAAgM"]
[Tue Apr 07 23:01:50.451420 2026] [:error] [pid 37719:tid 37732] [client 195.86.5.15:53626] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Tue Apr 07 23:01:52.044729 2026] [:error] [pid 37719:tid 37724] [client 195.86.5.15:53626] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Apr 07 23:01:52.308020 2026] [:error] [pid 37719:tid 37742] [client 195.86.5.15:53626] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adUcYE09Xv52u2xXGLBdBQAAANQ"]
[Tue Apr 07 23:01:52.839226 2026] [:error] [pid 59804:tid 59810] [client 195.86.5.15:53636] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Apr 07 23:01:54.372285 2026] [:error] [pid 59804:tid 59818] [client 195.86.5.15:53636] [client 195.86.5.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.86.5.15, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adUcYnYVIXiPh5_eJTn1LgAAAgw"]
[Tue Apr 07 23:01:54.643597 2026] [:error] [pid 59804:tid 59821] [client 195.86.5.15:53636] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue Apr 07 23:01:54.911434 2026] [:error] [pid 59804:tid 59819] [client 195.86.5.15:53636] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue Apr 07 23:01:55.179356 2026] [:error] [pid 59804:tid 59822] [client 195.86.5.15:53636] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Tue Apr 07 23:01:55.443107 2026] [:error] [pid 59804:tid 59809] [client 195.86.5.15:53636] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adUcY3YVIXiPh5_eJTn1MgAAAgM"]
[Tue Apr 07 23:01:55.976419 2026] [:error] [pid 37719:tid 37746] [client 195.86.5.15:45012] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Apr 07 23:01:56.243454 2026] [:error] [pid 37719:tid 37741] [client 195.86.5.15:45012] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adUcZE09Xv52u2xXGLBdCwAAANM"]
[Tue Apr 07 23:01:57.082783 2026] [:error] [pid 12948:tid 12959] [client 195.86.5.15:45014] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Apr 07 23:01:57.360833 2026] [:error] [pid 12948:tid 12962] [client 195.86.5.15:45014] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adUcZcbeSPAN8LvMqsbK6wAAAQs"]
[Tue Apr 07 23:01:58.429610 2026] [:error] [pid 59804:tid 59818] [client 195.86.5.15:45026] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue Apr 07 23:01:58.693933 2026] [:error] [pid 59804:tid 59826] [client 195.86.5.15:45026] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adUcZnYVIXiPh5_eJTn1OwAAAhQ"]
[Tue Apr 07 23:01:59.218327 2026] [:error] [pid 37719:tid 37729] [client 195.86.5.15:45038] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adUcZ009Xv52u2xXGLBdEQAAAMc"]
[Tue Apr 07 23:01:59.749791 2026] [:error] [pid 59804:tid 59817] [client 195.86.5.15:45054] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Tue Apr 07 23:02:00.017964 2026] [:error] [pid 59804:tid 59823] [client 195.86.5.15:45054] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Tue Apr 07 23:02:01.094822 2026] [:error] [pid 59804:tid 59811] [client 195.86.5.15:45054] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adUcaXYVIXiPh5_eJTn1RgAAAgU"]
[Tue Apr 07 23:02:01.884137 2026] [:error] [pid 37719:tid 37728] [client 195.86.5.15:45278] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adUcaU09Xv52u2xXGLBdFAAAAMY"]
[Tue Apr 07 23:02:03.205763 2026] [:error] [pid 37598:tid 37679] [client 195.86.5.15:45072] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adUca-9g7q_cV2WhPazefQAAAJI"]
[Tue Apr 07 23:02:03.758789 2026] [:error] [pid 59804:tid 59817] [client 195.86.5.15:45078] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue Apr 07 23:02:04.318864 2026] [:error] [pid 59804:tid 59820] [client 195.86.5.15:45078] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Apr 07 23:02:04.596138 2026] [:error] [pid 59804:tid 59810] [client 195.86.5.15:45078] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adUcbHYVIXiPh5_eJTn1TQAAAgQ"]
[Tue Apr 07 23:02:05.134407 2026] [:error] [pid 59804:tid 59806] [client 195.86.5.15:51044] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Apr 07 23:02:05.673357 2026] [:error] [pid 59804:tid 59826] [client 195.86.5.15:51044] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "adUcbXYVIXiPh5_eJTn1UQAAAhQ"]
[Tue Apr 07 23:02:07.012022 2026] [:error] [pid 37719:tid 37726] [client 195.86.5.15:51054] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adUcb009Xv52u2xXGLBdHAAAAMQ"]
[Tue Apr 07 23:02:09.344511 2026] [:error] [pid 37598:tid 37685] [client 195.86.5.15:51064] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 07 23:02:10.140511 2026] [:error] [pid 37598:tid 37673] [client 195.86.5.15:51064] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue Apr 07 23:02:10.671848 2026] [:error] [pid 37598:tid 37675] [client 195.86.5.15:51064] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 07 23:02:10.933585 2026] [:error] [pid 37598:tid 37682] [client 195.86.5.15:51064] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adUccu9g7q_cV2WhPazehwAAAJU"]
[Tue Apr 07 23:02:11.474709 2026] [:error] [pid 59804:tid 59829] [client 195.86.5.15:51078] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adUcc3YVIXiPh5_eJTn1WgAAAhc"]
[Tue Apr 07 23:02:12.021658 2026] [:error] [pid 59804:tid 59828] [client 195.86.5.15:51086] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adUcdHYVIXiPh5_eJTn1XgAAAhY"]
[Tue Apr 07 23:02:12.571914 2026] [:error] [pid 59804:tid 59808] [client 195.86.5.15:51098] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adUcdHYVIXiPh5_eJTn1YAAAAgI"]
[Tue Apr 07 23:02:13.096307 2026] [:error] [pid 59660:tid 59686] [client 195.86.5.15:15597] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Tue Apr 07 23:02:13.357841 2026] [:error] [pid 59660:tid 59677] [client 195.86.5.15:15597] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adUcdTp3-oiX2o5bTswpvQAAAc8"]
[Tue Apr 07 23:02:13.880056 2026] [:error] [pid 59804:tid 59829] [client 195.86.5.15:38820] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adUcdXYVIXiPh5_eJTn1ZQAAAhc"]
[Tue Apr 07 23:02:14.408120 2026] [:error] [pid 59551:tid 59575] [client 195.86.5.15:38828] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 07 23:02:14.938954 2026] [:error] [pid 59551:tid 59561] [client 195.86.5.15:38828] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adUcdl7LN7Ubyqs-sVs8NgAAAYg"]
[Tue Apr 07 23:02:15.470126 2026] [:error] [pid 59660:tid 59683] [client 195.86.5.15:38838] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adUcdzp3-oiX2o5bTswpvgAAAdU"]
[Tue Apr 07 23:02:15.996751 2026] [:error] [pid 59490:tid 59504] [client 195.86.5.15:38844] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adUcd0cw8OFbiUZ7Rx18cAAAAUw"]
[Tue Apr 07 23:02:16.522457 2026] [:error] [pid 59660:tid 59680] [client 195.86.5.15:38852] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adUceDp3-oiX2o5bTswpvwAAAdI"]
[Tue Apr 07 23:02:17.312380 2026] [:error] [pid 37597:tid 37656] [client 195.86.5.15:38854] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adUceQ6uAY0QAy-8EELQ1QAAAFY"]
[Tue Apr 07 23:02:18.378733 2026] [:error] [pid 59660:tid 59670] [client 195.86.5.15:38862] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adUcejp3-oiX2o5bTswpwwAAAcg"]
[Tue Apr 07 23:02:18.929277 2026] [:error] [pid 59551:tid 59573] [client 195.86.5.15:38868] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Tue Apr 07 23:02:19.760818 2026] [:error] [pid 59551:tid 59569] [client 195.86.5.15:38868] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Tue Apr 07 23:02:20.034452 2026] [:error] [pid 59551:tid 59560] [client 195.86.5.15:38868] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adUcfF7LN7Ubyqs-sVs8PQAAAYc"]
[Tue Apr 07 23:02:20.831378 2026] [:error] [pid 37719:tid 37727] [client 195.86.5.15:38876] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Apr 07 23:02:21.099152 2026] [:error] [pid 37719:tid 37729] [client 195.86.5.15:38876] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Apr 07 23:02:22.435717 2026] [:error] [pid 37719:tid 37741] [client 195.86.5.15:38876] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adUcfk09Xv52u2xXGLBdLgAAANM"]
[Tue Apr 07 23:02:23.757550 2026] [:error] [pid 59490:tid 59512] [client 195.86.5.15:38880] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adUcf0cw8OFbiUZ7Rx18eQAAAVQ"]
[Tue Apr 07 23:02:24.292293 2026] [:error] [pid 37597:tid 37657] [client 195.86.5.15:48072] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adUcgA6uAY0QAy-8EELQ4gAAAFc"]
[Tue Apr 07 23:02:25.890550 2026] [:error] [pid 37719:tid 37723] [client 195.86.5.15:48078] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adUcgU09Xv52u2xXGLBdOQAAAME"]
[Tue Apr 07 23:02:28.372180 2026] [:error] [pid 37597:tid 37641] [client 195.86.5.15:48088] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue Apr 07 23:02:29.802334 2026] [:error] [pid 37597:tid 37641] [client 195.86.5.15:48088] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Tue Apr 07 23:02:30.070292 2026] [:error] [pid 37597:tid 37656] [client 195.86.5.15:48088] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Tue Apr 07 23:02:30.337983 2026] [:error] [pid 37597:tid 37657] [client 195.86.5.15:48088] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Tue Apr 07 23:02:31.679775 2026] [:error] [pid 37597:tid 37648] [client 195.86.5.15:48088] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adUchw6uAY0QAy-8EELQ9AAAAE4"]
[Tue Apr 07 23:02:32.225536 2026] [:error] [pid 59490:tid 59498] [client 195.86.5.15:48104] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adUciEcw8OFbiUZ7Rx18hgAAAUY"]
[Tue Apr 07 23:02:32.756872 2026] [:error] [pid 37597:tid 37651] [client 195.86.5.15:48116] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adUciA6uAY0QAy-8EELQ_AAAAFE"]
[Tue Apr 07 23:02:33.288821 2026] [:error] [pid 37719:tid 37735] [client 195.86.5.15:48128] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adUciU09Xv52u2xXGLBdPAAAAM0"]
[Tue Apr 07 23:02:33.816782 2026] [:error] [pid 37597:tid 37638] [client 195.86.5.15:48142] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adUciQ6uAY0QAy-8EELQ_gAAAEQ"]
[Tue Apr 07 23:02:34.345780 2026] [:error] [pid 37598:tid 37672] [client 195.86.5.15:52312] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adUciu9g7q_cV2WhPazejQAAAIs"]
[Tue Apr 07 23:02:35.146707 2026] [:error] [pid 37719:tid 37732] [client 195.86.5.15:52318] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adUci009Xv52u2xXGLBdQgAAAMo"]
[Tue Apr 07 23:02:35.688147 2026] [:error] [pid 59551:tid 59553] [client 195.86.5.15:52330] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adUci17LN7Ubyqs-sVs8QwAAAYA"]
[Tue Apr 07 23:02:36.213722 2026] [:error] [pid 59551:tid 59562] [client 195.86.5.15:52332] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adUcjF7LN7Ubyqs-sVs8RAAAAYk"]
[Tue Apr 07 23:02:36.746521 2026] [:error] [pid 59551:tid 59554] [client 195.86.5.15:52340] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adUcjF7LN7Ubyqs-sVs8RQAAAYE"]
[Tue Apr 07 23:02:37.817700 2026] [:error] [pid 37596:tid 37606] [client 195.86.5.15:52350] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adUcjapaAOZHEjRWjP2tMgAAAAA"]
[Tue Apr 07 23:02:38.622982 2026] [:error] [pid 59490:tid 59516] [client 195.86.5.15:52364] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adUcjkcw8OFbiUZ7Rx18jgAAAVg"]
[Tue Apr 07 23:02:39.156538 2026] [:error] [pid 59660:tid 59672] [client 195.86.5.15:52376] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Apr 07 23:02:39.687452 2026] [:error] [pid 59660:tid 59671] [client 195.86.5.15:52376] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adUcjzp3-oiX2o5bTswpzQAAAck"]
[Tue Apr 07 23:02:40.791621 2026] [:error] [pid 59804:tid 59823] [client 195.86.5.15:62702] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "adUckHYVIXiPh5_eJTn1eAAAAhE"]
[Tue Apr 07 23:02:41.904665 2026] [:error] [pid 37719:tid 37746] [client 195.86.5.15:52396] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Apr 07 23:02:42.173674 2026] [:error] [pid 37719:tid 37745] [client 195.86.5.15:52396] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adUckk09Xv52u2xXGLBdSQAAANc"]
[Tue Apr 07 23:02:42.977155 2026] [:error] [pid 37596:tid 37608] [client 195.86.5.15:52402] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Apr 07 23:02:43.246333 2026] [:error] [pid 37596:tid 37619] [client 195.86.5.15:52402] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Tue Apr 07 23:02:43.514411 2026] [:error] [pid 37596:tid 37609] [client 195.86.5.15:52402] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Apr 07 23:02:43.778682 2026] [:error] [pid 37596:tid 37617] [client 195.86.5.15:52402] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adUck6paAOZHEjRWjP2tNwAAAAs"]
[Tue Apr 07 23:02:44.310523 2026] [:error] [pid 12948:tid 12952] [client 195.86.5.15:34904] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue Apr 07 23:02:44.577549 2026] [:error] [pid 12948:tid 12974] [client 195.86.5.15:34904] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adUclMbeSPAN8LvMqsbLAAAAARc"]
[Tue Apr 07 23:02:45.694730 2026] [:error] [pid 59551:tid 59567] [client 195.86.5.15:34918] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Apr 07 23:02:45.974937 2026] [:error] [pid 59551:tid 59575] [client 195.86.5.15:34918] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Apr 07 23:02:46.255563 2026] [:error] [pid 59551:tid 59577] [client 195.86.5.15:34918] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Tue Apr 07 23:02:47.656376 2026] [:error] [pid 59551:tid 59566] [client 195.86.5.15:34918] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 07 23:02:47.935630 2026] [:error] [pid 59551:tid 59564] [client 195.86.5.15:34918] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Tue Apr 07 23:02:48.499309 2026] [:error] [pid 59551:tid 59557] [client 195.86.5.15:34918] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Tue Apr 07 23:02:49.341648 2026] [:error] [pid 59551:tid 59560] [client 195.86.5.15:34918] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Apr 07 23:02:49.617826 2026] [:error] [pid 59551:tid 59575] [client 195.86.5.15:34918] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adUcmV7LN7Ubyqs-sVs8ZgAAAZY"]
[Tue Apr 07 23:02:50.142868 2026] [:error] [pid 59551:tid 59555] [client 195.86.5.15:34934] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adUcml7LN7Ubyqs-sVs8aQAAAYI"]
[Tue Apr 07 23:02:50.676649 2026] [:error] [pid 59551:tid 59566] [client 195.86.5.15:34942] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Tue Apr 07 23:02:50.944687 2026] [:error] [pid 59551:tid 59564] [client 195.86.5.15:34942] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adUcml7LN7Ubyqs-sVs8awAAAYs"]
[Tue Apr 07 23:02:51.746504 2026] [:error] [pid 59660:tid 59677] [client 195.86.5.15:34948] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Apr 07 23:02:52.010544 2026] [:error] [pid 59660:tid 59669] [client 195.86.5.15:34948] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adUcnDp3-oiX2o5bTswp1gAAAcc"]
[Tue Apr 07 23:02:52.553918 2026] [:error] [pid 59660:tid 59663] [client 195.86.5.15:34950] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adUcnDp3-oiX2o5bTswp2AAAAcE"]
[Tue Apr 07 23:02:54.142457 2026] [:error] [pid 37719:tid 37730] [client 195.86.5.15:34954] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adUcnk09Xv52u2xXGLBdVgAAAMg"]
[Tue Apr 07 23:02:54.664402 2026] [:error] [pid 37597:tid 37657] [client 195.86.5.15:41006] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "adUcng6uAY0QAy-8EELREQAAAFc"]
[Tue Apr 07 23:02:57.478417 2026] [:error] [pid 59551:tid 59555] [client 195.86.5.15:41012] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Apr 07 23:02:58.004100 2026] [:error] [pid 59551:tid 59558] [client 195.86.5.15:41012] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adUcol7LN7Ubyqs-sVs8cwAAAYU"]
[Tue Apr 07 23:02:58.821630 2026] [:error] [pid 37598:tid 37683] [client 195.86.5.15:41018] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Tue Apr 07 23:02:59.367087 2026] [:error] [pid 37598:tid 37665] [client 195.86.5.15:41018] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/function.php"] [unique_id "adUco-9g7q_cV2WhPazeoAAAAIQ"]
[Tue Apr 07 23:02:59.894250 2026] [:error] [pid 59660:tid 59681] [client 195.86.5.15:41024] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "adUcozp3-oiX2o5bTswp2wAAAdM"]
[Tue Apr 07 23:03:00.703745 2026] [:error] [pid 37598:tid 37669] [client 195.86.5.15:41040] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Tue Apr 07 23:03:00.970676 2026] [:error] [pid 37598:tid 37678] [client 195.86.5.15:41040] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adUcpO9g7q_cV2WhPazeowAAAJE"]
[Tue Apr 07 23:03:01.501813 2026] [:error] [pid 12948:tid 12965] [client 195.86.5.15:41044] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adUcpcbeSPAN8LvMqsbLBQAAAQ4"]
[Tue Apr 07 23:03:02.610541 2026] [:error] [pid 12948:tid 12964] [client 195.86.5.15:41046] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Tue Apr 07 23:03:02.887028 2026] [:error] [pid 12948:tid 12955] [client 195.86.5.15:41046] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Tue Apr 07 23:03:03.442300 2026] [:error] [pid 12948:tid 12967] [client 195.86.5.15:41046] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Tue Apr 07 23:03:03.998047 2026] [:error] [pid 12948:tid 12970] [client 195.86.5.15:41046] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adUcp8beSPAN8LvMqsbLDwAAARM"]
[Tue Apr 07 23:03:04.540013 2026] [:error] [pid 59490:tid 59508] [client 195.86.5.15:36808] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adUcqEcw8OFbiUZ7Rx18kgAAAVA"]
[Tue Apr 07 23:03:05.988162 2026] [:error] [pid 59551:tid 59575] [client 195.86.5.15:36814] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 07 23:03:07.439002 2026] [:error] [pid 59551:tid 59575] [client 195.86.5.15:36814] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/index.php"] [unique_id "adUcq17LN7Ubyqs-sVs8hAAAAZY"]
[Tue Apr 07 23:03:07.987164 2026] [:error] [pid 37598:tid 37674] [client 195.86.5.15:36826] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adUcq-9g7q_cV2WhPazeqQAAAI0"]
[Tue Apr 07 23:03:08.520086 2026] [:error] [pid 59551:tid 59564] [client 195.86.5.15:36834] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adUcrF7LN7Ubyqs-sVs8iAAAAYs"]
[Tue Apr 07 23:03:10.121381 2026] [:error] [pid 37598:tid 37671] [client 195.86.5.15:36836] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Tue Apr 07 23:03:10.385836 2026] [:error] [pid 37598:tid 37662] [client 195.86.5.15:36836] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adUcru9g7q_cV2WhPazesgAAAIE"]
[Tue Apr 07 23:03:11.190169 2026] [:error] [pid 59804:tid 59820] [client 195.86.5.15:36850] [client 195.86.5.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adUcr3YVIXiPh5_eJTn1qgAAAg4"]
[Tue Apr 07 23:03:11.722872 2026] [:error] [pid 59804:tid 59806] [client 195.86.5.15:36854] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 07 23:03:11.990477 2026] [:error] [pid 59804:tid 59818] [client 195.86.5.15:36854] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Apr 07 23:03:13.684327 2026] [:error] [pid 59804:tid 59811] [client 195.86.5.15:36854] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Tue Apr 07 23:03:14.752276 2026] [:error] [pid 59804:tid 59808] [client 195.86.5.15:36854] [client 195.86.5.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.86.5.15, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/wp-login.php"] [unique_id "adUcsnYVIXiPh5_eJTn1tAAAAgI"]
[Tue Apr 07 23:03:15.293138 2026] [:error] [pid 59804:tid 59812] [client 195.86.5.15:36854] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Tue Apr 07 23:03:15.560922 2026] [:error] [pid 59804:tid 59819] [client 195.86.5.15:36854] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Tue Apr 07 23:03:15.827539 2026] [:error] [pid 59804:tid 59823] [client 195.86.5.15:36854] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Tue Apr 07 23:03:16.359728 2026] [:error] [pid 59804:tid 59810] [client 195.86.5.15:36854] [client 195.86.5.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.86.5.15, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adUctHYVIXiPh5_eJTn1ugAAAgQ"]
[Tue Apr 07 23:03:17.164866 2026] [:error] [pid 59804:tid 59829] [client 195.86.5.15:36854] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Apr 07 23:03:17.429786 2026] [:error] [pid 59804:tid 59815] [client 195.86.5.15:36854] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "adUctXYVIXiPh5_eJTn1vgAAAgk"]
[Tue Apr 07 23:03:17.952079 2026] [:error] [pid 59804:tid 59820] [client 195.86.5.15:42298] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "adUctXYVIXiPh5_eJTn1wAAAAg4"]
[Tue Apr 07 23:03:18.481424 2026] [:error] [pid 59660:tid 59670] [client 195.86.5.15:42314] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "adUctjp3-oiX2o5bTswp5AAAAcg"]
[Tue Apr 07 23:03:19.011459 2026] [:error] [pid 59660:tid 59664] [client 195.86.5.15:42322] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "adUctzp3-oiX2o5bTswp5QAAAcI"]
[Tue Apr 07 23:03:19.541706 2026] [:error] [pid 37719:tid 37733] [client 195.86.5.15:42338] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin.php"] [unique_id "adUct009Xv52u2xXGLBdYQAAAMs"]
[Tue Apr 07 23:03:21.680454 2026] [:error] [pid 37598:tid 37678] [client 195.86.5.15:42350] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/"] [unique_id "adUcue9g7q_cV2WhPazewQAAAJE"]
[Tue Apr 07 23:03:22.204083 2026] [:error] [pid 37719:tid 37723] [client 195.86.5.15:42354] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/"] [unique_id "adUcuk09Xv52u2xXGLBdZAAAAME"]
[Tue Apr 07 23:03:22.735303 2026] [:error] [pid 37597:tid 37635] [client 195.86.5.15:42358] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/"] [unique_id "adUcug6uAY0QAy-8EELRLgAAAEE"]
[Tue Apr 07 23:03:23.262642 2026] [:error] [pid 37597:tid 37657] [client 195.86.5.15:42362] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/"] [unique_id "adUcuw6uAY0QAy-8EELRLwAAAFc"]
[Tue Apr 07 23:03:23.784425 2026] [:error] [pid 37719:tid 37736] [client 195.86.5.15:42378] [client 195.86.5.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/"] [unique_id "adUcu009Xv52u2xXGLBdZQAAAM4"]
[Wed Apr 08 06:01:41.865812 2026] [:error] [pid 47732:tid 47741] [client 68.221.128.217:50862] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Wed Apr 08 06:01:42.113500 2026] [:error] [pid 47732:tid 47748] [client 68.221.128.217:50862] File does not exist: /usr/local/apache/htdocs/suspended-page/bogles.php
[Wed Apr 08 06:01:42.600070 2026] [:error] [pid 47732:tid 47743] [client 68.221.128.217:50862] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed Apr 08 06:01:42.843804 2026] [:error] [pid 47732:tid 47735] [client 68.221.128.217:50862] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Wed Apr 08 06:01:43.086196 2026] [:error] [pid 47732:tid 47757] [client 68.221.128.217:50862] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Wed Apr 08 06:01:43.571509 2026] [:error] [pid 47732:tid 47758] [client 68.221.128.217:50862] File does not exist: /usr/local/apache/htdocs/suspended-page/x123.php
[Wed Apr 08 06:01:43.814650 2026] [:error] [pid 47732:tid 47734] [client 68.221.128.217:50862] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 08:40:41.305575 2026] [:error] [pid 47626:tid 47671] [client 20.203.160.85:15335] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Wed Apr 08 08:40:41.544105 2026] [:error] [pid 47626:tid 47678] [client 20.203.160.85:15335] File does not exist: /usr/local/apache/htdocs/suspended-page/bogles.php
[Wed Apr 08 08:40:42.020957 2026] [:error] [pid 47626:tid 47688] [client 20.203.160.85:15335] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed Apr 08 08:40:42.259695 2026] [:error] [pid 47626:tid 47686] [client 20.203.160.85:15335] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Wed Apr 08 08:40:42.498422 2026] [:error] [pid 47626:tid 47684] [client 20.203.160.85:15335] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Wed Apr 08 08:40:42.978740 2026] [:error] [pid 47626:tid 47670] [client 20.203.160.85:15335] File does not exist: /usr/local/apache/htdocs/suspended-page/x123.php
[Wed Apr 08 08:40:43.216651 2026] [:error] [pid 47626:tid 47687] [client 20.203.160.85:15335] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 17:58:16.777468 2026] [:error] [pid 35642:tid 35652] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Apr 08 17:58:17.068403 2026] [:error] [pid 35642:tid 35656] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Apr 08 17:58:17.401572 2026] [:error] [pid 35642:tid 35668] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Apr 08 17:58:17.699392 2026] [:error] [pid 35642:tid 35650] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Apr 08 17:58:17.980200 2026] [:error] [pid 35642:tid 35655] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 08 17:58:18.260478 2026] [:error] [pid 35642:tid 35645] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Apr 08 17:58:18.531660 2026] [:error] [pid 35642:tid 35646] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 08 17:58:18.816163 2026] [:error] [pid 35642:tid 35667] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Apr 08 17:58:19.489891 2026] [:error] [pid 35642:tid 35662] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Apr 08 17:58:19.833826 2026] [:error] [pid 35642:tid 35659] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Apr 08 17:58:20.123485 2026] [:error] [pid 35642:tid 35665] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 17:58:20.429228 2026] [:error] [pid 35642:tid 35658] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Apr 08 17:58:20.950717 2026] [:error] [pid 35642:tid 35656] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Apr 08 17:58:21.253081 2026] [:error] [pid 35642:tid 35666] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Apr 08 17:58:21.531641 2026] [:error] [pid 35642:tid 35646] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Apr 08 17:58:21.917443 2026] [:error] [pid 35642:tid 35665] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 08 17:58:22.234721 2026] [:error] [pid 35642:tid 35660] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Apr 08 17:58:22.510343 2026] [:error] [pid 35642:tid 35658] [client 91.217.249.12:20977] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 08 17:58:29.576721 2026] [:error] [pid 35642:tid 35667] [client 91.217.249.12:20977] [client 91.217.249.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adYmxQ-CqryxdEs5DN8e_AAAAFc"]
[Wed Apr 08 17:58:31.695490 2026] [:error] [pid 12490:tid 12499] [client 91.217.249.11:62693] [client 91.217.249.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adYmx21Fea4F4fbumr23qAAAAMc"]
[Wed Apr 08 17:58:34.006736 2026] [:error] [pid 12386:tid 12419] [client 45.86.202.235:63215] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Apr 08 17:58:34.889165 2026] [:error] [pid 12386:tid 12437] [client 45.86.202.235:63215] [client 45.86.202.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adYmyhLhhLtqHi2gK7XoZAAAARU"]
[Wed Apr 08 17:58:36.477483 2026] [:error] [pid 12490:tid 12510] [client 91.217.249.14:30473] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Apr 08 17:58:36.744910 2026] [:error] [pid 12490:tid 12511] [client 91.217.249.14:30473] [client 91.217.249.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adYmzG1Fea4F4fbumr231wAAANM"]
[Wed Apr 08 17:58:38.167172 2026] [:error] [pid 12453:tid 12478] [client 45.86.202.211:35809] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Apr 08 17:58:39.584510 2026] [:error] [pid 12453:tid 12460] [client 45.86.202.211:35809] [client 45.86.202.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adYmzxjtW7S6XsLPvrTIZQAAAIU"]
[Wed Apr 08 17:58:40.999403 2026] [:error] [pid 12490:tid 12501] [client 91.217.249.11:47777] [client 91.217.249.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adYm0G1Fea4F4fbumr238gAAAMk"]
[Wed Apr 08 17:58:42.071967 2026] [:error] [pid 12490:tid 12502] [client 91.217.249.2:23371] [client 91.217.249.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adYm0m1Fea4F4fbumr23_wAAAMo"]
[Wed Apr 08 17:58:43.201806 2026] [:error] [pid 12490:tid 12499] [client 91.217.249.24:51755] [client 91.217.249.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adYm021Fea4F4fbumr24EQAAAMc"]
[Wed Apr 08 17:58:44.330614 2026] [:error] [pid 35642:tid 35664] [client 45.86.202.237:41115] [client 45.86.202.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adYm1A-CqryxdEs5DN8fSAAAAFQ"]
[Wed Apr 08 17:58:45.377528 2026] [:error] [pid 12490:tid 12496] [client 91.217.249.8:24547] [client 91.217.249.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adYm1W1Fea4F4fbumr24JgAAAMQ"]
[Wed Apr 08 17:58:46.809064 2026] [:error] [pid 12453:tid 12472] [client 91.217.249.21:29505] [client 91.217.249.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adYm1hjtW7S6XsLPvrTIiQAAAJE"]
[Wed Apr 08 17:58:48.073604 2026] [:error] [pid 35642:tid 35658] [client 45.86.202.229:38977] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Apr 08 17:58:48.686624 2026] [:error] [pid 35642:tid 35660] [client 45.86.202.229:38977] [client 45.86.202.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "adYm2A-CqryxdEs5DN8fXQAAAFA"]
[Wed Apr 08 17:58:50.471170 2026] [:error] [pid 12490:tid 12501] [client 91.217.249.22:37359] [client 91.217.249.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adYm2m1Fea4F4fbumr24MwAAAMk"]
[Wed Apr 08 17:58:51.812395 2026] [:error] [pid 12490:tid 12493] [client 45.86.202.243:21429] [client 45.86.202.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adYm221Fea4F4fbumr24NgAAAME"]
[Wed Apr 08 17:58:52.919590 2026] [:error] [pid 12490:tid 12502] [client 45.86.202.247:25855] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Apr 08 17:58:54.186773 2026] [:error] [pid 12490:tid 12502] [client 45.86.202.247:25855] [client 45.86.202.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adYm3m1Fea4F4fbumr24RQAAAMo"]
[Wed Apr 08 17:58:56.060538 2026] [:error] [pid 35642:tid 35659] [client 45.86.202.231:28923] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Apr 08 17:58:56.870661 2026] [:error] [pid 35642:tid 35661] [client 45.86.202.231:28923] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Apr 08 17:58:57.843820 2026] [:error] [pid 35642:tid 35668] [client 45.86.202.231:28923] [client 45.86.202.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adYm4Q-CqryxdEs5DN8flAAAAFg"]
[Wed Apr 08 17:58:58.911814 2026] [:error] [pid 12385:tid 12390] [client 91.217.249.18:49011] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Apr 08 17:58:59.175942 2026] [:error] [pid 12385:tid 12396] [client 91.217.249.18:49011] [client 91.217.249.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adYm4yAjtvRQEkLosq12xAAAAAc"]
[Wed Apr 08 17:59:00.127171 2026] [:error] [pid 12490:tid 12504] [client 91.217.249.25:25341] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Apr 08 17:59:00.843531 2026] [:error] [pid 12490:tid 12492] [client 91.217.249.25:25341] [client 91.217.249.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adYm5G1Fea4F4fbumr24cgAAAMA"]
[Wed Apr 08 17:59:01.844454 2026] [:error] [pid 12385:tid 12394] [client 91.217.249.5:27279] [client 91.217.249.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adYm5SAjtvRQEkLosq12yAAAAAU"]
[Wed Apr 08 17:59:03.870437 2026] [:error] [pid 12385:tid 12395] [client 45.86.202.230:41789] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Apr 08 17:59:04.138030 2026] [:error] [pid 12385:tid 12405] [client 45.86.202.230:41789] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Apr 08 17:59:04.676673 2026] [:error] [pid 12385:tid 12404] [client 45.86.202.230:41789] [client 45.86.202.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adYm6CAjtvRQEkLosq123wAAAA8"]
[Wed Apr 08 17:59:06.012555 2026] [:error] [pid 35642:tid 35653] [client 91.217.249.5:23963] [client 91.217.249.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adYm6g-CqryxdEs5DN8fwgAAAEk"]
[Wed Apr 08 17:59:07.274823 2026] [:error] [pid 35642:tid 35660] [client 45.86.202.249:43133] [client 45.86.202.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adYm6w-CqryxdEs5DN8fyQAAAFA"]
[Wed Apr 08 17:59:08.358792 2026] [:error] [pid 12490:tid 12512] [client 45.86.202.211:31057] [client 45.86.202.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adYm7G1Fea4F4fbumr24vQAAANQ"]
[Wed Apr 08 17:59:09.460032 2026] [:error] [pid 12385:tid 12393] [client 91.217.249.14:31381] [client 91.217.249.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adYm7SAjtvRQEkLosq126QAAAAQ"]
[Wed Apr 08 17:59:10.775822 2026] [:error] [pid 35642:tid 35666] [client 45.86.202.233:40727] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Apr 08 17:59:11.043183 2026] [:error] [pid 35642:tid 35653] [client 45.86.202.233:40727] [client 45.86.202.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adYm7w-CqryxdEs5DN8f4AAAAEk"]
[Wed Apr 08 17:59:12.146402 2026] [:error] [pid 12386:tid 12416] [client 91.217.249.2:37593] [client 91.217.249.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adYm8BLhhLtqHi2gK7Xo7QAAAQA"]
[Wed Apr 08 17:59:13.069927 2026] [:error] [pid 12490:tid 12501] [client 91.217.249.21:28987] [client 91.217.249.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adYm8W1Fea4F4fbumr247QAAAMk"]
[Wed Apr 08 17:59:14.542105 2026] [:error] [pid 35642:tid 35657] [client 45.86.202.240:26815] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Apr 08 17:59:15.108669 2026] [:error] [pid 35642:tid 35656] [client 45.86.202.240:26815] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Apr 08 17:59:16.345984 2026] [:error] [pid 35642:tid 35666] [client 45.86.202.240:26815] [client 45.86.202.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adYm9A-CqryxdEs5DN8f_wAAAFY"]
[Wed Apr 08 17:59:19.437578 2026] [:error] [pid 35642:tid 35660] [client 45.86.202.231:57517] [client 45.86.202.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.231, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adYm9w-CqryxdEs5DN8gFgAAAFA"]
[Wed Apr 08 17:59:19.712558 2026] [:error] [pid 35642:tid 35662] [client 45.86.202.231:57517] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Apr 08 17:59:21.132805 2026] [:error] [pid 35642:tid 35660] [client 45.86.202.231:57517] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Apr 08 17:59:21.414220 2026] [:error] [pid 35642:tid 35656] [client 45.86.202.231:57517] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Apr 08 17:59:22.851731 2026] [:error] [pid 35642:tid 35644] [client 45.86.202.231:57517] [client 45.86.202.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adYm-g-CqryxdEs5DN8gNQAAAEA"]
[Wed Apr 08 17:59:24.242179 2026] [:error] [pid 12386:tid 12422] [client 91.217.249.5:48871] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Apr 08 17:59:24.519162 2026] [:error] [pid 12386:tid 12427] [client 91.217.249.5:48871] [client 91.217.249.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.5, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adYm_BLhhLtqHi2gK7XpHAAAAQs"]
[Wed Apr 08 17:59:25.066763 2026] [:error] [pid 12386:tid 12424] [client 91.217.249.5:48871] [client 91.217.249.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "adYm_RLhhLtqHi2gK7XpJwAAAQg"]
[Wed Apr 08 17:59:27.157083 2026] [:error] [pid 12385:tid 12398] [client 91.217.249.11:26989] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Apr 08 17:59:27.779130 2026] [:error] [pid 12385:tid 12410] [client 91.217.249.11:26989] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Wed Apr 08 17:59:28.334150 2026] [:error] [pid 12385:tid 12412] [client 91.217.249.11:26989] [client 91.217.249.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adYnACAjtvRQEkLosq13NQAAABc"]
[Wed Apr 08 17:59:29.431393 2026] [:error] [pid 35642:tid 35658] [client 45.86.202.239:42149] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 08 17:59:30.513470 2026] [:error] [pid 35642:tid 35663] [client 45.86.202.239:42149] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Apr 08 17:59:31.160918 2026] [:error] [pid 35642:tid 35657] [client 45.86.202.239:42149] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Apr 08 17:59:31.973545 2026] [:error] [pid 35642:tid 35656] [client 45.86.202.239:42149] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Apr 08 17:59:32.260569 2026] [:error] [pid 35642:tid 35648] [client 45.86.202.239:42149] [client 45.86.202.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adYnBA-CqryxdEs5DN8gbQAAAEQ"]
[Wed Apr 08 17:59:33.368616 2026] [:error] [pid 12453:tid 12478] [client 91.217.249.2:32095] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Apr 08 17:59:33.674685 2026] [:error] [pid 12453:tid 12459] [client 91.217.249.2:32095] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Apr 08 17:59:33.975519 2026] [:error] [pid 12453:tid 12466] [client 91.217.249.2:32095] [client 91.217.249.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adYnBRjtW7S6XsLPvrTJYgAAAIs"]
[Wed Apr 08 17:59:35.362574 2026] [:error] [pid 12385:tid 12405] [client 91.217.249.13:29049] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Apr 08 17:59:35.959888 2026] [:error] [pid 12385:tid 12389] [client 91.217.249.13:29049] [client 91.217.249.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.13, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adYnByAjtvRQEkLosq13ZgAAAAA"]
[Wed Apr 08 17:59:36.237888 2026] [:error] [pid 12385:tid 12402] [client 91.217.249.13:29049] [client 91.217.249.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adYnCCAjtvRQEkLosq13agAAAA0"]
[Wed Apr 08 17:59:40.258687 2026] [:error] [pid 12453:tid 12467] [client 45.86.202.210:43193] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Apr 08 17:59:41.904491 2026] [:error] [pid 12453:tid 12472] [client 45.86.202.210:43193] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Apr 08 17:59:42.177985 2026] [:error] [pid 12453:tid 12473] [client 45.86.202.210:43193] [client 45.86.202.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adYnDhjtW7S6XsLPvrTJmQAAAJI"]
[Wed Apr 08 17:59:43.177817 2026] [:error] [pid 12490:tid 12504] [client 91.217.249.9:37917] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Apr 08 17:59:44.042704 2026] [:error] [pid 12490:tid 12504] [client 91.217.249.9:37917] [client 91.217.249.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.9, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adYnEG1Fea4F4fbumr253AAAAMw"]
[Wed Apr 08 17:59:44.323060 2026] [:error] [pid 12490:tid 12495] [client 91.217.249.9:37917] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Apr 08 17:59:44.606483 2026] [:error] [pid 12490:tid 12513] [client 91.217.249.9:37917] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Apr 08 17:59:44.886373 2026] [:error] [pid 12490:tid 12503] [client 91.217.249.9:37917] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Apr 08 17:59:45.172359 2026] [:error] [pid 12490:tid 12493] [client 91.217.249.9:37917] [client 91.217.249.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adYnEW1Fea4F4fbumr258gAAAME"]
[Wed Apr 08 17:59:46.098685 2026] [:error] [pid 12490:tid 12499] [client 45.86.202.238:59721] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Apr 08 17:59:46.363308 2026] [:error] [pid 12490:tid 12498] [client 45.86.202.238:59721] [client 45.86.202.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adYnEm1Fea4F4fbumr26BQAAAMY"]
[Wed Apr 08 17:59:47.448070 2026] [:error] [pid 12490:tid 12501] [client 45.86.202.251:43571] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Apr 08 17:59:47.715427 2026] [:error] [pid 12490:tid 12509] [client 45.86.202.251:43571] [client 45.86.202.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adYnE21Fea4F4fbumr26GQAAANE"]
[Wed Apr 08 17:59:49.190090 2026] [:error] [pid 12490:tid 12495] [client 91.217.249.25:30761] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Apr 08 17:59:49.463249 2026] [:error] [pid 12490:tid 12510] [client 91.217.249.25:30761] [client 91.217.249.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adYnFW1Fea4F4fbumr26LQAAANI"]
[Wed Apr 08 17:59:50.100902 2026] [:error] [pid 12385:tid 12389] [client 91.217.249.26:39213] [client 91.217.249.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adYnFiAjtvRQEkLosq13lAAAAAA"]
[Wed Apr 08 17:59:50.645105 2026] [:error] [pid 35642:tid 35656] [client 91.217.249.5:23319] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Apr 08 17:59:50.934586 2026] [:error] [pid 35642:tid 35648] [client 91.217.249.5:23319] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Wed Apr 08 17:59:52.086608 2026] [:error] [pid 35642:tid 35651] [client 91.217.249.5:23319] [client 91.217.249.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adYnGA-CqryxdEs5DN8gxQAAAEc"]
[Wed Apr 08 17:59:53.178602 2026] [:error] [pid 12453:tid 12467] [client 91.217.249.15:47139] [client 91.217.249.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adYnGRjtW7S6XsLPvrTJuQAAAIw"]
[Wed Apr 08 17:59:55.099845 2026] [:error] [pid 12453:tid 12469] [client 45.86.202.246:36777] [client 45.86.202.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adYnGxjtW7S6XsLPvrTJvwAAAI4"]
[Wed Apr 08 17:59:56.084559 2026] [:error] [pid 12453:tid 12477] [client 45.86.202.210:24293] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Wed Apr 08 17:59:56.641129 2026] [:error] [pid 12453:tid 12463] [client 45.86.202.210:24293] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Apr 08 17:59:56.941164 2026] [:error] [pid 12453:tid 12467] [client 45.86.202.210:24293] [client 45.86.202.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adYnHBjtW7S6XsLPvrTJzAAAAIw"]
[Wed Apr 08 17:59:57.749127 2026] [:error] [pid 12385:tid 12401] [client 91.217.249.14:31619] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Apr 08 17:59:58.425740 2026] [:error] [pid 12385:tid 12412] [client 91.217.249.14:31619] [client 91.217.249.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "adYnHiAjtvRQEkLosq13oQAAABc"]
[Wed Apr 08 17:59:59.902857 2026] [:error] [pid 12453:tid 12472] [client 45.86.202.251:40507] [client 45.86.202.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adYnHxjtW7S6XsLPvrTJ2QAAAJE"]
[Wed Apr 08 18:00:01.567965 2026] [:error] [pid 12386:tid 12426] [client 91.217.249.21:59039] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Apr 08 18:00:02.612902 2026] [:error] [pid 12386:tid 12416] [client 91.217.249.21:59039] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Wed Apr 08 18:00:03.198951 2026] [:error] [pid 12386:tid 12433] [client 91.217.249.21:59039] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Apr 08 18:00:03.650702 2026] [:error] [pid 12386:tid 12431] [client 91.217.249.21:59039] [client 91.217.249.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adYnIxLhhLtqHi2gK7XpqgAAAQ8"]
[Wed Apr 08 18:00:04.427659 2026] [:error] [pid 12490:tid 12504] [client 91.217.249.11:44243] [client 91.217.249.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adYnJG1Fea4F4fbumr26bAAAAMw"]
[Wed Apr 08 18:00:06.301466 2026] [:error] [pid 12453:tid 12467] [client 45.86.202.247:25003] [client 45.86.202.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adYnJhjtW7S6XsLPvrTJ7gAAAIw"]
[Wed Apr 08 18:00:07.162059 2026] [:error] [pid 12490:tid 12492] [client 45.86.202.248:43145] [client 45.86.202.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adYnJ21Fea4F4fbumr26lAAAAMA"]
[Wed Apr 08 18:00:08.069977 2026] [:error] [pid 12386:tid 12424] [client 45.86.202.234:30143] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Wed Apr 08 18:00:08.346083 2026] [:error] [pid 12386:tid 12433] [client 45.86.202.234:30143] [client 45.86.202.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adYnKBLhhLtqHi2gK7XptAAAARE"]
[Wed Apr 08 18:00:09.281052 2026] [:error] [pid 12453:tid 12462] [client 45.86.202.247:54897] [client 45.86.202.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adYnKRjtW7S6XsLPvrTJ_gAAAIc"]
[Wed Apr 08 18:00:10.119359 2026] [:error] [pid 12490:tid 12508] [client 45.86.202.231:26331] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Apr 08 18:00:10.665474 2026] [:error] [pid 12490:tid 12493] [client 45.86.202.231:26331] [client 45.86.202.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adYnKm1Fea4F4fbumr26wwAAAME"]
[Wed Apr 08 18:00:47.384289 2026] [autoindex:error] [pid 12385:tid 12411] [client 91.217.249.1:34241] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 07:50:04.936478 2026] [:error] [pid 20536:tid 20580] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Apr 09 07:50:05.397590 2026] [:error] [pid 20536:tid 20582] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Apr 09 07:50:05.858915 2026] [:error] [pid 20536:tid 20585] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 09 07:50:06.337128 2026] [:error] [pid 20536:tid 20575] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Apr 09 07:50:06.794321 2026] [:error] [pid 20536:tid 20590] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 09 07:50:07.257243 2026] [:error] [pid 20536:tid 20583] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 09 07:50:07.723931 2026] [:error] [pid 20536:tid 20586] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 09 07:50:08.183018 2026] [:error] [pid 20536:tid 20595] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Apr 09 07:50:09.127633 2026] [:error] [pid 20536:tid 20573] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Apr 09 07:50:09.585276 2026] [:error] [pid 20536:tid 20587] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Apr 09 07:50:10.063785 2026] [:error] [pid 20536:tid 20576] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 09 07:50:10.536344 2026] [:error] [pid 20536:tid 20592] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Apr 09 07:50:10.997958 2026] [:error] [pid 20536:tid 20591] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 09 07:50:12.925871 2026] [:error] [pid 20536:tid 20591] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Apr 09 07:50:13.386402 2026] [:error] [pid 20536:tid 20581] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Apr 09 07:50:13.843606 2026] [:error] [pid 20536:tid 20580] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 09 07:50:14.317404 2026] [:error] [pid 20536:tid 20572] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 09 07:50:14.785965 2026] [:error] [pid 20536:tid 20573] [client 192.253.209.118:44777] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Apr 09 07:50:21.277432 2026] [:error] [pid 20536:tid 20588] [client 192.253.209.118:44777] [client 192.253.209.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adbpvcPqyUJM1s3YpIZFKgAAAFE"]
[Thu Apr 09 07:50:24.649851 2026] [:error] [pid 22627:tid 22646] [client 192.253.209.130:36763] [client 192.253.209.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adbpwPr8glsF_jKQpr5iRwAAARA"]
[Thu Apr 09 07:50:27.006438 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.120:24271] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 09 07:50:28.412566 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.120:24271] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adbpxAWiD9hWnEUHWdNrTwAAAAo"]
[Thu Apr 09 07:50:30.289541 2026] [:error] [pid 20536:tid 20590] [client 192.253.209.127:50765] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 09 07:50:30.770126 2026] [:error] [pid 20536:tid 20595] [client 192.253.209.127:50765] [client 192.253.209.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adbpxsPqyUJM1s3YpIZFNQAAAFg"]
[Thu Apr 09 07:50:32.181404 2026] [:error] [pid 20641:tid 20665] [client 192.253.209.114:36739] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Apr 09 07:50:34.522531 2026] [:error] [pid 20641:tid 20664] [client 192.253.209.114:36739] [client 192.253.209.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adbpym3LksBSF-6rlkafzAAAANM"]
[Thu Apr 09 07:50:35.891291 2026] [:error] [pid 20537:tid 20611] [client 192.253.209.133:30149] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adbpy8STjpSeyrxLmN47KQAAAI0"]
[Thu Apr 09 07:50:38.530340 2026] [:error] [pid 20641:tid 20664] [client 192.253.209.119:31619] [client 192.253.209.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adbpzm3LksBSF-6rlkaf3QAAANM"]
[Thu Apr 09 07:50:39.558205 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.165:44813] [client 192.253.209.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adbpzwWiD9hWnEUHWdNrcgAAAAs"]
[Thu Apr 09 07:50:40.503050 2026] [:error] [pid 20535:tid 20564] [client 192.253.209.150:63457] [client 192.253.209.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adbp0AWiD9hWnEUHWdNrdwAAABQ"]
[Thu Apr 09 07:50:41.483570 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.121:25489] [client 192.253.209.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adbp0fr8glsF_jKQpr5ihAAAAQg"]
[Thu Apr 09 07:50:42.882760 2026] [:error] [pid 22627:tid 22635] [client 192.253.209.128:44797] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adbp0vr8glsF_jKQpr5ilAAAAQU"]
[Thu Apr 09 07:50:43.865536 2026] [:error] [pid 20537:tid 20617] [client 192.253.209.147:27297] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Apr 09 07:50:44.895660 2026] [:error] [pid 20537:tid 20622] [client 192.253.209.147:27297] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "adbp1MSTjpSeyrxLmN47MwAAAJg"]
[Thu Apr 09 07:50:46.903357 2026] [:error] [pid 20535:tid 20568] [client 192.253.209.147:38011] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adbp1gWiD9hWnEUHWdNrgwAAABg"]
[Thu Apr 09 07:50:48.339915 2026] [:error] [pid 22627:tid 22643] [client 192.253.209.113:21731] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adbp2Pr8glsF_jKQpr5irwAAAQ0"]
[Thu Apr 09 07:50:49.274696 2026] [:error] [pid 20537:tid 20604] [client 192.253.209.122:37979] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Apr 09 07:50:49.732630 2026] [:error] [pid 20537:tid 20620] [client 192.253.209.122:37979] [client 192.253.209.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adbp2cSTjpSeyrxLmN47NQAAAJY"]
[Thu Apr 09 07:50:50.672412 2026] [:error] [pid 20537:tid 20603] [client 192.253.209.126:63413] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Apr 09 07:50:52.099387 2026] [:error] [pid 20537:tid 20619] [client 192.253.209.126:63413] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Apr 09 07:50:53.541477 2026] [:error] [pid 20537:tid 20617] [client 192.253.209.126:63413] [client 192.253.209.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adbp3cSTjpSeyrxLmN47QAAAAJM"]
[Thu Apr 09 07:50:54.511870 2026] [:error] [pid 20535:tid 20567] [client 192.253.209.119:64617] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Apr 09 07:50:54.965604 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.119:64617] [client 192.253.209.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adbp3gWiD9hWnEUHWdNrkAAAABM"]
[Thu Apr 09 07:50:55.882834 2026] [:error] [pid 20535:tid 20561] [client 192.253.209.147:34485] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Apr 09 07:50:57.848718 2026] [:error] [pid 20535:tid 20548] [client 192.253.209.147:34485] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adbp4QWiD9hWnEUHWdNrmQAAAAQ"]
[Thu Apr 09 07:50:59.266180 2026] [:error] [pid 20641:tid 20648] [client 192.253.209.142:54427] [client 192.253.209.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adbp423LksBSF-6rlkaf9wAAAMM"]
[Thu Apr 09 07:51:00.835751 2026] [:error] [pid 20641:tid 20655] [client 192.253.209.120:21305] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Apr 09 07:51:01.338991 2026] [:error] [pid 20641:tid 20646] [client 192.253.209.120:21305] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Apr 09 07:51:02.347562 2026] [:error] [pid 20641:tid 20663] [client 192.253.209.120:21305] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adbp5m3LksBSF-6rlkagAQAAANI"]
[Thu Apr 09 07:51:03.795755 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.139:38149] [client 192.253.209.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adbp5wWiD9hWnEUHWdNroQAAAAs"]
[Thu Apr 09 07:51:05.258377 2026] [:error] [pid 20641:tid 20659] [client 192.253.209.120:61449] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adbp6W3LksBSF-6rlkagCAAAAM4"]
[Thu Apr 09 07:51:07.190809 2026] [:error] [pid 20536:tid 20579] [client 192.253.209.164:41929] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adbp68PqyUJM1s3YpIZFYAAAAEg"]
[Thu Apr 09 07:51:08.127635 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.133:45001] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adbp7AWiD9hWnEUHWdNrqQAAAAY"]
[Thu Apr 09 07:51:10.006679 2026] [:error] [pid 20536:tid 20573] [client 192.253.209.130:23043] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Apr 09 07:51:10.466317 2026] [:error] [pid 20536:tid 20576] [client 192.253.209.130:23043] [client 192.253.209.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adbp7sPqyUJM1s3YpIZFZQAAAEU"]
[Thu Apr 09 07:51:11.482679 2026] [:error] [pid 20535:tid 20556] [client 192.253.209.164:47631] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adbp7wWiD9hWnEUHWdNrqwAAAAw"]
[Thu Apr 09 07:51:12.403577 2026] [:error] [pid 22627:tid 22630] [client 192.253.209.135:43421] [client 192.253.209.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adbp8Pr8glsF_jKQpr5i2QAAAQA"]
[Thu Apr 09 07:51:14.264394 2026] [:error] [pid 20535:tid 20565] [client 192.253.209.141:57635] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Apr 09 07:51:15.179676 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.141:57635] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Apr 09 07:51:17.076751 2026] [:error] [pid 20535:tid 20553] [client 192.253.209.141:57635] [client 192.253.209.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adbp9QWiD9hWnEUHWdNruwAAAAk"]
[Thu Apr 09 07:51:19.444972 2026] [:error] [pid 20537:tid 20601] [client 192.253.209.146:25975] [client 192.253.209.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.146, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adbp98STjpSeyrxLmN47UwAAAIM"]
[Thu Apr 09 07:51:19.909042 2026] [:error] [pid 20537:tid 20603] [client 192.253.209.146:25975] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Apr 09 07:51:22.249373 2026] [:error] [pid 20537:tid 20605] [client 192.253.209.146:25975] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Apr 09 07:51:22.705756 2026] [:error] [pid 20537:tid 20609] [client 192.253.209.146:25975] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Apr 09 07:51:26.154591 2026] [:error] [pid 20537:tid 20604] [client 192.253.209.146:25975] [client 192.253.209.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adbp_sSTjpSeyrxLmN47YwAAAIY"]
[Thu Apr 09 07:51:27.542833 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.130:33393] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Apr 09 07:51:27.996335 2026] [:error] [pid 20535:tid 20566] [client 192.253.209.130:33393] [client 192.253.209.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.130, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adbp_wWiD9hWnEUHWdNr0AAAABY"]
[Thu Apr 09 07:51:28.917369 2026] [:error] [pid 20535:tid 20549] [client 192.253.209.130:33393] [client 192.253.209.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "adbqAAWiD9hWnEUHWdNr1AAAAAU"]
[Thu Apr 09 07:51:31.735284 2026] [:error] [pid 22627:tid 22631] [client 192.253.209.137:37769] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Apr 09 07:51:32.656357 2026] [:error] [pid 22627:tid 22634] [client 192.253.209.137:37769] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Apr 09 07:51:33.624820 2026] [:error] [pid 22627:tid 22639] [client 192.253.209.137:37769] [client 192.253.209.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adbqBfr8glsF_jKQpr5jGwAAAQk"]
[Thu Apr 09 07:51:34.542694 2026] [:error] [pid 20535:tid 20567] [client 192.253.209.155:37139] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 09 07:51:35.925130 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.155:37139] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Apr 09 07:51:36.873886 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.155:37139] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Apr 09 07:51:37.795606 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.155:37139] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Apr 09 07:51:38.252158 2026] [:error] [pid 20535:tid 20546] [client 192.253.209.155:37139] [client 192.253.209.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adbqCgWiD9hWnEUHWdNr9QAAAAI"]
[Thu Apr 09 07:51:39.181074 2026] [:error] [pid 20536:tid 20578] [client 192.253.209.140:25477] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Apr 09 07:51:39.642209 2026] [:error] [pid 20536:tid 20581] [client 192.253.209.140:25477] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Apr 09 07:51:40.119095 2026] [:error] [pid 20536:tid 20590] [client 192.253.209.140:25477] [client 192.253.209.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adbqDMPqyUJM1s3YpIZFeQAAAFM"]
[Thu Apr 09 07:51:41.485892 2026] [:error] [pid 20641:tid 20660] [client 192.253.209.161:58923] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Apr 09 07:51:42.408466 2026] [:error] [pid 20641:tid 20648] [client 192.253.209.161:58923] [client 192.253.209.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.161, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adbqDm3LksBSF-6rlkagMAAAAMM"]
[Thu Apr 09 07:51:42.874340 2026] [:error] [pid 20641:tid 20661] [client 192.253.209.161:58923] [client 192.253.209.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adbqDm3LksBSF-6rlkagMQAAANA"]
[Thu Apr 09 07:51:48.444996 2026] [:error] [pid 20536:tid 20587] [client 192.253.209.154:28059] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Apr 09 07:51:51.279766 2026] [:error] [pid 20536:tid 20588] [client 192.253.209.154:28059] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Apr 09 07:51:51.786305 2026] [:error] [pid 20536:tid 20576] [client 192.253.209.154:28059] [client 192.253.209.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adbqF8PqyUJM1s3YpIZFkQAAAEU"]
[Thu Apr 09 07:51:52.740981 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.145:50869] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Apr 09 07:51:54.112834 2026] [:error] [pid 20535:tid 20548] [client 192.253.209.145:50869] [client 192.253.209.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.145, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adbqGgWiD9hWnEUHWdNsDAAAAAQ"]
[Thu Apr 09 07:51:54.576959 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.145:50869] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Apr 09 07:51:55.038540 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.145:50869] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Apr 09 07:51:55.497676 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.145:50869] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Apr 09 07:51:55.956672 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.145:50869] [client 192.253.209.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adbqGwWiD9hWnEUHWdNsEQAAAAs"]
[Thu Apr 09 07:51:56.874503 2026] [:error] [pid 20641:tid 20645] [client 192.253.209.128:46469] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Apr 09 07:51:57.336711 2026] [:error] [pid 20641:tid 20647] [client 192.253.209.128:46469] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adbqHW3LksBSF-6rlkagUAAAAMI"]
[Thu Apr 09 07:51:58.785443 2026] [:error] [pid 20535:tid 20548] [client 192.253.209.142:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Apr 09 07:51:59.243755 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.142:28393] [client 192.253.209.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adbqHwWiD9hWnEUHWdNsHgAAAAY"]
[Thu Apr 09 07:52:01.235604 2026] [:error] [pid 20641:tid 20661] [client 192.253.209.154:34485] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Apr 09 07:52:01.697838 2026] [:error] [pid 20641:tid 20668] [client 192.253.209.154:34485] [client 192.253.209.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adbqIW3LksBSF-6rlkagWwAAANc"]
[Thu Apr 09 07:52:02.615429 2026] [:error] [pid 20535:tid 20556] [client 192.253.209.148:29633] [client 192.253.209.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adbqIgWiD9hWnEUHWdNsLwAAAAw"]
[Thu Apr 09 07:52:03.533981 2026] [:error] [pid 20535:tid 20561] [client 192.253.209.163:51841] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Apr 09 07:52:03.992652 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.163:51841] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Apr 09 07:52:05.834291 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.163:51841] [client 192.253.209.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adbqJQWiD9hWnEUHWdNsOgAAAAo"]
[Thu Apr 09 07:52:07.246527 2026] [:error] [pid 22627:tid 22639] [client 192.253.209.114:33553] [client 192.253.209.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adbqJ_r8glsF_jKQpr5jQwAAAQk"]
[Thu Apr 09 07:52:09.554318 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.130:45721] [client 192.253.209.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adbqKfr8glsF_jKQpr5jTAAAARg"]
[Thu Apr 09 07:52:10.492083 2026] [:error] [pid 22627:tid 22645] [client 192.253.209.147:34129] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Apr 09 07:52:11.465222 2026] [:error] [pid 22627:tid 22637] [client 192.253.209.147:34129] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Apr 09 07:52:11.918370 2026] [:error] [pid 22627:tid 22643] [client 192.253.209.147:34129] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adbqK_r8glsF_jKQpr5jWQAAAQ0"]
[Thu Apr 09 07:52:12.846853 2026] [:error] [pid 20641:tid 20662] [client 192.253.209.108:64223] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Apr 09 07:52:13.763221 2026] [:error] [pid 20641:tid 20663] [client 192.253.209.108:64223] [client 192.253.209.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "adbqLW3LksBSF-6rlkagdgAAANI"]
[Thu Apr 09 07:52:16.124351 2026] [:error] [pid 20641:tid 20664] [client 192.253.209.131:37183] [client 192.253.209.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adbqMG3LksBSF-6rlkagewAAANM"]
[Thu Apr 09 07:52:17.599869 2026] [:error] [pid 20537:tid 20620] [client 192.253.209.117:51845] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Apr 09 07:52:18.984935 2026] [:error] [pid 20537:tid 20614] [client 192.253.209.117:51845] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Apr 09 07:52:19.909657 2026] [:error] [pid 20537:tid 20604] [client 192.253.209.117:51845] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Apr 09 07:52:20.394871 2026] [:error] [pid 20537:tid 20600] [client 192.253.209.117:51845] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adbqNMSTjpSeyrxLmN47zwAAAII"]
[Thu Apr 09 07:52:21.312829 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.158:23485] [client 192.253.209.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adbqNfr8glsF_jKQpr5jcwAAAQ4"]
[Thu Apr 09 07:52:22.228399 2026] [:error] [pid 20536:tid 20588] [client 192.253.209.146:29327] [client 192.253.209.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adbqNsPqyUJM1s3YpIZFpAAAAFE"]
[Thu Apr 09 07:52:23.156837 2026] [:error] [pid 20536:tid 20583] [client 192.253.209.131:54059] [client 192.253.209.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adbqN8PqyUJM1s3YpIZFqAAAAEw"]
[Thu Apr 09 07:52:24.101987 2026] [:error] [pid 22627:tid 22650] [client 192.253.209.148:57043] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Apr 09 07:52:24.626739 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.148:57043] [client 192.253.209.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adbqOPr8glsF_jKQpr5jfwAAAQ4"]
[Thu Apr 09 07:52:25.572309 2026] [:error] [pid 20537:tid 20621] [client 192.253.209.117:64917] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adbqOcSTjpSeyrxLmN471wAAAJc"]
[Thu Apr 09 07:52:26.498440 2026] [:error] [pid 20535:tid 20552] [client 192.253.209.110:42813] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Apr 09 07:52:27.464019 2026] [:error] [pid 20535:tid 20559] [client 192.253.209.110:42813] [client 192.253.209.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adbqOwWiD9hWnEUHWdNsSAAAAA8"]
[Thu Apr 09 07:52:28.379628 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.138:63887] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adbqPAWiD9hWnEUHWdNsSgAAAAs"]
[Thu Apr 09 07:52:29.304957 2026] [:error] [pid 20537:tid 20603] [client 192.253.209.113:52773] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adbqPcSTjpSeyrxLmN473wAAAIU"]
[Thu Apr 09 07:52:30.220118 2026] [:error] [pid 20537:tid 20612] [client 192.253.209.133:54035] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adbqPsSTjpSeyrxLmN474gAAAI4"]
[Thu Apr 09 07:52:31.790209 2026] [:error] [pid 20641:tid 20656] [client 192.253.209.124:20773] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adbqP23LksBSF-6rlkaglwAAAMs"]
[Thu Apr 09 07:52:33.645664 2026] [:error] [pid 20537:tid 20608] [client 192.253.209.117:35121] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adbqQcSTjpSeyrxLmN476QAAAIo"]
[Thu Apr 09 07:52:34.569399 2026] [:error] [pid 20535:tid 20567] [client 192.253.209.148:23407] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Apr 09 07:52:35.992619 2026] [:error] [pid 20535:tid 20545] [client 192.253.209.148:23407] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Apr 09 07:52:36.460135 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.148:23407] [client 192.253.209.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adbqRAWiD9hWnEUHWdNsUgAAAA0"]
[Thu Apr 09 07:52:37.860853 2026] [:error] [pid 20641:tid 20661] [client 192.253.209.127:64609] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Apr 09 07:52:38.336526 2026] [:error] [pid 20641:tid 20656] [client 192.253.209.127:64609] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Apr 09 07:52:40.720732 2026] [:error] [pid 20641:tid 20660] [client 192.253.209.127:64609] [client 192.253.209.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adbqSG3LksBSF-6rlkagrAAAAM8"]
[Thu Apr 09 07:52:43.037205 2026] [:error] [pid 20641:tid 20645] [client 192.253.209.164:43931] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adbqS23LksBSF-6rlkagtwAAAMA"]
[Thu Apr 09 07:52:44.002887 2026] [:error] [pid 22627:tid 22634] [client 192.253.209.161:62479] [client 192.253.209.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adbqTPr8glsF_jKQpr5joQAAAQQ"]
[Thu Apr 09 07:52:46.816283 2026] [:error] [pid 22627:tid 22653] [client 192.253.209.141:42891] [client 192.253.209.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adbqTvr8glsF_jKQpr5jrgAAARc"]
[Thu Apr 09 07:52:48.674338 2026] [:error] [pid 22627:tid 22634] [client 192.253.209.137:52503] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Apr 09 07:52:49.136896 2026] [:error] [pid 22627:tid 22647] [client 192.253.209.137:52503] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Apr 09 07:52:49.603394 2026] [:error] [pid 22627:tid 22650] [client 192.253.209.137:52503] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Apr 09 07:52:50.074486 2026] [:error] [pid 22627:tid 22639] [client 192.253.209.137:52503] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Apr 09 07:52:52.378753 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.137:52503] [client 192.253.209.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adbqVPr8glsF_jKQpr5jxAAAAQg"]
[Thu Apr 09 07:52:53.310266 2026] [:error] [pid 20537:tid 20622] [client 192.253.209.108:47809] [client 192.253.209.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adbqVcSTjpSeyrxLmN48AAAAAJg"]
[Thu Apr 09 07:52:54.245885 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.128:58601] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adbqVvr8glsF_jKQpr5jzgAAAQ4"]
[Thu Apr 09 07:52:55.157673 2026] [:error] [pid 20535:tid 20558] [client 192.253.209.120:39307] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adbqVwWiD9hWnEUHWdNsbwAAAA4"]
[Thu Apr 09 07:52:56.074643 2026] [:error] [pid 20536:tid 20589] [client 192.253.209.117:49919] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adbqWMPqyUJM1s3YpIZFyAAAAFI"]
[Thu Apr 09 07:52:57.008749 2026] [:error] [pid 22627:tid 22631] [client 192.253.209.161:44869] [client 192.253.209.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adbqWfr8glsF_jKQpr5j1AAAAQE"]
[Thu Apr 09 07:52:58.450661 2026] [:error] [pid 20535:tid 20549] [client 192.253.209.162:28577] [client 192.253.209.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adbqWgWiD9hWnEUHWdNseQAAAAU"]
[Thu Apr 09 07:52:59.398958 2026] [:error] [pid 20641:tid 20669] [client 192.253.209.133:51909] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adbqW23LksBSF-6rlkagxQAAANg"]
[Thu Apr 09 07:53:00.329441 2026] [:error] [pid 20641:tid 20656] [client 192.253.209.164:40905] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adbqXG3LksBSF-6rlkagxwAAAMs"]
[Thu Apr 09 07:53:01.304964 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.141:53425] [client 192.253.209.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adbqXQWiD9hWnEUHWdNsfQAAAAM"]
[Thu Apr 09 07:53:03.168331 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.123:43051] [client 192.253.209.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adbqX_r8glsF_jKQpr5j5QAAAQ4"]
[Thu Apr 09 07:53:04.555743 2026] [:error] [pid 20641:tid 20653] [client 192.253.209.126:53253] [client 192.253.209.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adbqYG3LksBSF-6rlkagygAAAMg"]
[Thu Apr 09 07:53:05.468582 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.121:28443] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Apr 09 07:53:06.409418 2026] [:error] [pid 22627:tid 22653] [client 192.253.209.121:28443] [client 192.253.209.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adbqYvr8glsF_jKQpr5j9gAAARc"]
[Thu Apr 09 07:53:08.251889 2026] [:error] [pid 22627:tid 22632] [client 192.253.209.122:25313] [client 192.253.209.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "adbqZPr8glsF_jKQpr5kAAAAAQI"]
[Thu Apr 09 07:53:10.099464 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.124:41477] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Thu Apr 09 07:53:10.552598 2026] [:error] [pid 22627:tid 22633] [client 192.253.209.124:41477] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adbqZvr8glsF_jKQpr5kFAAAAQM"]
[Thu Apr 09 07:53:11.929251 2026] [:error] [pid 20641:tid 20650] [client 192.253.209.108:25709] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Apr 09 07:53:12.392407 2026] [:error] [pid 20641:tid 20648] [client 192.253.209.108:25709] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Apr 09 07:53:12.850767 2026] [:error] [pid 20641:tid 20669] [client 192.253.209.108:25709] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Apr 09 07:53:13.381361 2026] [:error] [pid 20641:tid 20666] [client 192.253.209.108:25709] [client 192.253.209.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adbqaW3LksBSF-6rlkag1AAAANU"]
[Thu Apr 09 07:53:14.340601 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.124:63891] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Apr 09 07:53:14.806671 2026] [:error] [pid 20535:tid 20566] [client 192.253.209.124:63891] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adbqagWiD9hWnEUHWdNsigAAABY"]
[Thu Apr 09 07:53:16.665062 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.148:39145] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 09 07:53:17.126336 2026] [:error] [pid 20535:tid 20566] [client 192.253.209.148:39145] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Apr 09 07:53:17.583497 2026] [:error] [pid 20535:tid 20567] [client 192.253.209.148:39145] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Thu Apr 09 07:53:19.903407 2026] [:error] [pid 20535:tid 20560] [client 192.253.209.148:39145] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Apr 09 07:53:20.364044 2026] [:error] [pid 20535:tid 20546] [client 192.253.209.148:39145] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Apr 09 07:53:21.285990 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.148:39145] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Thu Apr 09 07:53:22.678695 2026] [:error] [pid 20535:tid 20544] [client 192.253.209.148:39145] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 09 07:53:23.159086 2026] [:error] [pid 20535:tid 20546] [client 192.253.209.148:39145] [client 192.253.209.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adbqcwWiD9hWnEUHWdNssAAAAAI"]
[Thu Apr 09 07:53:24.113006 2026] [:error] [pid 22627:tid 22631] [client 192.253.209.164:20819] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adbqdPr8glsF_jKQpr5kLQAAAQE"]
[Thu Apr 09 07:53:25.030451 2026] [:error] [pid 20535:tid 20551] [client 192.253.209.133:48779] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Apr 09 07:53:26.655952 2026] [:error] [pid 20535:tid 20551] [client 192.253.209.133:48779] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adbqdgWiD9hWnEUHWdNsvQAAAAc"]
[Thu Apr 09 07:53:28.055717 2026] [:error] [pid 20537:tid 20616] [client 192.253.209.127:52169] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Apr 09 07:53:28.514028 2026] [:error] [pid 20537:tid 20613] [client 192.253.209.127:52169] [client 192.253.209.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adbqeMSTjpSeyrxLmN48KAAAAI8"]
[Thu Apr 09 07:53:29.447579 2026] [:error] [pid 20537:tid 20598] [client 192.253.209.163:63125] [client 192.253.209.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adbqecSTjpSeyrxLmN48KQAAAIA"]
[Thu Apr 09 07:53:32.355609 2026] [:error] [pid 22627:tid 22639] [client 192.253.209.129:27531] [client 192.253.209.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adbqfPr8glsF_jKQpr5kTgAAAQk"]
[Thu Apr 09 07:53:33.281357 2026] [:error] [pid 22627:tid 22632] [client 192.253.209.119:60893] [client 192.253.209.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "adbqffr8glsF_jKQpr5kUAAAAQI"]
[Thu Apr 09 07:53:35.592354 2026] [:error] [pid 22627:tid 22646] [client 192.253.209.127:59857] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Apr 09 07:53:36.515158 2026] [:error] [pid 22627:tid 22649] [client 192.253.209.127:59857] [client 192.253.209.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adbqgPr8glsF_jKQpr5kYwAAARM"]
[Thu Apr 09 07:53:37.886563 2026] [:error] [pid 20641:tid 20661] [client 192.253.209.164:40127] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Thu Apr 09 07:53:38.828164 2026] [:error] [pid 20641:tid 20656] [client 192.253.209.164:40127] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/function.php"] [unique_id "adbqgm3LksBSF-6rlkag7wAAAMs"]
[Thu Apr 09 07:53:41.337806 2026] [:error] [pid 20537:tid 20621] [client 192.253.209.137:56705] [client 192.253.209.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "adbqhcSTjpSeyrxLmN48NgAAAJc"]
[Thu Apr 09 07:53:42.798766 2026] [:error] [pid 22627:tid 22650] [client 192.253.209.150:20855] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Apr 09 07:53:43.256127 2026] [:error] [pid 22627:tid 22641] [client 192.253.209.150:20855] [client 192.253.209.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adbqh_r8glsF_jKQpr5kewAAAQs"]
[Thu Apr 09 07:53:44.186332 2026] [:error] [pid 20537:tid 20618] [client 192.253.209.124:24545] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adbqiMSTjpSeyrxLmN48NwAAAJQ"]
[Thu Apr 09 07:53:46.921710 2026] [:error] [pid 20641:tid 20665] [client 192.253.209.127:50741] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Apr 09 07:53:47.388206 2026] [:error] [pid 20641:tid 20655] [client 192.253.209.127:50741] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Apr 09 07:53:48.316834 2026] [:error] [pid 20641:tid 20660] [client 192.253.209.127:50741] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Apr 09 07:53:49.233837 2026] [:error] [pid 20641:tid 20647] [client 192.253.209.127:50741] [client 192.253.209.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adbqjW3LksBSF-6rlkahAgAAAMI"]
[Thu Apr 09 07:53:50.181960 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.165:36813] [client 192.253.209.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adbqjgWiD9hWnEUHWdNs5wAAAAM"]
[Thu Apr 09 07:53:53.291835 2026] [:error] [pid 20535:tid 20548] [client 192.253.209.126:21295] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Apr 09 07:53:53.764515 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.126:21295] [client 192.253.209.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/index.php"] [unique_id "adbqkQWiD9hWnEUHWdNs9QAAAAs"]
[Thu Apr 09 07:53:54.675020 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.138:54749] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adbqkvr8glsF_jKQpr5klQAAARg"]
[Thu Apr 09 07:53:55.624833 2026] [:error] [pid 22627:tid 22631] [client 192.253.209.119:20445] [client 192.253.209.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adbqk_r8glsF_jKQpr5klwAAAQE"]
[Thu Apr 09 07:53:58.427357 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.144:23973] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Apr 09 07:53:58.881270 2026] [:error] [pid 22627:tid 22643] [client 192.253.209.144:23973] [client 192.253.209.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adbqlvr8glsF_jKQpr5krwAAAQ0"]
[Thu Apr 09 07:54:00.281640 2026] [:error] [pid 20537:tid 20600] [client 192.253.209.133:53711] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adbqmMSTjpSeyrxLmN48SwAAAII"]
[Thu Apr 09 07:54:01.319970 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Apr 09 07:54:01.782397 2026] [:error] [pid 20535:tid 20561] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Apr 09 07:54:02.713073 2026] [:error] [pid 20535:tid 20556] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Apr 09 07:54:04.583688 2026] [:error] [pid 20535:tid 20565] [client 192.253.209.158:45673] [client 192.253.209.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.158, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/wp-login.php"] [unique_id "adbqnAWiD9hWnEUHWdNtBwAAABU"]
[Thu Apr 09 07:54:05.537358 2026] [:error] [pid 20535:tid 20548] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Thu Apr 09 07:54:06.009043 2026] [:error] [pid 20535:tid 20552] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Apr 09 07:54:06.486717 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Thu Apr 09 07:54:07.402454 2026] [:error] [pid 20535:tid 20556] [client 192.253.209.158:45673] [client 192.253.209.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.158, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adbqnwWiD9hWnEUHWdNtEQAAAAw"]
[Thu Apr 09 07:54:08.797413 2026] [:error] [pid 20535:tid 20565] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Apr 09 07:54:09.257353 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Thu Apr 09 07:54:10.269676 2026] [:error] [pid 20535:tid 20568] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Thu Apr 09 07:54:11.191177 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Apr 09 07:54:12.569837 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Thu Apr 09 07:54:16.962980 2026] [:error] [pid 20535:tid 20551] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 09 07:54:17.447925 2026] [:error] [pid 20535:tid 20546] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Apr 09 07:54:19.766162 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.158:45673] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Apr 09 07:54:20.702602 2026] [:error] [pid 20535:tid 20565] [client 192.253.209.158:45673] [client 192.253.209.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adbqrAWiD9hWnEUHWdNtQAAAABU"]
[Thu Apr 09 07:54:22.850392 2026] [:error] [pid 20537:tid 20617] [client 192.253.209.134:26533] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Apr 09 07:54:23.413986 2026] [:error] [pid 20537:tid 20610] [client 192.253.209.134:26533] [client 192.253.209.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adbqr8STjpSeyrxLmN48YQAAAIw"]
[Thu Apr 09 07:54:24.803945 2026] [:error] [pid 20536:tid 20579] [client 192.253.209.131:56319] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Apr 09 07:54:25.281671 2026] [:error] [pid 20536:tid 20576] [client 192.253.209.131:56319] [client 192.253.209.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adbqscPqyUJM1s3YpIZGBQAAAEU"]
[Thu Apr 09 07:54:27.130889 2026] [:error] [pid 22627:tid 22647] [client 192.253.209.163:60305] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Apr 09 07:54:28.077558 2026] [:error] [pid 22627:tid 22633] [client 192.253.209.163:60305] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Apr 09 07:54:29.010717 2026] [:error] [pid 22627:tid 22652] [client 192.253.209.163:60305] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu Apr 09 07:54:29.477016 2026] [:error] [pid 22627:tid 22653] [client 192.253.209.163:60305] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Thu Apr 09 07:54:30.419592 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.163:60305] [client 192.253.209.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adbqtvr8glsF_jKQpr5lHwAAAQg"]
[Thu Apr 09 07:54:31.417848 2026] [:error] [pid 22627:tid 22641] [client 192.253.209.130:22501] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Thu Apr 09 07:54:31.886565 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.130:22501] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Apr 09 07:54:32.347153 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.130:22501] [client 192.253.209.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adbquPr8glsF_jKQpr5lLwAAARg"]
[Thu Apr 09 07:54:33.809357 2026] [:error] [pid 20535:tid 20545] [client 192.253.209.136:29237] [client 192.253.209.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adbquQWiD9hWnEUHWdNtXwAAAAE"]
[Thu Apr 09 07:54:35.193087 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.136:28333] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Apr 09 07:54:36.599617 2026] [:error] [pid 22627:tid 22647] [client 192.253.209.136:28333] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Thu Apr 09 07:54:37.065625 2026] [:error] [pid 22627:tid 22643] [client 192.253.209.136:28333] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Thu Apr 09 07:54:37.525657 2026] [:error] [pid 22627:tid 22635] [client 192.253.209.136:28333] [client 192.253.209.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adbqvfr8glsF_jKQpr5lSQAAAQU"]
[Thu Apr 09 07:54:38.446605 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.121:55311] [client 192.253.209.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adbqvgWiD9hWnEUHWdNtcAAAABM"]
[Thu Apr 09 07:54:41.685486 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.133:54317] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Thu Apr 09 07:54:42.615262 2026] [:error] [pid 20535:tid 20549] [client 192.253.209.133:54317] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adbqwgWiD9hWnEUHWdNtigAAAAU"]
[Thu Apr 09 07:54:44.018926 2026] [:error] [pid 20535:tid 20560] [client 192.253.209.128:35785] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "adbqxAWiD9hWnEUHWdNtkgAAABA"]
[Thu Apr 09 07:54:45.437101 2026] [:error] [pid 20536:tid 20583] [client 192.253.209.125:39127] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Apr 09 07:54:45.900421 2026] [:error] [pid 20536:tid 20579] [client 192.253.209.125:39127] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Apr 09 07:54:46.355037 2026] [:error] [pid 20536:tid 20576] [client 192.253.209.125:39127] [client 192.253.209.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adbqxsPqyUJM1s3YpIZGGAAAAEU"]
[Thu Apr 09 07:54:47.778414 2026] [:error] [pid 20535:tid 20568] [client 192.253.209.108:52217] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Thu Apr 09 07:54:48.237114 2026] [:error] [pid 20535:tid 20544] [client 192.253.209.108:52217] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Thu Apr 09 07:54:49.178976 2026] [:error] [pid 20535:tid 20548] [client 192.253.209.108:52217] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Apr 09 07:54:51.759746 2026] [:error] [pid 20535:tid 20560] [client 192.253.209.108:52217] [client 192.253.209.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adbqywWiD9hWnEUHWdNtrQAAABA"]
[Thu Apr 09 07:54:52.679731 2026] [:error] [pid 22627:tid 22649] [client 192.253.209.145:29557] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Thu Apr 09 07:54:54.222877 2026] [:error] [pid 22627:tid 22639] [client 192.253.209.145:29557] [client 192.253.209.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adbqzvr8glsF_jKQpr5lkwAAAQk"]
[Thu Apr 09 07:54:55.610577 2026] [:error] [pid 20537:tid 20620] [client 192.253.209.148:35677] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Thu Apr 09 07:54:57.000531 2026] [:error] [pid 20537:tid 20609] [client 192.253.209.148:35677] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Thu Apr 09 07:54:57.462271 2026] [:error] [pid 20537:tid 20622] [client 192.253.209.148:35677] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Thu Apr 09 07:54:59.496422 2026] [:error] [pid 20537:tid 20608] [client 192.253.209.148:35677] [client 192.253.209.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.148, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adbq08STjpSeyrxLmN48jQAAAIo"]
[Thu Apr 09 07:55:01.901434 2026] [:error] [pid 20537:tid 20605] [client 192.253.209.148:35677] [client 192.253.209.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adbq1cSTjpSeyrxLmN48lAAAAIc"]
[Thu Apr 09 07:55:02.830846 2026] [:error] [pid 22627:tid 22645] [client 192.253.209.150:55593] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Thu Apr 09 07:55:03.292165 2026] [:error] [pid 22627:tid 22639] [client 192.253.209.150:55593] [client 192.253.209.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adbq1_r8glsF_jKQpr5lsAAAAQk"]
[Thu Apr 09 07:55:04.212668 2026] [:error] [pid 20535:tid 20560] [client 192.253.209.138:22235] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Thu Apr 09 07:55:05.131709 2026] [:error] [pid 20535:tid 20553] [client 192.253.209.138:22235] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Apr 09 07:55:06.058500 2026] [:error] [pid 20535:tid 20560] [client 192.253.209.138:22235] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adbq2gWiD9hWnEUHWdNt2wAAABA"]
[Thu Apr 09 07:55:07.478372 2026] [:error] [pid 20536:tid 20583] [client 192.253.209.158:38611] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Thu Apr 09 07:55:07.935411 2026] [:error] [pid 20536:tid 20577] [client 192.253.209.158:38611] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Apr 09 07:55:08.412360 2026] [:error] [pid 20536:tid 20578] [client 192.253.209.158:38611] [client 192.253.209.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adbq3MPqyUJM1s3YpIZGMAAAAEc"]
[Thu Apr 09 07:55:09.327086 2026] [:error] [pid 20537:tid 20619] [client 192.253.209.161:56063] [client 192.253.209.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adbq3cSTjpSeyrxLmN48lwAAAJU"]
[Thu Apr 09 07:55:10.256705 2026] [:error] [pid 20537:tid 20608] [client 192.253.209.138:65169] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Thu Apr 09 07:55:10.718823 2026] [:error] [pid 20537:tid 20604] [client 192.253.209.138:65169] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Thu Apr 09 07:55:11.639093 2026] [:error] [pid 20537:tid 20621] [client 192.253.209.138:65169] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adbq38STjpSeyrxLmN48oAAAAJc"]
[Thu Apr 09 07:55:12.560343 2026] [:error] [pid 20641:tid 20668] [client 192.253.209.144:64687] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Thu Apr 09 07:55:13.509337 2026] [:error] [pid 20641:tid 20650] [client 192.253.209.144:64687] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Thu Apr 09 07:55:13.974384 2026] [:error] [pid 20641:tid 20651] [client 192.253.209.144:64687] [client 192.253.209.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adbq4W3LksBSF-6rlkahygAAAMY"]
[Thu Apr 09 07:55:15.354691 2026] [:error] [pid 20536:tid 20588] [client 192.253.209.139:64371] [client 192.253.209.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/db.php"] [unique_id "adbq48PqyUJM1s3YpIZGOgAAAFE"]
[Thu Apr 09 07:55:16.414084 2026] [:error] [pid 20536:tid 20578] [client 192.253.209.165:56025] [client 192.253.209.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adbq5MPqyUJM1s3YpIZGPAAAAEc"]
[Thu Apr 09 07:55:17.343823 2026] [:error] [pid 20641:tid 20668] [client 192.253.209.143:26553] [client 192.253.209.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adbq5W3LksBSF-6rlkah2wAAANc"]
[Thu Apr 09 07:55:18.277453 2026] [:error] [pid 20641:tid 20650] [client 192.253.209.114:24287] [client 192.253.209.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adbq5m3LksBSF-6rlkah3QAAAMU"]
[Thu Apr 09 07:55:19.213664 2026] [:error] [pid 20536:tid 20579] [client 192.253.209.118:62871] [client 192.253.209.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adbq58PqyUJM1s3YpIZGPQAAAEg"]
[Thu Apr 09 07:55:20.129123 2026] [:error] [pid 20537:tid 20600] [client 192.253.209.161:51297] [client 192.253.209.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adbq6MSTjpSeyrxLmN48rAAAAII"]
[Thu Apr 09 07:55:21.993600 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.117:44977] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adbq6QWiD9hWnEUHWdNuAAAAAAY"]
[Thu Apr 09 07:55:22.931904 2026] [:error] [pid 20641:tid 20669] [client 192.253.209.132:55429] [client 192.253.209.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adbq6m3LksBSF-6rlkah5QAAANg"]
[Thu Apr 09 07:55:23.902807 2026] [:error] [pid 20537:tid 20620] [client 192.253.209.118:24991] [client 192.253.209.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adbq68STjpSeyrxLmN48twAAAJY"]
[Thu Apr 09 07:55:24.819642 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.131:33147] [client 192.253.209.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adbq7AWiD9hWnEUHWdNuAwAAABI"]
[Thu Apr 09 07:55:25.759288 2026] [:error] [pid 20537:tid 20618] [client 192.253.209.113:33047] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "adbq7cSTjpSeyrxLmN48vAAAAJQ"]
[Thu Apr 09 07:55:26.710999 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.138:34939] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Thu Apr 09 07:55:28.133925 2026] [:error] [pid 20535:tid 20568] [client 192.253.209.138:34939] [client 192.253.209.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.138, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adbq8AWiD9hWnEUHWdNuEgAAABg"]
[Thu Apr 09 07:55:30.517174 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.138:34939] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adbq8gWiD9hWnEUHWdNuJAAAAAs"]
[Thu Apr 09 07:55:32.507985 2026] [:error] [pid 20535:tid 20544] [client 192.253.209.128:32411] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Apr 09 07:55:32.974936 2026] [:error] [pid 20535:tid 20559] [client 192.253.209.128:32411] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Thu Apr 09 07:55:34.822009 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.128:32411] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Thu Apr 09 07:55:35.296120 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.128:32411] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Thu Apr 09 07:55:37.195602 2026] [:error] [pid 20535:tid 20566] [client 192.253.209.128:32411] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Thu Apr 09 07:55:37.673850 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.128:32411] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Thu Apr 09 07:55:38.149541 2026] [:error] [pid 20535:tid 20561] [client 192.253.209.128:32411] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Apr 09 07:55:38.618788 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.128:32411] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Thu Apr 09 07:55:40.208953 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.128:32411] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adbq_AWiD9hWnEUHWdNuZwAAAAM"]
[Thu Apr 09 07:55:41.134585 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.146:62311] [client 192.253.209.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adbq_QWiD9hWnEUHWdNuagAAAA0"]
[Thu Apr 09 07:55:42.047125 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.133:61303] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adbq_gWiD9hWnEUHWdNubwAAABI"]
[Thu Apr 09 07:55:43.433286 2026] [:error] [pid 22627:tid 22637] [client 192.253.209.143:51173] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Thu Apr 09 07:55:43.891817 2026] [:error] [pid 22627:tid 22647] [client 192.253.209.143:51173] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Thu Apr 09 07:55:44.809102 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.143:51173] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Thu Apr 09 07:55:45.725809 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.143:51173] [client 192.253.209.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adbrAfr8glsF_jKQpr5l7AAAAQg"]
[Thu Apr 09 07:55:46.635513 2026] [:error] [pid 22627:tid 22642] [client 192.253.209.139:54929] [client 192.253.209.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adbrAvr8glsF_jKQpr5l7gAAAQw"]
[Thu Apr 09 07:55:47.576374 2026] [:error] [pid 20641:tid 20668] [client 192.253.209.118:26679] [client 192.253.209.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adbrA23LksBSF-6rlkaiFgAAANc"]
[Thu Apr 09 07:55:50.460933 2026] [:error] [pid 22627:tid 22650] [client 192.253.209.139:53985] [client 192.253.209.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adbrBvr8glsF_jKQpr5l_wAAARQ"]
[Thu Apr 09 07:55:51.865452 2026] [:error] [pid 20537:tid 20599] [client 192.253.209.123:41899] [client 192.253.209.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adbrB8STjpSeyrxLmN483gAAAIE"]
[Thu Apr 09 07:55:53.730897 2026] [:error] [pid 20537:tid 20610] [client 192.253.209.126:35889] [client 192.253.209.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adbrCcSTjpSeyrxLmN488gAAAIw"]
[Thu Apr 09 07:55:59.773692 2026] [:error] [pid 20535:tid 20556] [client 192.253.209.109:37351] [client 192.253.209.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "adbrDwWiD9hWnEUHWdNuowAAAAw"]
[Thu Apr 09 07:56:00.722655 2026] [:error] [pid 22627:tid 22631] [client 192.253.209.148:30277] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Thu Apr 09 07:56:01.175859 2026] [:error] [pid 22627:tid 22647] [client 192.253.209.148:30277] [client 192.253.209.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/about.php"] [unique_id "adbrEfr8glsF_jKQpr5mIgAAARE"]
[Thu Apr 09 07:56:03.026057 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.129:24127] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Thu Apr 09 07:56:04.412609 2026] [:error] [pid 20535:tid 20545] [client 192.253.209.129:24127] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Apr 09 07:56:04.866468 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.129:24127] [client 192.253.209.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "adbrFAWiD9hWnEUHWdNutQAAABI"]
[Thu Apr 09 07:56:06.699153 2026] [:error] [pid 20641:tid 20645] [client 192.253.209.126:63875] [client 192.253.209.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adbrFm3LksBSF-6rlkaiTwAAAMA"]
[Thu Apr 09 07:56:09.511037 2026] [:error] [pid 20536:tid 20588] [client 192.253.209.128:61353] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adbrGcPqyUJM1s3YpIZGcAAAAFE"]
[Thu Apr 09 07:56:12.291821 2026] [:error] [pid 20641:tid 20652] [client 192.253.209.133:51017] [client 192.253.209.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adbrHG3LksBSF-6rlkaiYgAAAMc"]
[Thu Apr 09 07:56:13.693074 2026] [:error] [pid 20641:tid 20667] [client 192.253.209.152:35477] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Apr 09 07:56:14.151306 2026] [:error] [pid 20641:tid 20668] [client 192.253.209.152:35477] [client 192.253.209.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adbrHm3LksBSF-6rlkaiaQAAANc"]
[Thu Apr 09 07:56:15.079825 2026] [:error] [pid 20535:tid 20559] [client 192.253.209.161:33941] [client 192.253.209.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adbrHwWiD9hWnEUHWdNuzwAAAA8"]
[Thu Apr 09 07:56:18.299931 2026] [:error] [pid 20535:tid 20568] [client 192.253.209.147:28075] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adbrIgWiD9hWnEUHWdNu5AAAABg"]
[Thu Apr 09 07:56:19.215586 2026] [:error] [pid 20535:tid 20545] [client 192.253.209.113:46415] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Thu Apr 09 07:56:21.083435 2026] [:error] [pid 20535:tid 20552] [client 192.253.209.113:46415] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Thu Apr 09 07:56:21.539564 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.113:46415] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adbrJQWiD9hWnEUHWdNu8wAAAAs"]
[Thu Apr 09 07:56:23.450838 2026] [:error] [pid 22627:tid 22645] [client 192.253.209.136:30933] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Thu Apr 09 07:56:24.720566 2026] [:error] [pid 22627:tid 22634] [client 192.253.209.136:30933] [client 192.253.209.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adbrKPr8glsF_jKQpr5mVQAAAQQ"]
[Thu Apr 09 07:56:25.652056 2026] [:error] [pid 20535:tid 20559] [client 192.253.209.130:39207] [client 192.253.209.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adbrKQWiD9hWnEUHWdNvAgAAAA8"]
[Thu Apr 09 07:56:27.074112 2026] [:error] [pid 20535:tid 20546] [client 192.253.209.125:49425] [client 192.253.209.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adbrKwWiD9hWnEUHWdNvCwAAAAI"]
[Thu Apr 09 07:56:28.910523 2026] [:error] [pid 22627:tid 22650] [client 192.253.209.123:58947] [client 192.253.209.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "adbrLPr8glsF_jKQpr5mYwAAARQ"]
[Thu Apr 09 07:56:29.834743 2026] [:error] [pid 20537:tid 20604] [client 192.253.209.165:37181] [client 192.253.209.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adbrLcSTjpSeyrxLmN49IgAAAIY"]
[Thu Apr 09 07:56:31.244666 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.147:41555] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Thu Apr 09 07:56:33.540133 2026] [:error] [pid 20535:tid 20549] [client 192.253.209.147:41555] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "adbrMQWiD9hWnEUHWdNvMQAAAAU"]
[Thu Apr 09 07:56:35.395744 2026] [:error] [pid 20536:tid 20582] [client 192.253.209.155:54567] [client 192.253.209.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "adbrM8PqyUJM1s3YpIZGfgAAAEs"]
[Thu Apr 09 07:56:36.307582 2026] [:error] [pid 20535:tid 20556] [client 192.253.209.152:45373] [client 192.253.209.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "adbrNAWiD9hWnEUHWdNvPAAAAAw"]
[Thu Apr 09 07:56:37.698472 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.129:64249] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Thu Apr 09 07:56:38.158206 2026] [:error] [pid 22627:tid 22645] [client 192.253.209.129:64249] [client 192.253.209.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adbrNvr8glsF_jKQpr5mlgAAAQ8"]
[Thu Apr 09 07:56:41.192801 2026] [:error] [pid 20535:tid 20545] [client 192.253.209.138:26843] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adbrOQWiD9hWnEUHWdNvVgAAAAE"]
[Thu Apr 09 07:56:44.433653 2026] [:error] [pid 20641:tid 20648] [client 192.253.209.132:26055] [client 192.253.209.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adbrPG3LksBSF-6rlkaiqAAAAMM"]
[Thu Apr 09 07:56:45.816137 2026] [:error] [pid 22627:tid 22633] [client 192.253.209.125:61515] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Thu Apr 09 07:56:46.279838 2026] [:error] [pid 22627:tid 22640] [client 192.253.209.125:61515] [client 192.253.209.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adbrPvr8glsF_jKQpr5msAAAAQo"]
[Thu Apr 09 07:56:48.123527 2026] [:error] [pid 22627:tid 22640] [client 192.253.209.130:32167] [client 192.253.209.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adbrQPr8glsF_jKQpr5muAAAAQo"]
[Thu Apr 09 07:56:49.505967 2026] [:error] [pid 20537:tid 20622] [client 192.253.209.149:20217] [client 192.253.209.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/as.php"] [unique_id "adbrQcSTjpSeyrxLmN49QAAAAJg"]
[Thu Apr 09 07:56:50.901128 2026] [:error] [pid 20536:tid 20591] [client 192.253.209.113:59725] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adbrQsPqyUJM1s3YpIZGkQAAAFQ"]
[Thu Apr 09 07:56:51.847632 2026] [:error] [pid 20641:tid 20649] [client 192.253.209.128:48071] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/install.php"] [unique_id "adbrQ23LksBSF-6rlkaisAAAAMQ"]
[Thu Apr 09 07:56:52.774496 2026] [:error] [pid 22627:tid 22643] [client 192.253.209.109:54381] [client 192.253.209.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "adbrRPr8glsF_jKQpr5mxQAAAQ0"]
[Thu Apr 09 07:56:56.608906 2026] [:error] [pid 22627:tid 22640] [client 192.253.209.155:49127] [client 192.253.209.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adbrSPr8glsF_jKQpr5m4wAAAQo"]
[Thu Apr 09 07:56:58.897271 2026] [:error] [pid 20536:tid 20587] [client 192.253.209.111:51069] [client 192.253.209.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "adbrSsPqyUJM1s3YpIZGpQAAAFA"]
[Thu Apr 09 07:57:00.286413 2026] [:error] [pid 20537:tid 20620] [client 192.253.209.146:61215] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Thu Apr 09 07:57:00.855068 2026] [:error] [pid 20537:tid 20609] [client 192.253.209.146:61215] [client 192.253.209.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "adbrTMSTjpSeyrxLmN49VAAAAIs"]
[Thu Apr 09 07:57:02.717627 2026] [:error] [pid 20537:tid 20611] [client 192.253.209.121:37539] [client 192.253.209.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "adbrTsSTjpSeyrxLmN49WQAAAI0"]
[Thu Apr 09 07:57:03.645010 2026] [:error] [pid 20641:tid 20646] [client 192.253.209.114:54051] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Thu Apr 09 07:57:05.994338 2026] [:error] [pid 20641:tid 20661] [client 192.253.209.114:54051] [client 192.253.209.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adbrUW3LksBSF-6rlkaizAAAANA"]
[Thu Apr 09 07:57:07.377130 2026] [:error] [pid 22627:tid 22637] [client 192.253.209.124:53573] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adbrU_r8glsF_jKQpr5m_gAAAQc"]
[Thu Apr 09 07:57:08.759162 2026] [:error] [pid 20535:tid 20556] [client 192.253.209.149:41005] [client 192.253.209.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adbrVAWiD9hWnEUHWdNvjwAAAAw"]
[Thu Apr 09 07:57:10.612627 2026] [:error] [pid 20641:tid 20663] [client 192.253.209.160:63253] [client 192.253.209.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adbrVm3LksBSF-6rlkai2AAAANI"]
[Thu Apr 09 07:57:15.274497 2026] [:error] [pid 20641:tid 20662] [client 192.253.209.132:22779] [client 192.253.209.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adbrW23LksBSF-6rlkai7gAAANE"]
[Thu Apr 09 07:57:16.209916 2026] [:error] [pid 22627:tid 22636] [client 192.253.209.108:25289] [client 192.253.209.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adbrXPr8glsF_jKQpr5nEwAAAQY"]
[Thu Apr 09 07:57:18.951609 2026] [:error] [pid 22627:tid 22636] [client 192.253.209.120:30943] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adbrXvr8glsF_jKQpr5nKgAAAQY"]
[Thu Apr 09 07:57:19.872494 2026] [:error] [pid 22627:tid 22633] [client 192.253.209.137:24007] [client 192.253.209.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adbrX_r8glsF_jKQpr5nLwAAAQM"]
[Thu Apr 09 07:57:21.736467 2026] [:error] [pid 20641:tid 20646] [client 192.253.209.117:28069] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "adbrYW3LksBSF-6rlkai9gAAAME"]
[Thu Apr 09 07:57:22.659056 2026] [:error] [pid 20535:tid 20545] [client 192.253.209.137:64875] [client 192.253.209.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "adbrYgWiD9hWnEUHWdNvqAAAAAE"]
[Thu Apr 09 07:57:23.708765 2026] [:error] [pid 20536:tid 20579] [client 192.253.209.113:50259] [client 192.253.209.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.113, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "adbrY8PqyUJM1s3YpIZGxAAAAEg"]
[Thu Apr 09 07:57:23.712959 2026] [:error] [pid 20536:tid 20579] [client 192.253.209.113:50259] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Thu Apr 09 07:57:24.175036 2026] [:error] [pid 20536:tid 20575] [client 192.253.209.113:50259] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "adbrZMPqyUJM1s3YpIZGxQAAAEQ"]
[Thu Apr 09 07:57:25.566896 2026] [:error] [pid 20537:tid 20618] [client 192.253.209.158:37235] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Thu Apr 09 07:57:26.021437 2026] [:error] [pid 20537:tid 20604] [client 192.253.209.158:37235] [client 192.253.209.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "adbrZsSTjpSeyrxLmN49kwAAAIY"]
[Thu Apr 09 07:57:26.947906 2026] [:error] [pid 22627:tid 22639] [client 192.253.209.119:38177] [client 192.253.209.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/network.php"] [unique_id "adbrZvr8glsF_jKQpr5nRwAAAQk"]
[Thu Apr 09 07:57:27.871882 2026] [:error] [pid 20641:tid 20648] [client 192.253.209.120:52005] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Thu Apr 09 07:57:31.220781 2026] [:error] [pid 20641:tid 20661] [client 192.253.209.120:52005] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "adbra23LksBSF-6rlkajFwAAANA"]
[Thu Apr 09 07:57:32.133539 2026] [:error] [pid 20537:tid 20602] [client 192.253.209.161:35277] [client 192.253.209.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "adbrbMSTjpSeyrxLmN49sgAAAIQ"]
[Thu Apr 09 07:57:34.072226 2026] [:error] [pid 20537:tid 20603] [client 192.253.209.148:45715] [client 192.253.209.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "adbrbsSTjpSeyrxLmN49vQAAAIU"]
[Thu Apr 09 07:57:34.978876 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.164:43377] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "adbrbgWiD9hWnEUHWdNvugAAABM"]
[Thu Apr 09 07:57:35.922120 2026] [:error] [pid 20536:tid 20576] [client 192.253.209.154:52665] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Thu Apr 09 07:57:36.404013 2026] [:error] [pid 20536:tid 20571] [client 192.253.209.154:52665] [client 192.253.209.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.154, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "adbrcMPqyUJM1s3YpIZG2AAAAEA"]
[Thu Apr 09 07:57:37.322487 2026] [:error] [pid 20536:tid 20583] [client 192.253.209.154:52665] [client 192.253.209.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "adbrccPqyUJM1s3YpIZG7AAAAEw"]
[Thu Apr 09 07:57:39.633835 2026] [:error] [pid 22627:tid 22635] [client 192.253.209.165:44425] [client 192.253.209.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "adbrc_r8glsF_jKQpr5niQAAAQU"]
[Thu Apr 09 07:57:40.549078 2026] [:error] [pid 20641:tid 20645] [client 192.253.209.152:33571] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Thu Apr 09 07:57:41.013036 2026] [:error] [pid 20641:tid 20646] [client 192.253.209.152:33571] [client 192.253.209.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "adbrdW3LksBSF-6rlkajyQAAAME"]
[Thu Apr 09 07:57:41.943843 2026] [:error] [pid 20536:tid 20587] [client 192.253.209.128:49999] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "adbrdcPqyUJM1s3YpIZG-wAAAFA"]
[Thu Apr 09 07:57:42.881807 2026] [:error] [pid 22627:tid 22639] [client 192.253.209.152:51289] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Thu Apr 09 07:57:44.284291 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.152:51289] [client 192.253.209.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "adbrePr8glsF_jKQpr5nlAAAARg"]
[Thu Apr 09 07:57:46.393269 2026] [:error] [pid 20537:tid 20622] [client 192.253.209.160:46661] [client 192.253.209.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adbresSTjpSeyrxLmN494gAAAJg"]
[Thu Apr 09 07:57:47.318733 2026] [:error] [pid 22627:tid 22641] [client 192.253.209.117:52825] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Thu Apr 09 07:57:48.253423 2026] [:error] [pid 22627:tid 22653] [client 192.253.209.117:52825] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Apr 09 07:57:49.185304 2026] [:error] [pid 22627:tid 22635] [client 192.253.209.117:52825] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "adbrffr8glsF_jKQpr5npwAAAQU"]
[Thu Apr 09 07:57:50.142946 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.155:43499] [client 192.253.209.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "adbrfvr8glsF_jKQpr5nrAAAARg"]
[Thu Apr 09 07:57:51.517836 2026] [:error] [pid 20535:tid 20553] [client 192.253.209.117:28415] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/count.php"] [unique_id "adbrfwWiD9hWnEUHWdNv5QAAAAk"]
[Thu Apr 09 07:57:52.447425 2026] [:error] [pid 20536:tid 20573] [client 192.253.209.114:38719] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Thu Apr 09 07:57:55.297981 2026] [:error] [pid 20536:tid 20586] [client 192.253.209.114:38719] [client 192.253.209.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "adbrg8PqyUJM1s3YpIZHGwAAAE8"]
[Thu Apr 09 07:57:57.132520 2026] [:error] [pid 20537:tid 20607] [client 192.253.209.124:61237] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||windfc.windfarmcoolants.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/stories/themes.php"] [unique_id "adbrhcSTjpSeyrxLmN499AAAAIk"]
[Thu Apr 09 07:57:57.589201 2026] [:error] [pid 20537:tid 20621] [client 192.253.209.124:61237] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "adbrhcSTjpSeyrxLmN499QAAAJc"]
[Thu Apr 09 07:57:59.421122 2026] [:error] [pid 22627:tid 22646] [client 192.253.209.164:21621] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "adbrh_r8glsF_jKQpr5nxAAAARA"]
[Thu Apr 09 07:58:00.334656 2026] [:error] [pid 20535:tid 20568] [client 192.253.209.117:48795] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "adbriAWiD9hWnEUHWdNwEQAAABg"]
[Thu Apr 09 07:58:02.277504 2026] [:error] [pid 20535:tid 20549] [client 192.253.209.126:27785] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Apr 09 07:58:04.139441 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.126:27785] [client 192.253.209.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "adbrjAWiD9hWnEUHWdNwJQAAAAY"]
[Thu Apr 09 07:58:06.000633 2026] [:error] [pid 20535:tid 20564] [client 192.253.209.126:40109] [client 192.253.209.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "adbrjQWiD9hWnEUHWdNwKAAAABQ"]
[Thu Apr 09 07:58:07.380522 2026] [:error] [pid 20641:tid 20660] [client 192.253.209.165:25313] [client 192.253.209.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "adbrj23LksBSF-6rlkaj7AAAAM8"]
[Thu Apr 09 07:58:08.320939 2026] [:error] [pid 20535:tid 20561] [client 192.253.209.120:50575] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Thu Apr 09 07:58:10.650439 2026] [:error] [pid 20535:tid 20561] [client 192.253.209.120:50575] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "adbrkgWiD9hWnEUHWdNwNQAAABE"]
[Thu Apr 09 07:58:11.595662 2026] [:error] [pid 20537:tid 20598] [client 192.253.209.123:56883] [client 192.253.209.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/colour.php"] [unique_id "adbrk8STjpSeyrxLmN4-DQAAAIA"]
[Thu Apr 09 07:58:12.514592 2026] [:error] [pid 20535:tid 20545] [client 192.253.209.144:33131] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Apr 09 07:58:12.969594 2026] [:error] [pid 20535:tid 20553] [client 192.253.209.144:33131] [client 192.253.209.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "adbrlAWiD9hWnEUHWdNwQAAAAAk"]
[Thu Apr 09 07:58:13.905475 2026] [:error] [pid 22627:tid 22650] [client 192.253.209.115:23821] [client 192.253.209.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "adbrlfr8glsF_jKQpr5n9wAAARQ"]
[Thu Apr 09 07:58:15.745464 2026] [:error] [pid 22627:tid 22630] [client 192.253.209.138:23559] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "adbrl_r8glsF_jKQpr5oBAAAAQA"]
[Thu Apr 09 07:58:17.595265 2026] [:error] [pid 20641:tid 20662] [client 192.253.209.132:24371] [client 192.253.209.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "adbrmW3LksBSF-6rlkakCQAAANE"]
[Thu Apr 09 07:58:18.528132 2026] [:error] [pid 20537:tid 20615] [client 192.253.209.139:35881] [client 192.253.209.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "adbrmsSTjpSeyrxLmN4-GwAAAJE"]
[Thu Apr 09 07:58:21.332010 2026] [:error] [pid 20536:tid 20579] [client 192.253.209.109:27047] [client 192.253.209.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "adbrncPqyUJM1s3YpIZHQwAAAEg"]
[Thu Apr 09 07:58:24.404521 2026] [:error] [pid 20536:tid 20593] [client 192.253.209.117:44701] [client 192.253.209.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "adbroMPqyUJM1s3YpIZHTQAAAFY"]
[Thu Apr 09 07:58:25.395783 2026] [:error] [pid 20537:tid 20601] [client 192.253.209.121:23853] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Thu Apr 09 07:58:26.821622 2026] [:error] [pid 20537:tid 20607] [client 192.253.209.121:23853] [client 192.253.209.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "adbrosSTjpSeyrxLmN4-LwAAAIk"]
[Thu Apr 09 07:58:27.797963 2026] [:error] [pid 20537:tid 20618] [client 192.253.209.129:50497] [client 192.253.209.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "adbro8STjpSeyrxLmN4-MQAAAJQ"]
[Thu Apr 09 07:58:28.727195 2026] [:error] [pid 20537:tid 20615] [client 192.253.209.119:65079] [client 192.253.209.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "adbrpMSTjpSeyrxLmN4-NAAAAJE"]
[Thu Apr 09 07:58:29.664524 2026] [:error] [pid 20537:tid 20600] [client 192.253.209.138:33499] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Thu Apr 09 07:58:30.584355 2026] [:error] [pid 20537:tid 20607] [client 192.253.209.138:33499] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "adbrpsSTjpSeyrxLmN4-QwAAAIk"]
[Thu Apr 09 07:58:31.515765 2026] [:error] [pid 22627:tid 22649] [client 192.253.209.161:58959] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Thu Apr 09 07:58:32.435897 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.161:58959] [client 192.253.209.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "adbrqPr8glsF_jKQpr5oKQAAAQg"]
[Thu Apr 09 07:58:33.352430 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.121:33395] [client 192.253.209.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "adbrqQWiD9hWnEUHWdNwhAAAAAM"]
[Thu Apr 09 07:58:34.728115 2026] [:error] [pid 20537:tid 20598] [client 192.253.209.152:34851] [client 192.253.209.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "adbrqsSTjpSeyrxLmN4-SQAAAIA"]
[Thu Apr 09 07:58:35.668367 2026] [:error] [pid 20537:tid 20619] [client 192.253.209.128:28969] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "adbrq8STjpSeyrxLmN4-TAAAAJU"]
[Thu Apr 09 07:58:37.537268 2026] [:error] [pid 20537:tid 20622] [client 192.253.209.124:44467] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "adbrrcSTjpSeyrxLmN4-UgAAAJg"]
[Thu Apr 09 07:58:38.931346 2026] [:error] [pid 20537:tid 20614] [client 192.253.209.142:57037] [client 192.253.209.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "adbrrsSTjpSeyrxLmN4-VgAAAJA"]
[Thu Apr 09 07:58:39.857380 2026] [:error] [pid 20537:tid 20615] [client 192.253.209.132:64981] [client 192.253.209.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adbrr8STjpSeyrxLmN4-WAAAAJE"]
[Thu Apr 09 07:58:40.780357 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.147:50123] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "adbrsAWiD9hWnEUHWdNwjwAAAAo"]
[Thu Apr 09 07:58:42.634620 2026] [:error] [pid 20535:tid 20554] [client 192.253.209.119:23483] [client 192.253.209.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "adbrsgWiD9hWnEUHWdNwnQAAAAo"]
[Thu Apr 09 07:58:44.466053 2026] [:error] [pid 20535:tid 20548] [client 192.253.209.118:57487] [client 192.253.209.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "adbrtAWiD9hWnEUHWdNwqAAAAAQ"]
[Thu Apr 09 07:58:45.867117 2026] [:error] [pid 22627:tid 22641] [client 192.253.209.147:37135] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "adbrtfr8glsF_jKQpr5oPwAAAQs"]
[Thu Apr 09 07:58:47.287547 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.141:47139] [client 192.253.209.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "adbrtwWiD9hWnEUHWdNwrQAAABM"]
[Thu Apr 09 07:58:49.158696 2026] [:error] [pid 20537:tid 20612] [client 192.253.209.145:27423] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Thu Apr 09 07:58:50.995181 2026] [:error] [pid 20537:tid 20611] [client 192.253.209.145:27423] [client 192.253.209.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "adbrusSTjpSeyrxLmN4-bAAAAI0"]
[Thu Apr 09 07:58:51.951042 2026] [:error] [pid 22627:tid 22645] [client 192.253.209.122:63667] [client 192.253.209.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "adbru_r8glsF_jKQpr5oWwAAAQ8"]
[Thu Apr 09 07:58:53.328328 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.136:40969] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Thu Apr 09 07:58:53.792437 2026] [:error] [pid 22627:tid 22647] [client 192.253.209.136:40969] [client 192.253.209.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "adbrvfr8glsF_jKQpr5oaAAAARE"]
[Thu Apr 09 07:58:56.557952 2026] [:error] [pid 22627:tid 22633] [client 192.253.209.134:28693] [client 192.253.209.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "adbrwPr8glsF_jKQpr5oeAAAAQM"]
[Thu Apr 09 07:58:57.956149 2026] [:error] [pid 20535:tid 20561] [client 192.253.209.131:40745] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Thu Apr 09 07:58:58.411703 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.131:40745] [client 192.253.209.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "adbrwgWiD9hWnEUHWdNwyAAAAAs"]
[Thu Apr 09 07:59:00.239162 2026] [:error] [pid 22627:tid 22637] [client 192.253.209.147:49081] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "adbrxPr8glsF_jKQpr5ogwAAAQc"]
[Thu Apr 09 07:59:01.319467 2026] [:error] [pid 22627:tid 22654] [client 192.253.209.121:61613] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Thu Apr 09 07:59:01.772651 2026] [:error] [pid 22627:tid 22651] [client 192.253.209.121:61613] [client 192.253.209.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "adbrxfr8glsF_jKQpr5oiQAAARU"]
[Thu Apr 09 07:59:03.166097 2026] [:error] [pid 20535:tid 20548] [client 192.253.209.139:42471] [client 192.253.209.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "adbrxwWiD9hWnEUHWdNw0QAAAAQ"]
[Thu Apr 09 07:59:05.495761 2026] [:error] [pid 20641:tid 20667] [client 192.253.209.135:41457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Thu Apr 09 07:59:05.950475 2026] [:error] [pid 20641:tid 20664] [client 192.253.209.135:41457] [client 192.253.209.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "adbryW3LksBSF-6rlkakQQAAANM"]
[Thu Apr 09 07:59:08.255591 2026] [:error] [pid 22627:tid 22633] [client 192.253.209.163:29221] [client 192.253.209.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "adbrzPr8glsF_jKQpr5oogAAAQM"]
[Thu Apr 09 07:59:09.180082 2026] [:error] [pid 20536:tid 20577] [client 192.253.209.164:27039] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Thu Apr 09 07:59:09.643672 2026] [:error] [pid 20536:tid 20587] [client 192.253.209.164:27039] [client 192.253.209.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "adbrzcPqyUJM1s3YpIZHgQAAAFA"]
[Thu Apr 09 07:59:10.559678 2026] [:error] [pid 20537:tid 20607] [client 192.253.209.116:39547] [client 192.253.209.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "adbrzsSTjpSeyrxLmN4-igAAAIk"]
[Thu Apr 09 07:59:11.490340 2026] [:error] [pid 22627:tid 22653] [client 192.253.209.111:50079] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Thu Apr 09 07:59:12.432415 2026] [:error] [pid 22627:tid 22649] [client 192.253.209.111:50079] [client 192.253.209.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "adbr0Pr8glsF_jKQpr5orwAAARM"]
[Thu Apr 09 07:59:13.353541 2026] [:error] [pid 20536:tid 20576] [client 192.253.209.125:26129] [client 192.253.209.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "adbr0cPqyUJM1s3YpIZHiAAAAEU"]
[Thu Apr 09 07:59:17.055382 2026] [:error] [pid 22627:tid 22632] [client 192.253.209.119:46235] [client 192.253.209.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "adbr1fr8glsF_jKQpr5oywAAAQI"]
[Thu Apr 09 07:59:17.966276 2026] [:error] [pid 20641:tid 20648] [client 192.253.209.139:44825] [client 192.253.209.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "adbr1W3LksBSF-6rlkakTwAAAMM"]
[Thu Apr 09 07:59:20.300894 2026] [:error] [pid 22627:tid 22649] [client 192.253.209.111:52233] [client 192.253.209.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/log.php"] [unique_id "adbr2Pr8glsF_jKQpr5o1wAAARM"]
[Thu Apr 09 07:59:21.215251 2026] [:error] [pid 22627:tid 22630] [client 192.253.209.154:61087] [client 192.253.209.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "adbr2fr8glsF_jKQpr5o3AAAAQA"]
[Thu Apr 09 07:59:22.140192 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.113:42867] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "adbr2gWiD9hWnEUHWdNw7wAAAAM"]
[Thu Apr 09 07:59:23.083583 2026] [:error] [pid 20536:tid 20581] [client 192.253.209.148:40569] [client 192.253.209.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/aw.php"] [unique_id "adbr28PqyUJM1s3YpIZHlAAAAEo"]
[Thu Apr 09 07:59:25.837410 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.138:21949] [client 192.253.209.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "adbr3fr8glsF_jKQpr5o5wAAAQ4"]
[Thu Apr 09 07:59:26.757210 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.131:38913] [client 192.253.209.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "adbr3gWiD9hWnEUHWdNw9wAAAA0"]
[Thu Apr 09 07:59:28.162307 2026] [:error] [pid 20535:tid 20550] [client 192.253.209.158:45473] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Thu Apr 09 07:59:28.616520 2026] [:error] [pid 20535:tid 20559] [client 192.253.209.158:45473] [client 192.253.209.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "adbr4AWiD9hWnEUHWdNxAgAAAA8"]
[Thu Apr 09 07:59:29.557342 2026] [:error] [pid 20535:tid 20546] [client 192.253.209.123:60435] [client 192.253.209.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "adbr4QWiD9hWnEUHWdNxCQAAAAI"]
[Thu Apr 09 07:59:31.500014 2026] [:error] [pid 20535:tid 20555] [client 192.253.209.155:23455] [client 192.253.209.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "adbr4wWiD9hWnEUHWdNxEAAAAAs"]
[Thu Apr 09 07:59:32.409078 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.147:21481] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "adbr5Pr8glsF_jKQpr5o8gAAAQ4"]
[Thu Apr 09 07:59:36.622772 2026] [:error] [pid 20641:tid 20650] [client 192.253.209.128:26517] [client 192.253.209.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "adbr6G3LksBSF-6rlkakbwAAAMU"]
[Thu Apr 09 07:59:37.530092 2026] [:error] [pid 22627:tid 22649] [client 192.253.209.120:42311] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "adbr6fr8glsF_jKQpr5pgAAAARM"]
[Thu Apr 09 07:59:40.807040 2026] [:error] [pid 20641:tid 20651] [client 192.253.209.136:54485] [client 192.253.209.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/file.php"] [unique_id "adbr7G3LksBSF-6rlkakewAAAMY"]
[Thu Apr 09 07:59:42.184127 2026] [:error] [pid 22627:tid 22649] [client 192.253.209.134:57951] [client 192.253.209.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "adbr7vr8glsF_jKQpr5pjQAAARM"]
[Thu Apr 09 07:59:43.570449 2026] [:error] [pid 20535:tid 20563] [client 192.253.209.113:57227] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/load.php"] [unique_id "adbr7wWiD9hWnEUHWdNxVQAAABM"]
[Thu Apr 09 07:59:44.485209 2026] [:error] [pid 22627:tid 22633] [client 192.253.209.158:65273] [client 192.253.209.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "adbr8Pr8glsF_jKQpr5pmgAAAQM"]
[Thu Apr 09 07:59:45.409369 2026] [:error] [pid 20535:tid 20557] [client 192.253.209.127:43891] [client 192.253.209.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "adbr8QWiD9hWnEUHWdNxVwAAAA0"]
[Thu Apr 09 07:59:47.726611 2026] [:error] [pid 20535:tid 20562] [client 192.253.209.124:50727] [client 192.253.209.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "adbr8wWiD9hWnEUHWdNxZQAAABI"]
[Thu Apr 09 07:59:48.654978 2026] [:error] [pid 20536:tid 20576] [client 192.253.209.158:62433] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Thu Apr 09 07:59:49.108676 2026] [:error] [pid 20536:tid 20581] [client 192.253.209.158:62433] [client 192.253.209.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "adbr9cPqyUJM1s3YpIZHrwAAAEo"]
[Thu Apr 09 07:59:50.504641 2026] [:error] [pid 20537:tid 20609] [client 192.253.209.145:36135] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Thu Apr 09 07:59:50.962583 2026] [:error] [pid 20537:tid 20605] [client 192.253.209.145:36135] [client 192.253.209.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "adbr9sSTjpSeyrxLmN4-0QAAAIc"]
[Thu Apr 09 07:59:51.881686 2026] [:error] [pid 22627:tid 22634] [client 192.253.209.155:52235] [client 192.253.209.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "adbr9_r8glsF_jKQpr5psQAAAQQ"]
[Thu Apr 09 07:59:52.800329 2026] [:error] [pid 20535:tid 20561] [client 192.253.209.135:30159] [client 192.253.209.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "adbr-AWiD9hWnEUHWdNxagAAABE"]
[Thu Apr 09 07:59:55.563268 2026] [:error] [pid 20535:tid 20547] [client 192.253.209.126:34033] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Apr 09 07:59:57.402386 2026] [:error] [pid 20535:tid 20559] [client 192.253.209.126:34033] [client 192.253.209.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "adbr_QWiD9hWnEUHWdNxdgAAAA8"]
[Thu Apr 09 07:59:58.790933 2026] [:error] [pid 20537:tid 20612] [client 192.253.209.137:43311] [client 192.253.209.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "adbr_sSTjpSeyrxLmN4-2QAAAI4"]
[Thu Apr 09 08:00:00.811665 2026] [:error] [pid 20537:tid 20610] [client 192.253.209.152:61427] [client 192.253.209.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "adbsAMSTjpSeyrxLmN4-5QAAAIw"]
[Thu Apr 09 08:00:01.765049 2026] [:error] [pid 20537:tid 20598] [client 192.253.209.120:31879] [client 192.253.209.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "adbsAcSTjpSeyrxLmN4-6gAAAIA"]
[Thu Apr 09 08:00:02.684772 2026] [:error] [pid 20535:tid 20558] [client 192.253.209.111:41195] [client 192.253.209.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "adbsAgWiD9hWnEUHWdNxiQAAAA4"]
[Thu Apr 09 08:00:04.531527 2026] [:error] [pid 20641:tid 20669] [client 192.253.209.109:59953] [client 192.253.209.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "adbsBG3LksBSF-6rlkakngAAANg"]
[Thu Apr 09 08:00:08.717012 2026] [:error] [pid 20641:tid 20663] [client 192.253.209.147:43779] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ms-pie.php"] [unique_id "adbsCG3LksBSF-6rlkaksgAAANI"]
[Thu Apr 09 08:00:13.070588 2026] [:error] [pid 22627:tid 22638] [client 192.253.209.134:45763] [client 192.253.209.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "adbsDfr8glsF_jKQpr5p8QAAAQg"]
[Thu Apr 09 08:00:14.924792 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.132:36799] [client 192.253.209.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/nav-menu.php"] [unique_id "adbsDvr8glsF_jKQpr5p9wAAAQ4"]
[Thu Apr 09 08:00:15.844488 2026] [:error] [pid 20641:tid 20664] [client 192.253.209.142:54719] [client 192.253.209.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/user.php"] [unique_id "adbsD23LksBSF-6rlkakywAAANM"]
[Thu Apr 09 08:00:21.971049 2026] [:error] [pid 22627:tid 22643] [client 192.253.209.165:25577] [client 192.253.209.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "adbsFfr8glsF_jKQpr5qLAAAAQ0"]
[Thu Apr 09 08:00:22.963833 2026] [:error] [pid 22627:tid 22633] [client 192.253.209.147:58509] [client 192.253.209.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "adbsFvr8glsF_jKQpr5qMQAAAQM"]
[Thu Apr 09 08:00:23.894650 2026] [:error] [pid 20535:tid 20551] [client 192.253.209.155:42227] [client 192.253.209.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "adbsFwWiD9hWnEUHWdNx4wAAAAc"]
[Thu Apr 09 08:00:25.363490 2026] [:error] [pid 20537:tid 20607] [client 192.253.209.136:52343] [client 192.253.209.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.253.209.136, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "adbsGcSTjpSeyrxLmN4-9QAAAIk"]
[Thu Apr 09 08:00:26.283744 2026] [:error] [pid 20537:tid 20619] [client 192.253.209.136:52343] [client 192.253.209.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "adbsGsSTjpSeyrxLmN4-9wAAAJU"]
[Thu Apr 09 08:00:27.212496 2026] [:error] [pid 22627:tid 22637] [client 192.253.209.152:24325] [client 192.253.209.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "adbsG_r8glsF_jKQpr5qPwAAAQc"]
[Thu Apr 09 08:00:28.130302 2026] [:error] [pid 20536:tid 20591] [client 192.253.209.165:60037] [client 192.253.209.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "adbsHMPqyUJM1s3YpIZHzQAAAFQ"]
[Thu Apr 09 08:00:32.055853 2026] [:error] [pid 22627:tid 22648] [client 192.253.209.143:46539] [client 192.253.209.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "adbsIPr8glsF_jKQpr5qWgAAARI"]
[Thu Apr 09 08:00:36.276409 2026] [:error] [pid 20537:tid 20616] [client 192.253.209.116:62041] [client 192.253.209.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "adbsJMSTjpSeyrxLmN4_DQAAAJI"]
[Thu Apr 09 08:00:38.125658 2026] [:error] [pid 20537:tid 20604] [client 192.253.209.134:63041] [client 192.253.209.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "adbsJsSTjpSeyrxLmN4_FQAAAIY"]
[Thu Apr 09 08:00:44.767176 2026] [:error] [pid 20536:tid 20590] [client 192.253.209.162:46997] [client 192.253.209.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "adbsLMPqyUJM1s3YpIZH-wAAAFM"]
[Thu Apr 09 08:00:45.691733 2026] [:error] [pid 22627:tid 22645] [client 192.253.209.158:27505] [client 192.253.209.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "adbsLfr8glsF_jKQpr5qhQAAAQ8"]
[Thu Apr 09 08:00:46.604105 2026] [:error] [pid 22627:tid 22643] [client 192.253.209.113:35527] [client 192.253.209.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/mer_gagal.php"] [unique_id "adbsLvr8glsF_jKQpr5qiwAAAQ0"]
[Thu Apr 09 08:00:47.534922 2026] [:error] [pid 22627:tid 22635] [client 192.253.209.162:65105] [client 192.253.209.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "adbsL_r8glsF_jKQpr5qkwAAAQU"]
[Thu Apr 09 08:00:49.899957 2026] [:error] [pid 22627:tid 22644] [client 192.253.209.150:46715] [client 192.253.209.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "adbsMfr8glsF_jKQpr5qnwAAAQ4"]
[Thu Apr 09 08:00:50.816760 2026] [:error] [pid 20535:tid 20545] [client 192.253.209.132:26317] [client 192.253.209.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "adbsMgWiD9hWnEUHWdNyCgAAAAE"]
[Thu Apr 09 08:00:54.043204 2026] [:error] [pid 22627:tid 22646] [client 192.253.209.152:34477] [client 192.253.209.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "adbsNvr8glsF_jKQpr5qtwAAARA"]
[Thu Apr 09 08:00:56.794469 2026] [:error] [pid 20535:tid 20567] [client 192.253.209.162:51469] [client 192.253.209.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "adbsOAWiD9hWnEUHWdNyHwAAABc"]
[Thu Apr 09 08:00:57.743317 2026] [:error] [pid 22627:tid 22653] [client 192.253.209.162:45381] [client 192.253.209.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "adbsOfr8glsF_jKQpr5q4wAAARc"]
[Thu Apr 09 08:01:42.438128 2026] [autoindex:error] [pid 20537:tid 20611] [client 192.253.209.110:34783] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 22:31:54.790071 2026] [:error] [pid 20837:tid 20855] [client 172.213.2.23:35283] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 23:24:37.620038 2026] [:error] [pid 24516:tid 24561] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/green.php
[Thu Apr 09 23:24:37.886250 2026] [:error] [pid 24516:tid 24563] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/6xBAm3vODE05BSzkJZRAws.php
[Thu Apr 09 23:24:38.155077 2026] [:error] [pid 24516:tid 24570] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Thu Apr 09 23:24:38.436783 2026] [:error] [pid 24516:tid 24550] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Thu Apr 09 23:24:38.701863 2026] [:error] [pid 24516:tid 24569] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/5xkfgawzejgwqh9hiaznCdefault.php
[Thu Apr 09 23:24:38.968653 2026] [:error] [pid 24516:tid 24558] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Thu Apr 09 23:24:39.247446 2026] [:error] [pid 24516:tid 24555] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Thu Apr 09 23:24:39.534555 2026] [:error] [pid 24516:tid 24564] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 23:24:39.800271 2026] [:error] [pid 24516:tid 24547] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Thu Apr 09 23:24:40.065759 2026] [:error] [pid 24516:tid 24568] [client 4.225.204.246:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Thu Apr 09 23:24:40.329835 2026] [:error] [pid 24516:tid 24565] [client 4.225.204.246:21195] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "adfEuNhW7vSS-UkeWCVC1gAAAFI"]
[Thu Apr 09 23:24:44.708718 2026] [:error] [pid 18477:tid 18491] [client 4.225.204.246:1138] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "adfEvMDe826HlFeoLPKxbwAAAUw"]
[Thu Apr 09 23:24:49.950863 2026] [:error] [pid 24624:tid 24646] [client 4.225.204.246:25869] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "adfEwe4Jn-WvK1ZBTvj8AQAAANQ"]
[Thu Apr 09 23:24:51.888344 2026] [:error] [pid 24517:tid 24589] [client 4.225.204.246:16421] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "adfEw3boYEn2ZFM_PS-OagAAAI8"]
[Thu Apr 09 23:24:53.808569 2026] [:error] [pid 24624:tid 24644] [client 4.225.204.246:32349] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "adfExe4Jn-WvK1ZBTvj8BwAAANI"]
[Thu Apr 09 23:24:56.685143 2026] [:error] [pid 24927:tid 24951] [client 4.225.204.246:30240] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "adfEyDXObuzEuw8mNJs7owAAARU"]
[Thu Apr 09 23:24:57.711404 2026] [:error] [pid 24927:tid 24936] [client 4.225.204.246:35942] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "adfEyTXObuzEuw8mNJs7rQAAAQY"]
[Thu Apr 09 23:25:00.254332 2026] [:error] [pid 24515:tid 24543] [client 4.225.204.246:30211] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "adfEzK1OMnvM2fMnB1P9AAAAABg"]
[Thu Apr 09 23:25:03.493226 2026] [:error] [pid 20837:tid 20861] [client 4.225.204.246:32334] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "adfEz_SL71FHZkjrGzMZMAAAAZY"]
[Thu Apr 09 23:25:07.878435 2026] [:error] [pid 18477:tid 18490] [client 4.225.204.246:37099] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "adfE08De826HlFeoLPKxhgAAAUs"]
[Thu Apr 09 23:25:10.397830 2026] [:error] [pid 24515:tid 24543] [client 4.225.204.246:37525] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "adfE1q1OMnvM2fMnB1P9CAAAABg"]
[Thu Apr 09 23:25:11.571576 2026] [:error] [pid 24515:tid 24537] [client 4.225.204.246:32176] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "adfE161OMnvM2fMnB1P9CgAAABI"]
[Thu Apr 09 23:25:15.182749 2026] [:error] [pid 20837:tid 20839] [client 4.225.204.246:22227] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pass4.php"] [unique_id "adfE2_SL71FHZkjrGzMZOAAAAYA"]
[Thu Apr 09 23:25:19.151394 2026] [:error] [pid 24515:tid 24530] [client 4.225.204.246:32157] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pass4.php"] [unique_id "adfE361OMnvM2fMnB1P9FwAAAAs"]
[Thu Apr 09 23:25:21.454081 2026] [:error] [pid 24515:tid 24538] [client 4.225.204.246:13312] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pass4.php"] [unique_id "adfE4a1OMnvM2fMnB1P9GwAAABM"]
[Thu Apr 09 23:25:23.455216 2026] [:error] [pid 24927:tid 24947] [client 4.225.204.246:37085] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pass4.php"] [unique_id "adfE4zXObuzEuw8mNJs7wQAAARE"]
[Thu Apr 09 23:25:25.628724 2026] [:error] [pid 24927:tid 24941] [client 4.225.204.246:32174] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "adfE5TXObuzEuw8mNJs7wgAAAQs"]
[Thu Apr 09 23:25:27.503931 2026] [:error] [pid 18477:tid 18493] [client 4.225.204.246:32164] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "adfE58De826HlFeoLPKxiQAAAU4"]
[Thu Apr 09 23:25:28.842329 2026] [:error] [pid 24624:tid 24633] [client 4.225.204.246:15708] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "adfE6O4Jn-WvK1ZBTvj8EwAAAMc"]
[Thu Apr 09 23:25:30.980139 2026] [:error] [pid 63331:tid 63350] [client 4.225.204.246:13795] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "adfE6ibKfIYuVjWbE4Wl9gAAAdE"]
[Thu Apr 09 23:25:32.043903 2026] [:error] [pid 24516:tid 24565] [client 4.225.204.246:13665] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "adfE7NhW7vSS-UkeWCVC4AAAAFI"]
[Thu Apr 09 23:25:36.652916 2026] [:error] [pid 24515:tid 24540] [client 4.225.204.246:17459] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "adfE8K1OMnvM2fMnB1P9IgAAABU"]
[Thu Apr 09 23:25:38.983880 2026] [:error] [pid 24624:tid 24629] [client 4.225.204.246:20374] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "adfE8u4Jn-WvK1ZBTvj8GQAAAMM"]
[Thu Apr 09 23:25:40.546332 2026] [:error] [pid 24515:tid 24522] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Thu Apr 09 23:25:40.812310 2026] [:error] [pid 24515:tid 24536] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Thu Apr 09 23:25:41.078079 2026] [:error] [pid 24515:tid 24530] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Apr 09 23:25:41.372506 2026] [:error] [pid 24515:tid 24541] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Thu Apr 09 23:25:41.638614 2026] [:error] [pid 24515:tid 24524] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Thu Apr 09 23:25:41.918338 2026] [:error] [pid 24515:tid 24521] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Thu Apr 09 23:25:42.187770 2026] [:error] [pid 24515:tid 24523] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Thu Apr 09 23:25:42.454038 2026] [:error] [pid 24515:tid 24542] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Thu Apr 09 23:25:42.723475 2026] [:error] [pid 24515:tid 24527] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Thu Apr 09 23:25:42.989932 2026] [:error] [pid 24515:tid 24531] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu Apr 09 23:25:43.258374 2026] [:error] [pid 24515:tid 24532] [client 4.225.204.246:19840] File does not exist: /usr/local/apache/htdocs/suspended-page/mI35rZhMg1zJ1vuXdefault.php
[Thu Apr 09 23:25:44.787175 2026] [:error] [pid 24515:tid 24532] [client 4.225.204.246:19840] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adfE-K1OMnvM2fMnB1P9QQAAAA0"]
[Thu Apr 09 23:25:46.493584 2026] [:error] [pid 24515:tid 24541] [client 4.225.204.246:18696] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adfE-q1OMnvM2fMnB1P9QgAAABY"]
[Thu Apr 09 23:25:49.033679 2026] [:error] [pid 24624:tid 24643] [client 4.225.204.246:21180] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adfE_e4Jn-WvK1ZBTvj8HwAAANE"]
[Thu Apr 09 23:25:51.825589 2026] [:error] [pid 24624:tid 24649] [client 4.225.204.246:27053] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adfE_-4Jn-WvK1ZBTvj8JQAAANc"]
[Thu Apr 09 23:25:52.942491 2026] [:error] [pid 24516:tid 24567] [client 4.225.204.246:19291] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfFANhW7vSS-UkeWCVC4QAAAFQ"]
[Thu Apr 09 23:25:55.250122 2026] [:error] [pid 24515:tid 24521] [client 4.225.204.246:31957] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfFA61OMnvM2fMnB1P9RAAAAAI"]
[Thu Apr 09 23:25:56.587574 2026] [:error] [pid 24515:tid 24523] [client 4.225.204.246:25971] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfFBK1OMnvM2fMnB1P9RgAAAAQ"]
[Thu Apr 09 23:25:59.518833 2026] [:error] [pid 24927:tid 24949] [client 4.225.204.246:12865] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfFBzXObuzEuw8mNJs71gAAARM"]
[Thu Apr 09 23:26:00.248648 2026] [:error] [pid 24516:tid 24552] [client 4.225.204.246:35550] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adfFCNhW7vSS-UkeWCVC4wAAAEU"]
[Thu Apr 09 23:26:02.583902 2026] [:error] [pid 63331:tid 63345] [client 4.225.204.246:25925] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adfFCibKfIYuVjWbE4WmAAAAAcw"]
[Thu Apr 09 23:26:04.494108 2026] [:error] [pid 18477:tid 18496] [client 4.225.204.246:27069] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adfFDMDe826HlFeoLPKxjwAAAVE"]
[Thu Apr 09 23:26:05.355234 2026] [:error] [pid 20837:tid 20858] [client 4.225.204.246:17881] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adfFDfSL71FHZkjrGzMZSgAAAZM"]
[Thu Apr 09 23:26:06.516590 2026] [:error] [pid 18477:tid 18482] [client 4.225.204.246:1061] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "adfFDsDe826HlFeoLPKxkgAAAUM"]
[Thu Apr 09 23:26:08.091523 2026] [:error] [pid 20837:tid 20853] [client 4.225.204.246:21755] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "adfFEPSL71FHZkjrGzMZUQAAAY4"]
[Thu Apr 09 23:26:09.894864 2026] [:error] [pid 18477:tid 18502] [client 4.225.204.246:1066] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "adfFEcDe826HlFeoLPKxlAAAAVc"]
[Thu Apr 09 23:26:12.078132 2026] [:error] [pid 20837:tid 20840] [client 4.225.204.246:17795] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "adfFFPSL71FHZkjrGzMZVQAAAYE"]
[Thu Apr 09 23:26:13.433827 2026] [:error] [pid 63331:tid 63338] [client 4.225.204.246:31367] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "adfFFSbKfIYuVjWbE4WmBQAAAcU"]
[Thu Apr 09 23:26:14.684539 2026] [:error] [pid 24515:tid 24519] [client 4.225.204.246:15632] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "adfFFq1OMnvM2fMnB1P9UAAAAAA"]
[Thu Apr 09 23:26:17.639052 2026] [:error] [pid 24624:tid 24648] [client 4.225.204.246:20441] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "adfFGe4Jn-WvK1ZBTvj8MQAAANY"]
[Thu Apr 09 23:26:19.591587 2026] [:error] [pid 63331:tid 63336] [client 4.225.204.246:21718] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "adfFGybKfIYuVjWbE4WmEAAAAcM"]
[Thu Apr 09 23:26:21.111365 2026] [:error] [pid 18477:tid 18503] [client 4.225.204.246:13588] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "adfFHcDe826HlFeoLPKxmAAAAVg"]
[Thu Apr 09 23:26:24.160194 2026] [:error] [pid 24517:tid 24593] [client 4.225.204.246:14727] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "adfFIHboYEn2ZFM_PS-OjgAAAJM"]
[Thu Apr 09 23:26:26.763902 2026] [:error] [pid 24515:tid 24527] [client 4.225.204.246:29221] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "adfFIq1OMnvM2fMnB1P9VgAAAAg"]
[Thu Apr 09 23:26:28.712398 2026] [:error] [pid 24515:tid 24522] [client 4.225.204.246:20453] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "adfFJK1OMnvM2fMnB1P9WgAAAAM"]
[Thu Apr 09 23:26:31.084062 2026] [:error] [pid 18477:tid 18483] [client 4.225.204.246:29191] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adfFJ8De826HlFeoLPKxoAAAAUQ"]
[Thu Apr 09 23:26:32.676714 2026] [:error] [pid 24624:tid 24637] [client 4.225.204.246:1217] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adfFKO4Jn-WvK1ZBTvj8NAAAAMs"]
[Thu Apr 09 23:26:33.868632 2026] [:error] [pid 24515:tid 24532] [client 4.225.204.246:18790] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adfFKa1OMnvM2fMnB1P9XQAAAA0"]
[Thu Apr 09 23:26:37.454662 2026] [:error] [pid 24515:tid 24534] [client 4.225.204.246:31158] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adfFLa1OMnvM2fMnB1P9ZQAAAA8"]
[Thu Apr 09 23:26:39.701718 2026] [:error] [pid 24927:tid 24948] [client 4.225.204.246:19012] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adfFLzXObuzEuw8mNJs77AAAARI"]
[Thu Apr 09 23:26:43.398377 2026] [:error] [pid 24927:tid 24952] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Thu Apr 09 23:26:43.663367 2026] [:error] [pid 24927:tid 24939] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Thu Apr 09 23:26:45.035357 2026] [:error] [pid 24927:tid 24944] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Apr 09 23:26:45.323473 2026] [:error] [pid 24927:tid 24936] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Thu Apr 09 23:26:45.590981 2026] [:error] [pid 24927:tid 24940] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Apr 09 23:26:45.860834 2026] [:error] [pid 24927:tid 24949] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Thu Apr 09 23:26:46.144099 2026] [:error] [pid 24927:tid 24942] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/wlld5fjtdpjmjhsds3qzmipfCdefault.php
[Thu Apr 09 23:26:46.687305 2026] [:error] [pid 24927:tid 24933] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 09 23:26:46.951919 2026] [:error] [pid 24927:tid 24946] [client 4.225.204.246:31458] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Thu Apr 09 23:26:47.214009 2026] [:error] [pid 24927:tid 24953] [client 4.225.204.246:31458] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "adfFNzXObuzEuw8mNJs7_AAAARc"]
[Thu Apr 09 23:26:48.989245 2026] [:error] [pid 18477:tid 18496] [client 4.225.204.246:21397] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "adfFOMDe826HlFeoLPKxoQAAAVE"]
[Thu Apr 09 23:26:51.130358 2026] [:error] [pid 18477:tid 18482] [client 4.225.204.246:14913] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "adfFO8De826HlFeoLPKxpQAAAUM"]
[Thu Apr 09 23:26:53.377232 2026] [:error] [pid 24515:tid 24540] [client 4.225.204.246:14144] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "adfFPa1OMnvM2fMnB1P9egAAABU"]
[Thu Apr 09 23:26:56.400207 2026] [:error] [pid 18477:tid 18503] [client 4.225.204.246:28810] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "adfFQMDe826HlFeoLPKxrAAAAVg"]
[Thu Apr 09 23:26:58.457762 2026] [:error] [pid 24516:tid 24562] [client 4.225.204.246:37487] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "adfFQthW7vSS-UkeWCVC9AAAAE8"]
[Thu Apr 09 23:27:00.088615 2026] [:error] [pid 20837:tid 20839] [client 4.225.204.246:27362] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "adfFRPSL71FHZkjrGzMZXwAAAYA"]
[Thu Apr 09 23:27:02.620306 2026] [:error] [pid 20837:tid 20859] [client 4.225.204.246:35876] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "adfFRvSL71FHZkjrGzMZYgAAAZQ"]
[Thu Apr 09 23:27:04.090884 2026] [:error] [pid 18477:tid 18489] [client 4.225.204.246:31213] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "adfFSMDe826HlFeoLPKxtAAAAUo"]
[Thu Apr 09 23:27:06.307972 2026] [:error] [pid 24515:tid 24532] [client 4.225.204.246:27385] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "adfFSq1OMnvM2fMnB1P9hwAAAA0"]
[Thu Apr 09 23:27:08.374340 2026] [:error] [pid 24515:tid 24535] [client 4.225.204.246:28819] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "adfFTK1OMnvM2fMnB1P9iwAAABA"]
[Thu Apr 09 23:27:12.919283 2026] [:error] [pid 20837:tid 20862] [client 4.225.204.246:30331] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "adfFUPSL71FHZkjrGzMZaQAAAZc"]
[Thu Apr 09 23:27:15.153177 2026] [:error] [pid 24927:tid 24934] [client 4.225.204.246:35870] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "adfFUzXObuzEuw8mNJs7_wAAAQQ"]
[Thu Apr 09 23:27:16.305831 2026] [:error] [pid 24927:tid 24935] [client 4.225.204.246:18985] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "adfFVDXObuzEuw8mNJs8AAAAAQU"]
[Thu Apr 09 23:27:17.576702 2026] [:error] [pid 24927:tid 24930] [client 4.225.204.246:36089] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "adfFVTXObuzEuw8mNJs8AQAAAQA"]
[Thu Apr 09 23:27:18.810809 2026] [:error] [pid 24927:tid 24937] [client 4.225.204.246:14509] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "adfFVjXObuzEuw8mNJs8AgAAAQc"]
[Thu Apr 09 23:27:20.557113 2026] [:error] [pid 24516:tid 24558] [client 4.225.204.246:28485] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "adfFWNhW7vSS-UkeWCVC_wAAAEs"]
[Thu Apr 09 23:27:22.044493 2026] [:error] [pid 24624:tid 24642] [client 4.225.204.246:30333] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "adfFWu4Jn-WvK1ZBTvj8QgAAANA"]
[Thu Apr 09 23:27:26.548908 2026] [:error] [pid 63331:tid 63335] [client 4.225.204.246:19000] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "adfFXibKfIYuVjWbE4WmMwAAAcI"]
[Thu Apr 09 23:27:29.082893 2026] [:error] [pid 18477:tid 18491] [client 4.225.204.246:35868] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "adfFYcDe826HlFeoLPKxwQAAAUw"]
[Thu Apr 09 23:27:31.824301 2026] [:error] [pid 18477:tid 18486] [client 4.225.204.246:35865] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "adfFY8De826HlFeoLPKxwwAAAUc"]
[Thu Apr 09 23:27:33.814540 2026] [:error] [pid 24515:tid 24540] [client 4.225.204.246:24086] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "adfFZa1OMnvM2fMnB1P9lgAAABU"]
[Thu Apr 09 23:27:36.553530 2026] [:error] [pid 63331:tid 63352] [client 4.225.204.246:30317] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "adfFaCbKfIYuVjWbE4WmOAAAAdM"]
[Thu Apr 09 23:27:38.849387 2026] [:error] [pid 63331:tid 63343] [client 4.225.204.246:32389] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "adfFaibKfIYuVjWbE4WmPgAAAco"]
[Thu Apr 09 23:27:42.198802 2026] [:error] [pid 24517:tid 24580] [client 4.225.204.246:18124] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adfFbnboYEn2ZFM_PS-OpwAAAIY"]
[Thu Apr 09 23:27:44.343579 2026] [:error] [pid 24515:tid 24534] [client 4.225.204.246:24113] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adfFcK1OMnvM2fMnB1P9nwAAAA8"]
[Thu Apr 09 23:27:46.925950 2026] [:error] [pid 24515:tid 24525] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Thu Apr 09 23:27:47.191719 2026] [:error] [pid 24515:tid 24533] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Apr 09 23:27:47.469138 2026] [:error] [pid 24515:tid 24529] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Thu Apr 09 23:27:47.744946 2026] [:error] [pid 24515:tid 24543] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/ws87.php
[Thu Apr 09 23:27:48.020749 2026] [:error] [pid 24515:tid 24541] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Thu Apr 09 23:27:48.286273 2026] [:error] [pid 24515:tid 24524] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/new3.php
[Thu Apr 09 23:27:48.551517 2026] [:error] [pid 24515:tid 24538] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Thu Apr 09 23:27:48.817957 2026] [:error] [pid 24515:tid 24534] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Thu Apr 09 23:27:49.093728 2026] [:error] [pid 24515:tid 24520] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/t2gorhwasq4vioshtatw5eCdefault.php
[Thu Apr 09 23:27:49.359227 2026] [:error] [pid 24515:tid 24527] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Thu Apr 09 23:27:49.979178 2026] [:error] [pid 24515:tid 24542] [client 4.225.204.246:35882] File does not exist: /usr/local/apache/htdocs/suspended-page/b4txckoieeyhynhsrpi9lCdefault.php
[Thu Apr 09 23:27:50.241621 2026] [:error] [pid 24515:tid 24537] [client 4.225.204.246:35882] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "adfFdq1OMnvM2fMnB1P9tgAAABI"]
[Thu Apr 09 23:27:52.517183 2026] [:error] [pid 24515:tid 24525] [client 4.225.204.246:36060] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "adfFeK1OMnvM2fMnB1P9uQAAAAY"]
[Thu Apr 09 23:27:54.481975 2026] [:error] [pid 24927:tid 24944] [client 4.225.204.246:14564] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "adfFejXObuzEuw8mNJs8IQAAAQ4"]
[Thu Apr 09 23:27:58.879806 2026] [:error] [pid 18477:tid 18503] [client 4.225.204.246:35889] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "adfFfsDe826HlFeoLPKxxQAAAVg"]
[Thu Apr 09 23:28:01.839139 2026] [:error] [pid 24515:tid 24526] [client 4.225.204.246:28519] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "adfFga1OMnvM2fMnB1P9vwAAAAc"]
[Thu Apr 09 23:28:04.566869 2026] [:error] [pid 24515:tid 24527] [client 4.225.204.246:18119] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "adfFhK1OMnvM2fMnB1P9xwAAAAg"]
[Thu Apr 09 23:28:06.910537 2026] [:error] [pid 24516:tid 24556] [client 4.225.204.246:36068] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "adfFhthW7vSS-UkeWCVDCAAAAEk"]
[Thu Apr 09 23:28:11.002549 2026] [:error] [pid 24515:tid 24533] [client 4.225.204.246:20864] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "adfFi61OMnvM2fMnB1P9ywAAAA4"]
[Thu Apr 09 23:28:13.095629 2026] [:error] [pid 18477:tid 18500] [client 4.225.204.246:1606] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adfFjcDe826HlFeoLPKxxwAAAVU"]
[Thu Apr 09 23:28:14.389487 2026] [:error] [pid 24515:tid 24538] [client 4.225.204.246:13387] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adfFjq1OMnvM2fMnB1P90AAAABM"]
[Thu Apr 09 23:28:16.881873 2026] [:error] [pid 24515:tid 24519] [client 4.225.204.246:17517] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adfFkK1OMnvM2fMnB1P90wAAAAA"]
[Thu Apr 09 23:28:18.593534 2026] [:error] [pid 24515:tid 24523] [client 4.225.204.246:20885] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adfFkq1OMnvM2fMnB1P92AAAAAQ"]
[Thu Apr 09 23:28:21.033077 2026] [:error] [pid 24515:tid 24524] [client 4.225.204.246:30601] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "adfFla1OMnvM2fMnB1P94wAAAAU"]
[Thu Apr 09 23:28:24.277410 2026] [:error] [pid 24517:tid 24598] [client 4.225.204.246:21428] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "adfFmHboYEn2ZFM_PS-OrQAAAJg"]
[Thu Apr 09 23:28:28.622411 2026] [:error] [pid 24927:tid 24935] [client 4.225.204.246:32890] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "adfFnDXObuzEuw8mNJs8KAAAAQU"]
[Thu Apr 09 23:28:31.782363 2026] [:error] [pid 24517:tid 24587] [client 4.225.204.246:19604] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "adfFn3boYEn2ZFM_PS-OsAAAAI0"]
[Thu Apr 09 23:28:34.952042 2026] [:error] [pid 24624:tid 24635] [client 4.225.204.246:13423] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8daf1238_1774208172.php"] [unique_id "adfFou4Jn-WvK1ZBTvj8aAAAAMk"]
[Thu Apr 09 23:28:40.427315 2026] [:error] [pid 24927:tid 24949] [client 4.225.204.246:1766] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8daf1238_1774208172.php"] [unique_id "adfFqDXObuzEuw8mNJs8MAAAARM"]
[Thu Apr 09 23:28:43.708388 2026] [:error] [pid 63331:tid 63351] [client 4.225.204.246:19647] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8daf1238_1774208172.php"] [unique_id "adfFqybKfIYuVjWbE4WmawAAAdI"]
[Thu Apr 09 23:28:45.751477 2026] [:error] [pid 24515:tid 24542] [client 4.225.204.246:15503] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8daf1238_1774208172.php"] [unique_id "adfFra1OMnvM2fMnB1P-AwAAABc"]
[Thu Apr 09 23:28:47.953268 2026] [:error] [pid 63331:tid 63357] [client 4.225.204.246:12382] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "adfFrybKfIYuVjWbE4WmcgAAAdg"]
[Thu Apr 09 23:28:49.964860 2026] [:error] [pid 20837:tid 20861] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Thu Apr 09 23:28:50.245000 2026] [:error] [pid 20837:tid 20847] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Thu Apr 09 23:28:50.511449 2026] [:error] [pid 20837:tid 20841] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Thu Apr 09 23:28:50.777851 2026] [:error] [pid 20837:tid 20851] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/buc.php
[Thu Apr 09 23:28:51.044687 2026] [:error] [pid 20837:tid 20857] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Thu Apr 09 23:28:51.312399 2026] [:error] [pid 20837:tid 20839] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex.php
[Thu Apr 09 23:28:55.047459 2026] [:error] [pid 20837:tid 20858] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Thu Apr 09 23:28:55.320288 2026] [:error] [pid 20837:tid 20846] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Thu Apr 09 23:28:55.607164 2026] [:error] [pid 20837:tid 20860] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Thu Apr 09 23:28:56.013454 2026] [:error] [pid 20837:tid 20862] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/hhxc.php
[Thu Apr 09 23:28:57.034550 2026] [:error] [pid 20837:tid 20844] [client 4.225.204.246:33207] File does not exist: /usr/local/apache/htdocs/suspended-page/0yellow.php
[Thu Apr 09 23:28:57.308598 2026] [:error] [pid 20837:tid 20852] [client 4.225.204.246:33207] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/only.php"] [unique_id "adfFufSL71FHZkjrGzMZjgAAAY0"]
[Thu Apr 09 23:28:58.423011 2026] [:error] [pid 24515:tid 24527] [client 4.225.204.246:21656] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/only.php"] [unique_id "adfFuq1OMnvM2fMnB1P-EAAAAAg"]
[Thu Apr 09 23:29:01.174601 2026] [:error] [pid 24515:tid 24537] [client 4.225.204.246:37248] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/only.php"] [unique_id "adfFva1OMnvM2fMnB1P-FQAAABI"]
[Thu Apr 09 23:29:02.207707 2026] [:error] [pid 24515:tid 24523] [client 4.225.204.246:15557] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/only.php"] [unique_id "adfFvq1OMnvM2fMnB1P-GAAAAAQ"]
[Thu Apr 09 23:29:03.858411 2026] [:error] [pid 24517:tid 24580] [client 4.225.204.246:12353] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "adfFv3boYEn2ZFM_PS-OtAAAAIY"]
[Thu Apr 09 23:29:05.431315 2026] [:error] [pid 18477:tid 18495] [client 4.225.204.246:18549] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "adfFwcDe826HlFeoLPKx2gAAAVA"]
[Thu Apr 09 23:29:07.014521 2026] [:error] [pid 24624:tid 24630] [client 4.225.204.246:31908] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "adfFw-4Jn-WvK1ZBTvj8owAAAMQ"]
[Thu Apr 09 23:29:11.767345 2026] [:error] [pid 24927:tid 24946] [client 4.225.204.246:25885] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "adfFxzXObuzEuw8mNJs8NAAAARA"]
[Thu Apr 09 23:29:15.511652 2026] [:error] [pid 24515:tid 24538] [client 4.225.204.246:21208] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "adfFy61OMnvM2fMnB1P-MwAAABM"]
[Thu Apr 09 23:29:22.244007 2026] [:error] [pid 24516:tid 24550] [client 4.225.204.246:24681] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "adfF0thW7vSS-UkeWCVDYAAAAEM"]
[Thu Apr 09 23:29:24.160565 2026] [:error] [pid 24515:tid 24519] [client 4.225.204.246:16385] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "adfF1K1OMnvM2fMnB1P-RwAAAAA"]
[Thu Apr 09 23:29:26.515650 2026] [:error] [pid 24515:tid 24538] [client 4.225.204.246:24699] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "adfF1q1OMnvM2fMnB1P-TgAAABM"]
[Thu Apr 09 23:29:30.923312 2026] [:error] [pid 24516:tid 24559] [client 4.225.204.246:19238] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adfF2thW7vSS-UkeWCVDcgAAAEw"]
[Thu Apr 09 23:29:33.664754 2026] [:error] [pid 24624:tid 24647] [client 4.225.204.246:13685] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adfF3e4Jn-WvK1ZBTvj81wAAANU"]
[Thu Apr 09 23:29:35.482342 2026] [:error] [pid 63331:tid 63356] [client 4.225.204.246:37527] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adfF3ybKfIYuVjWbE4WmhwAAAdc"]
[Thu Apr 09 23:29:38.088003 2026] [:error] [pid 24515:tid 24534] [client 4.225.204.246:24681] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adfF4q1OMnvM2fMnB1P-YgAAAA8"]
[Thu Apr 09 23:29:40.362612 2026] [:error] [pid 63331:tid 63351] [client 4.225.204.246:13775] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adfF5CbKfIYuVjWbE4WmjAAAAdI"]
[Thu Apr 09 23:29:41.903409 2026] [:error] [pid 63331:tid 63339] [client 4.225.204.246:28477] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adfF5SbKfIYuVjWbE4WmjQAAAcY"]
[Thu Apr 09 23:29:43.078973 2026] [:error] [pid 20837:tid 20861] [client 4.225.204.246:20647] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adfF5_SL71FHZkjrGzMZtQAAAZY"]
[Thu Apr 09 23:29:46.032028 2026] [:error] [pid 20837:tid 20840] [client 4.225.204.246:19902] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adfF6vSL71FHZkjrGzMZvgAAAYE"]
[Thu Apr 09 23:29:49.196274 2026] [:error] [pid 24515:tid 24542] [client 4.225.204.246:19572] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adfF7a1OMnvM2fMnB1P-awAAABc"]
[Thu Apr 09 23:29:51.971449 2026] [:error] [pid 24927:tid 24934] [client 4.225.204.246:28879] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adfF7zXObuzEuw8mNJs8XwAAAQQ"]
[Thu Apr 09 23:29:55.718334 2026] [:error] [pid 20837:tid 20847] [client 4.225.204.246:1342] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adfF8_SL71FHZkjrGzMZ3QAAAYg"]
[Thu Apr 09 23:30:00.240221 2026] [:error] [pid 24515:tid 24530] [client 4.225.204.246:20104] File does not exist: /usr/local/apache/htdocs/suspended-page/irpl4xz4fmlzm4tlvvu4h1mCdefault.php
[Thu Apr 09 23:30:00.507609 2026] [:error] [pid 24515:tid 24526] [client 4.225.204.246:20104] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Thu Apr 09 23:30:00.775540 2026] [:error] [pid 24515:tid 24531] [client 4.225.204.246:20104] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Fri Apr 10 01:17:25.001508 2026] [:error] [pid 21486:tid 21505] [client 4.204.215.156:64602] [client 4.204.215.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adffJaBRftltyNdYwLoh3AAAARE"]
[Fri Apr 10 01:17:29.725074 2026] [:error] [pid 21486:tid 21497] [client 4.204.215.156:65257] [client 4.204.215.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adffKaBRftltyNdYwLoh4QAAAQk"]
[Fri Apr 10 01:17:32.701680 2026] [:error] [pid 36672:tid 36689] [client 4.204.215.156:63967] [client 4.204.215.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adffLD99r9VLJsT_o8iAbwAAAM8"]
[Fri Apr 10 01:17:37.774288 2026] [:error] [pid 21486:tid 21512] [client 4.204.215.156:64605] [client 4.204.215.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adffMaBRftltyNdYwLoh8AAAARg"]
[Fri Apr 10 23:43:01.347644 2026] [:error] [pid 62819:tid 62824] [client 34.24.114.196:55194] [client 34.24.114.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "adkahfU20EyPf7NlsleIMQAAAoI"]
[Sat Apr 11 03:28:03.146851 2026] [:error] [pid 21570:tid 21672] [client 164.68.120.90:36186] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/careers"] [unique_id "adlPQzKs5t9xRSNL6cn28gAAAEU"]
[Sat Apr 11 03:28:24.045394 2026] [:error] [pid 21706:tid 21715] [client 164.68.120.90:57696] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/careers/"] [unique_id "adlPWCGQ1M5d8fQSsLEKNQAAAAc"]
[Sat Apr 11 03:28:43.393093 2026] [:error] [pid 21568:tid 21586] [client 164.68.120.90:54548] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/career"] [unique_id "adlPa4iz5v_ljZxkpR8BwAAAAQ4"]
[Sat Apr 11 03:29:30.631855 2026] [:error] [pid 55451:tid 55476] [client 164.68.120.90:60202] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/employment"] [unique_id "adlPmnApxuyB7yCS5RlUYQAAANc"]
[Sat Apr 11 03:29:53.170422 2026] [:error] [pid 55451:tid 55456] [client 164.68.120.90:40160] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/employment/"] [unique_id "adlPsXApxuyB7yCS5RlUjgAAAMM"]
[Sat Apr 11 03:31:37.907177 2026] [:error] [pid 21706:tid 21729] [client 164.68.120.90:47738] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/opportunities"] [unique_id "adlQGSGQ1M5d8fQSsLENZQAAABU"]
[Sat Apr 11 03:32:29.496383 2026] [:error] [pid 21568:tid 21596] [client 164.68.120.90:47266] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/current-vacancies/"] [unique_id "adlQTYiz5v_ljZxkpR8DcQAAARg"]
[Sat Apr 11 03:32:51.841170 2026] [:error] [pid 21570:tid 21677] [client 164.68.120.90:50580] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/positions-vacant"] [unique_id "adlQYzKs5t9xRSNL6cn5BwAAAEg"]
[Sat Apr 11 03:33:12.938737 2026] [:error] [pid 21568:tid 21582] [client 164.68.120.90:34328] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/positions-vacant/"] [unique_id "adlQeIiz5v_ljZxkpR8DzQAAAQo"]
[Sat Apr 11 03:34:24.380296 2026] [:error] [pid 21568:tid 21576] [client 164.68.120.90:60438] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/contact"] [unique_id "adlQwIiz5v_ljZxkpR8EgwAAAQQ"]
[Sat Apr 11 03:34:44.442675 2026] [:error] [pid 21569:tid 21669] [client 164.68.120.90:39450] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/contact-us"] [unique_id "adlQ1HAvQTgvXJ6vHorGYQAAAJI"]
[Sat Apr 11 03:35:09.087854 2026] [:error] [pid 21706:tid 21723] [client 164.68.120.90:49784] [client 164.68.120.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/privacy"] [unique_id "adlQ7SGQ1M5d8fQSsLERbQAAAA8"]
[Sun Apr 12 02:03:34.850530 2026] [:error] [pid 44701:tid 44783] [client 209.38.77.153:65457] [client 209.38.77.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adqM9hGZAP4MrlxEPFdHUwAAAEo"]
[Sun Apr 12 02:04:51.499537 2026] [:error] [pid 44701:tid 44792] [client 209.38.77.153:51239] [client 209.38.77.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adqNQxGZAP4MrlxEPFdH9AAAAFE"]
[Sun Apr 12 02:16:12.903828 2026] [:error] [pid 44701:tid 44779] [client 20.220.147.82:28622] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sun Apr 12 02:16:13.539468 2026] [:error] [pid 44701:tid 44778] [client 20.220.147.82:28622] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Apr 12 02:16:13.980898 2026] [:error] [pid 44701:tid 44798] [client 20.220.147.82:28622] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sun Apr 12 02:16:14.191001 2026] [:error] [pid 44701:tid 44782] [client 20.220.147.82:28622] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sun Apr 12 02:16:14.403868 2026] [:error] [pid 44701:tid 44787] [client 20.220.147.82:28622] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 12 02:16:14.632486 2026] [:error] [pid 44701:tid 44774] [client 20.220.147.82:28622] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sun Apr 12 02:16:14.873405 2026] [:error] [pid 44701:tid 44785] [client 20.220.147.82:28622] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sun Apr 12 02:16:16.501097 2026] [:error] [pid 44701:tid 44796] [client 20.220.147.82:28622] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Apr 12 02:16:16.928350 2026] [:error] [pid 44701:tid 44799] [client 20.220.147.82:28622] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx1.php"] [unique_id "adqP8BGZAP4MrlxEPFdLLgAAAFc"]
[Sun Apr 12 02:16:18.008722 2026] [:error] [pid 44698:tid 44712] [client 20.220.147.82:28564] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx1.php"] [unique_id "adqP8hgoH9UWd-U3D554uwAAAIk"]
[Sun Apr 12 02:16:18.677867 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28613] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx1.php"] [unique_id "adqP8oSWpa_VL1JPU6zv8QAAAY8"]
[Sun Apr 12 02:16:19.160356 2026] [:error] [pid 36938:tid 36941] [client 20.220.147.82:28548] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx1.php"] [unique_id "adqP84SWpa_VL1JPU6zv9QAAAYE"]
[Sun Apr 12 02:16:19.947340 2026] [:error] [pid 44698:tid 44714] [client 20.220.147.82:28663] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xv.php"] [unique_id "adqP8xgoH9UWd-U3D554xAAAAIs"]
[Sun Apr 12 02:16:20.803095 2026] [:error] [pid 44701:tid 44795] [client 20.220.147.82:28625] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xv.php"] [unique_id "adqP9BGZAP4MrlxEPFdLMgAAAFQ"]
[Sun Apr 12 02:16:21.895863 2026] [:error] [pid 34152:tid 34174] [client 20.220.147.82:28485] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xv.php"] [unique_id "adqP9YFtE4RhFslT1DrLPQAAABQ"]
[Sun Apr 12 02:16:22.922064 2026] [:error] [pid 44698:tid 44709] [client 20.220.147.82:28558] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xv.php"] [unique_id "adqP9hgoH9UWd-U3D5540QAAAIY"]
[Sun Apr 12 02:16:25.277169 2026] [:error] [pid 36938:tid 36949] [client 20.220.147.82:28647] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x56.php"] [unique_id "adqP-YSWpa_VL1JPU6zwFQAAAYk"]
[Sun Apr 12 02:16:27.869725 2026] [:error] [pid 36909:tid 36933] [client 20.220.147.82:28646] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x56.php"] [unique_id "adqP-0Gk5GhxTCzHUOomUgAAARY"]
[Sun Apr 12 02:16:29.108109 2026] [:error] [pid 36938:tid 36959] [client 20.220.147.82:28660] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x56.php"] [unique_id "adqP_YSWpa_VL1JPU6zwKAAAAZM"]
[Sun Apr 12 02:16:30.797912 2026] [:error] [pid 44698:tid 44716] [client 20.220.147.82:28555] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x56.php"] [unique_id "adqP_hgoH9UWd-U3D555CgAAAI0"]
[Sun Apr 12 02:16:31.428701 2026] [:error] [pid 44698:tid 44707] [client 20.220.147.82:28667] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htaccess.php"] [unique_id "adqP_xgoH9UWd-U3D555DwAAAIQ"]
[Sun Apr 12 02:16:34.387454 2026] [:error] [pid 36938:tid 36944] [client 20.220.147.82:28651] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htaccess.php"] [unique_id "adqQAoSWpa_VL1JPU6zwUgAAAYQ"]
[Sun Apr 12 02:16:38.248646 2026] [:error] [pid 44698:tid 44723] [client 20.220.147.82:28638] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htaccess.php"] [unique_id "adqQBhgoH9UWd-U3D555VwAAAJQ"]
[Sun Apr 12 02:16:45.409318 2026] [:error] [pid 44700:tid 44749] [client 20.220.147.82:28500] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htaccess.php"] [unique_id "adqQDWryPgh_uW4QPCl0ewAAAMU"]
[Sun Apr 12 02:16:53.666593 2026] [:error] [pid 36938:tid 36954] [client 20.220.147.82:28557] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/readme.php"] [unique_id "adqQFYSWpa_VL1JPU6zwmAAAAY4"]
[Sun Apr 12 02:17:00.015317 2026] [:error] [pid 36938:tid 36960] [client 20.220.147.82:28658] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/readme.php"] [unique_id "adqQHISWpa_VL1JPU6zwqQAAAZQ"]
[Sun Apr 12 02:17:03.350875 2026] [:error] [pid 44698:tid 44720] [client 20.220.147.82:28664] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x50.php"] [unique_id "adqQHxgoH9UWd-U3D555sAAAAJE"]
[Sun Apr 12 02:17:05.872589 2026] [:error] [pid 44700:tid 44766] [client 20.220.147.82:28572] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x50.php"] [unique_id "adqQIWryPgh_uW4QPCl0pgAAANY"]
[Sun Apr 12 02:17:07.037909 2026] [:error] [pid 44698:tid 44721] [client 20.220.147.82:28650] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x50.php"] [unique_id "adqQIxgoH9UWd-U3D555tQAAAJI"]
[Sun Apr 12 02:17:08.427218 2026] [:error] [pid 45064:tid 45099] [client 20.220.147.82:28508] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x50.php"] [unique_id "adqQJJcHBvLyJ6EUhUoOJwAAAUc"]
[Sun Apr 12 02:17:10.709168 2026] [:error] [pid 36909:tid 36924] [client 20.220.147.82:28608] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fv.php"] [unique_id "adqQJkGk5GhxTCzHUOomoQAAAQ0"]
[Sun Apr 12 02:17:11.903267 2026] [:error] [pid 44700:tid 44760] [client 20.220.147.82:28618] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fv.php"] [unique_id "adqQJ2ryPgh_uW4QPCl0rgAAANA"]
[Sun Apr 12 02:17:13.298710 2026] [:error] [pid 44700:tid 44753] [client 20.220.147.82:28626] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fv.php"] [unique_id "adqQKWryPgh_uW4QPCl0sQAAAMk"]
[Sun Apr 12 02:17:14.122467 2026] [:error] [pid 44700:tid 44750] [client 20.220.147.82:28666] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fv.php"] [unique_id "adqQKmryPgh_uW4QPCl0sgAAAMY"]
[Sun Apr 12 02:17:14.625285 2026] [:error] [pid 36909:tid 36930] [client 20.220.147.82:28547] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "adqQKkGk5GhxTCzHUOomrwAAARM"]
[Sun Apr 12 02:17:15.644884 2026] [:error] [pid 36938:tid 36947] [client 20.220.147.82:28665] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "adqQK4SWpa_VL1JPU6zw4wAAAYc"]
[Sun Apr 12 02:17:16.164776 2026] [:error] [pid 36938:tid 36963] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Apr 12 02:17:16.420148 2026] [:error] [pid 36938:tid 36941] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/lsd.php
[Sun Apr 12 02:17:16.630410 2026] [:error] [pid 36938:tid 36952] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Apr 12 02:17:16.917377 2026] [:error] [pid 36938:tid 36956] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Sun Apr 12 02:17:17.136974 2026] [:error] [pid 36938:tid 36949] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Sun Apr 12 02:17:17.363657 2026] [:error] [pid 36938:tid 36943] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/atx.php
[Sun Apr 12 02:17:17.572751 2026] [:error] [pid 36938:tid 36946] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Sun Apr 12 02:17:17.782154 2026] [:error] [pid 36938:tid 36950] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sun Apr 12 02:17:17.992674 2026] [:error] [pid 36938:tid 36947] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Sun Apr 12 02:17:18.205595 2026] [:error] [pid 36938:tid 36954] [client 20.220.147.82:28644] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Apr 12 02:17:18.806416 2026] [:error] [pid 36938:tid 36964] [client 20.220.147.82:28644] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "adqQLoSWpa_VL1JPU6zw-AAAAZg"]
[Sun Apr 12 02:17:19.418916 2026] [:error] [pid 36938:tid 36944] [client 20.220.147.82:28556] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "adqQL4SWpa_VL1JPU6zw_wAAAYQ"]
[Sun Apr 12 02:17:20.148566 2026] [:error] [pid 44700:tid 44762] [client 20.220.147.82:28551] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "adqQMGryPgh_uW4QPCl0vQAAANI"]
[Sun Apr 12 02:17:20.698768 2026] [:error] [pid 44700:tid 44752] [client 20.220.147.82:28632] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "adqQMGryPgh_uW4QPCl0wAAAAMg"]
[Sun Apr 12 02:17:21.629288 2026] [:error] [pid 36909:tid 36915] [client 20.220.147.82:28637] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/click.php"] [unique_id "adqQMUGk5GhxTCzHUOomyAAAAQQ"]
[Sun Apr 12 02:17:22.996096 2026] [:error] [pid 36938:tid 36943] [client 20.220.147.82:28653] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/click.php"] [unique_id "adqQMoSWpa_VL1JPU6zxDgAAAYM"]
[Sun Apr 12 02:17:23.560958 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28617] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/click.php"] [unique_id "adqQM4SWpa_VL1JPU6zxFgAAAY8"]
[Sun Apr 12 02:17:25.588591 2026] [:error] [pid 44698:tid 44725] [client 20.220.147.82:28636] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/click.php"] [unique_id "adqQNRgoH9UWd-U3D556GwAAAJY"]
[Sun Apr 12 02:17:27.828781 2026] [:error] [pid 36909:tid 36913] [client 20.220.147.82:28595] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/install.php"] [unique_id "adqQN0Gk5GhxTCzHUOom2gAAAQI"]
[Sun Apr 12 02:17:29.353494 2026] [:error] [pid 44698:tid 44708] [client 20.220.147.82:28643] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/install.php"] [unique_id "adqQORgoH9UWd-U3D556NQAAAIU"]
[Sun Apr 12 02:17:30.960840 2026] [:error] [pid 45064:tid 45096] [client 20.220.147.82:28655] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/install.php"] [unique_id "adqQOpcHBvLyJ6EUhUoOOgAAAUQ"]
[Sun Apr 12 02:17:31.962071 2026] [:error] [pid 36938:tid 36960] [client 20.220.147.82:28654] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/install.php"] [unique_id "adqQO4SWpa_VL1JPU6zxOgAAAZQ"]
[Sun Apr 12 02:17:32.874438 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28559] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lv.php"] [unique_id "adqQPISWpa_VL1JPU6zxQgAAAY8"]
[Sun Apr 12 02:17:33.457034 2026] [:error] [pid 36938:tid 36946] [client 20.220.147.82:28645] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lv.php"] [unique_id "adqQPYSWpa_VL1JPU6zxSgAAAYY"]
[Sun Apr 12 02:17:34.351008 2026] [:error] [pid 36938:tid 36962] [client 20.220.147.82:28670] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lv.php"] [unique_id "adqQPoSWpa_VL1JPU6zxUAAAAZY"]
[Sun Apr 12 02:17:37.629334 2026] [:error] [pid 36938:tid 36948] [client 20.220.147.82:28581] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lv.php"] [unique_id "adqQQYSWpa_VL1JPU6zxagAAAYg"]
[Sun Apr 12 02:17:38.816212 2026] [:error] [pid 36938:tid 36946] [client 20.220.147.82:28671] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "adqQQoSWpa_VL1JPU6zxdgAAAYY"]
[Sun Apr 12 02:17:39.810575 2026] [:error] [pid 44700:tid 44758] [client 20.220.147.82:28614] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "adqQQ2ryPgh_uW4QPCl07AAAAM4"]
[Sun Apr 12 02:17:40.406050 2026] [:error] [pid 36938:tid 36953] [client 20.220.147.82:28553] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "adqQRISWpa_VL1JPU6zxewAAAY0"]
[Sun Apr 12 02:17:40.997522 2026] [:error] [pid 34152:tid 34158] [client 20.220.147.82:28546] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "adqQRIFtE4RhFslT1DrLcQAAAAQ"]
[Sun Apr 12 02:17:41.684493 2026] [:error] [pid 45064:tid 45101] [client 20.220.147.82:28603] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css.php"] [unique_id "adqQRZcHBvLyJ6EUhUoORAAAAUg"]
[Sun Apr 12 02:17:42.378654 2026] [:error] [pid 44700:tid 44760] [client 20.220.147.82:28573] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css.php"] [unique_id "adqQRmryPgh_uW4QPCl09wAAANA"]
[Sun Apr 12 02:17:43.410745 2026] [:error] [pid 34152:tid 34167] [client 20.220.147.82:28599] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css.php"] [unique_id "adqQR4FtE4RhFslT1DrLdgAAAA0"]
[Sun Apr 12 02:17:44.302618 2026] [:error] [pid 44700:tid 44746] [client 20.220.147.82:28640] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css.php"] [unique_id "adqQSGryPgh_uW4QPCl1AAAAAMI"]
[Sun Apr 12 02:17:45.388457 2026] [:error] [pid 44700:tid 44768] [client 20.220.147.82:28657] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cong.php"] [unique_id "adqQSWryPgh_uW4QPCl1BgAAANg"]
[Sun Apr 12 02:17:46.633034 2026] [:error] [pid 44700:tid 44767] [client 20.220.147.82:28568] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cong.php"] [unique_id "adqQSmryPgh_uW4QPCl1CgAAANc"]
[Sun Apr 12 02:17:48.171445 2026] [:error] [pid 44698:tid 44704] [client 20.220.147.82:28552] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cong.php"] [unique_id "adqQTBgoH9UWd-U3D556jwAAAIE"]
[Sun Apr 12 02:17:48.679393 2026] [:error] [pid 36938:tid 36947] [client 20.220.147.82:28554] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cong.php"] [unique_id "adqQTISWpa_VL1JPU6zxfgAAAYc"]
[Sun Apr 12 02:17:50.053516 2026] [:error] [pid 36938:tid 36940] [client 20.220.147.82:28571] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adqQToSWpa_VL1JPU6zxggAAAYA"]
[Sun Apr 12 02:17:51.412559 2026] [:error] [pid 36909:tid 36934] [client 20.220.147.82:28561] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cong.php"] [unique_id "adqQT0Gk5GhxTCzHUOom9QAAARc"]
[Sun Apr 12 02:17:54.345998 2026] [:error] [pid 36938:tid 36950] [client 20.220.147.82:28577] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cong.php"] [unique_id "adqQUoSWpa_VL1JPU6zxjQAAAYo"]
[Sun Apr 12 02:17:57.572546 2026] [:error] [pid 44698:tid 44704] [client 20.220.147.82:28519] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cong.php"] [unique_id "adqQVRgoH9UWd-U3D556pgAAAIE"]
[Sun Apr 12 02:17:58.885380 2026] [:error] [pid 44698:tid 44720] [client 20.220.147.82:28544] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cong.php"] [unique_id "adqQVhgoH9UWd-U3D556rwAAAJE"]
[Sun Apr 12 02:18:00.924188 2026] [:error] [pid 36909:tid 36934] [client 20.220.147.82:28495] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w.php"] [unique_id "adqQWEGk5GhxTCzHUOonAQAAARc"]
[Sun Apr 12 02:18:02.996377 2026] [:error] [pid 34152:tid 34165] [client 20.220.147.82:28592] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w.php"] [unique_id "adqQWoFtE4RhFslT1DrLowAAAAs"]
[Sun Apr 12 02:18:04.158706 2026] [:error] [pid 44701:tid 44786] [client 20.220.147.82:28604] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w.php"] [unique_id "adqQXBGZAP4MrlxEPFdLlQAAAEw"]
[Sun Apr 12 02:18:05.198353 2026] [:error] [pid 44700:tid 44768] [client 20.220.147.82:28612] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w.php"] [unique_id "adqQXWryPgh_uW4QPCl1IgAAANg"]
[Sun Apr 12 02:18:05.872594 2026] [:error] [pid 36938:tid 36951] [client 20.220.147.82:28524] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/404.php"] [unique_id "adqQXYSWpa_VL1JPU6zxswAAAYs"]
[Sun Apr 12 02:18:08.110748 2026] [:error] [pid 44698:tid 44717] [client 20.220.147.82:28621] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/404.php"] [unique_id "adqQYBgoH9UWd-U3D556ywAAAI4"]
[Sun Apr 12 02:18:09.913955 2026] [:error] [pid 36938:tid 36950] [client 20.220.147.82:28662] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/404.php"] [unique_id "adqQYYSWpa_VL1JPU6zxxwAAAYo"]
[Sun Apr 12 02:18:11.589105 2026] [:error] [pid 36909:tid 36934] [client 20.220.147.82:28488] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/404.php"] [unique_id "adqQY0Gk5GhxTCzHUOonIQAAARc"]
[Sun Apr 12 02:18:12.690642 2026] [:error] [pid 36938:tid 36942] [client 20.220.147.82:28480] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "adqQZISWpa_VL1JPU6zx1QAAAYI"]
[Sun Apr 12 02:18:13.560385 2026] [:error] [pid 44698:tid 44707] [client 20.220.147.82:28455] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "adqQZRgoH9UWd-U3D5564QAAAIQ"]
[Sun Apr 12 02:18:15.401743 2026] [:error] [pid 36938:tid 36947] [client 20.220.147.82:28669] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "adqQZ4SWpa_VL1JPU6zx2gAAAYc"]
[Sun Apr 12 02:18:15.894544 2026] [:error] [pid 36909:tid 36929] [client 20.220.147.82:28574] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "adqQZ0Gk5GhxTCzHUOonKQAAARI"]
[Sun Apr 12 02:18:17.114672 2026] [:error] [pid 45064:tid 45110] [client 20.220.147.82:28578] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "adqQaZcHBvLyJ6EUhUoOcwAAAVE"]
[Sun Apr 12 02:18:18.406743 2026] [:error] [pid 36938:tid 36953] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sun Apr 12 02:18:18.635403 2026] [:error] [pid 36938:tid 36949] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Apr 12 02:18:18.854591 2026] [:error] [pid 36938:tid 36959] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Apr 12 02:18:19.306730 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 12 02:18:19.730365 2026] [:error] [pid 36938:tid 36956] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Apr 12 02:18:19.962053 2026] [:error] [pid 36938:tid 36958] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Apr 12 02:18:20.170073 2026] [:error] [pid 36938:tid 36954] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Apr 12 02:18:20.394559 2026] [:error] [pid 36938:tid 36942] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Apr 12 02:18:20.619619 2026] [:error] [pid 36938:tid 36949] [client 20.220.147.82:28576] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Apr 12 02:18:20.827975 2026] [:error] [pid 36938:tid 36964] [client 20.220.147.82:28576] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "adqQbISWpa_VL1JPU6zyBwAAAZg"]
[Sun Apr 12 02:18:24.149388 2026] [:error] [pid 44698:tid 44713] [client 20.220.147.82:28598] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "adqQcBgoH9UWd-U3D557FQAAAIo"]
[Sun Apr 12 02:18:25.737859 2026] [:error] [pid 44698:tid 44712] [client 20.220.147.82:28579] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "adqQcRgoH9UWd-U3D557IAAAAIk"]
[Sun Apr 12 02:18:27.844433 2026] [:error] [pid 36909:tid 36930] [client 20.220.147.82:28590] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "adqQc0Gk5GhxTCzHUOonPAAAARM"]
[Sun Apr 12 02:18:28.853229 2026] [:error] [pid 36938:tid 36958] [client 20.220.147.82:28496] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "adqQdISWpa_VL1JPU6zyGwAAAZI"]
[Sun Apr 12 02:18:29.878858 2026] [:error] [pid 44701:tid 44790] [client 20.220.147.82:28583] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "adqQdRGZAP4MrlxEPFdLowAAAE8"]
[Sun Apr 12 02:18:31.314083 2026] [:error] [pid 45064:tid 45117] [client 20.220.147.82:28656] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "adqQd5cHBvLyJ6EUhUoOfwAAAVg"]
[Sun Apr 12 02:18:32.342529 2026] [:error] [pid 45064:tid 45112] [client 20.220.147.82:28487] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "adqQeJcHBvLyJ6EUhUoOggAAAVM"]
[Sun Apr 12 02:18:35.677463 2026] [:error] [pid 36938:tid 36961] [client 20.220.147.82:28648] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "adqQe4SWpa_VL1JPU6zyMQAAAZU"]
[Sun Apr 12 02:18:36.687062 2026] [:error] [pid 36938:tid 36954] [client 20.220.147.82:28560] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "adqQfISWpa_VL1JPU6zyNgAAAY4"]
[Sun Apr 12 02:18:37.663797 2026] [:error] [pid 34152:tid 34154] [client 20.220.147.82:28624] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "adqQfYFtE4RhFslT1DrLwQAAAAA"]
[Sun Apr 12 02:18:39.756019 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28565] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "adqQf4SWpa_VL1JPU6zyPwAAAY8"]
[Sun Apr 12 02:18:45.316196 2026] [:error] [pid 36938:tid 36942] [client 20.220.147.82:28634] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "adqQhYSWpa_VL1JPU6zySAAAAYI"]
[Sun Apr 12 02:18:48.990936 2026] [:error] [pid 36938:tid 36956] [client 20.220.147.82:28484] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "adqQiISWpa_VL1JPU6zyUwAAAZA"]
[Sun Apr 12 02:18:58.500830 2026] [:error] [pid 36909:tid 36912] [client 20.220.147.82:28493] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "adqQkkGk5GhxTCzHUOoncQAAAQE"]
[Sun Apr 12 02:19:01.158660 2026] [:error] [pid 36938:tid 36940] [client 20.220.147.82:28509] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "adqQlYSWpa_VL1JPU6zykgAAAYA"]
[Sun Apr 12 02:19:02.934646 2026] [:error] [pid 36909:tid 36928] [client 20.220.147.82:28567] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "adqQlkGk5GhxTCzHUOoncgAAARE"]
[Sun Apr 12 02:19:03.893344 2026] [:error] [pid 45064:tid 45098] [client 20.220.147.82:28498] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "adqQl5cHBvLyJ6EUhUoOrwAAAUY"]
[Sun Apr 12 02:19:04.868962 2026] [:error] [pid 36938:tid 36943] [client 20.220.147.82:28499] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "adqQmISWpa_VL1JPU6zyqwAAAYM"]
[Sun Apr 12 02:19:05.382387 2026] [:error] [pid 45064:tid 45096] [client 20.220.147.82:28517] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "adqQmZcHBvLyJ6EUhUoOswAAAUQ"]
[Sun Apr 12 02:19:06.143974 2026] [:error] [pid 44698:tid 44726] [client 20.220.147.82:28668] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "adqQmhgoH9UWd-U3D557XwAAAJc"]
[Sun Apr 12 02:19:06.720498 2026] [:error] [pid 44698:tid 44723] [client 20.220.147.82:28539] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "adqQmhgoH9UWd-U3D557ZwAAAJQ"]
[Sun Apr 12 02:19:07.656520 2026] [:error] [pid 44698:tid 44715] [client 20.220.147.82:28639] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/manager.php"] [unique_id "adqQmxgoH9UWd-U3D557agAAAIw"]
[Sun Apr 12 02:19:08.658057 2026] [:error] [pid 44701:tid 44796] [client 20.220.147.82:28610] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/item.php"] [unique_id "adqQnBGZAP4MrlxEPFdL0QAAAFU"]
[Sun Apr 12 02:19:10.802291 2026] [:error] [pid 36938:tid 36950] [client 20.220.147.82:28627] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/item.php"] [unique_id "adqQnoSWpa_VL1JPU6zyygAAAYo"]
[Sun Apr 12 02:19:13.281376 2026] [:error] [pid 45064:tid 45108] [client 20.220.147.82:28525] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/item.php"] [unique_id "adqQoZcHBvLyJ6EUhUoOuAAAAU8"]
[Sun Apr 12 02:19:20.933314 2026] [:error] [pid 36909:tid 36918] [client 20.220.147.82:28633] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Apr 12 02:19:21.712783 2026] [:error] [pid 36909:tid 36920] [client 20.220.147.82:28633] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Apr 12 02:19:21.961699 2026] [:error] [pid 36909:tid 36930] [client 20.220.147.82:28633] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sun Apr 12 02:19:22.443558 2026] [:error] [pid 36909:tid 36933] [client 20.220.147.82:28633] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sun Apr 12 02:19:22.930141 2026] [:error] [pid 36909:tid 36915] [client 20.220.147.82:28633] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Apr 12 02:19:23.152198 2026] [:error] [pid 36909:tid 36931] [client 20.220.147.82:28633] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Apr 12 02:19:23.401311 2026] [:error] [pid 36909:tid 36925] [client 20.220.147.82:28633] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Apr 12 02:19:23.624337 2026] [:error] [pid 36909:tid 36923] [client 20.220.147.82:28633] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Apr 12 02:19:23.856066 2026] [:error] [pid 36909:tid 36920] [client 20.220.147.82:28633] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/index.php"] [unique_id "adqQq0Gk5GhxTCzHUOonnQAAAQk"]
[Sun Apr 12 02:19:29.520561 2026] [:error] [pid 45064:tid 45099] [client 20.220.147.82:28594] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/index.php"] [unique_id "adqQsZcHBvLyJ6EUhUoOzgAAAUc"]
[Sun Apr 12 02:19:31.521211 2026] [:error] [pid 44700:tid 44768] [client 20.220.147.82:28602] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/index.php"] [unique_id "adqQs2ryPgh_uW4QPCl1cgAAANg"]
[Sun Apr 12 02:19:32.843375 2026] [:error] [pid 45064:tid 45098] [client 20.220.147.82:28446] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/index.php"] [unique_id "adqQtJcHBvLyJ6EUhUoO2AAAAUY"]
[Sun Apr 12 02:19:33.293164 2026] [:error] [pid 36938:tid 36950] [client 20.220.147.82:28600] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adqQtYSWpa_VL1JPU6zzMwAAAYo"]
[Sun Apr 12 02:19:33.713814 2026] [:error] [pid 44701:tid 44790] [client 20.220.147.82:28587] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adqQtRGZAP4MrlxEPFdL6gAAAE8"]
[Sun Apr 12 02:19:34.261439 2026] [:error] [pid 36938:tid 36958] [client 20.220.147.82:28424] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adqQtoSWpa_VL1JPU6zzOgAAAZI"]
[Sun Apr 12 02:19:34.732557 2026] [:error] [pid 36938:tid 36954] [client 20.220.147.82:28563] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adqQtoSWpa_VL1JPU6zzPAAAAY4"]
[Sun Apr 12 02:19:35.787766 2026] [:error] [pid 44700:tid 44750] [client 20.220.147.82:28491] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/about.php"] [unique_id "adqQt2ryPgh_uW4QPCl1eQAAAMY"]
[Sun Apr 12 02:19:36.522512 2026] [:error] [pid 44700:tid 44765] [client 20.220.147.82:28514] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/about.php"] [unique_id "adqQuGryPgh_uW4QPCl1fAAAANU"]
[Sun Apr 12 02:19:37.209937 2026] [:error] [pid 34152:tid 34171] [client 20.220.147.82:28512] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/about.php"] [unique_id "adqQuYFtE4RhFslT1DrL4wAAABE"]
[Sun Apr 12 02:19:39.417261 2026] [:error] [pid 44700:tid 44767] [client 20.220.147.82:28507] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/about.php"] [unique_id "adqQu2ryPgh_uW4QPCl1gwAAANc"]
[Sun Apr 12 02:19:40.053654 2026] [:error] [pid 44700:tid 44764] [client 20.220.147.82:28443] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "adqQvGryPgh_uW4QPCl1hgAAANQ"]
[Sun Apr 12 02:19:41.689966 2026] [:error] [pid 45064:tid 45105] [client 20.220.147.82:28550] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "adqQvZcHBvLyJ6EUhUoO5wAAAUw"]
[Sun Apr 12 02:19:45.854910 2026] [:error] [pid 44698:tid 44719] [client 20.220.147.82:28421] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "adqQwRgoH9UWd-U3D557vwAAAJA"]
[Sun Apr 12 02:19:50.021722 2026] [:error] [pid 44698:tid 44713] [client 20.220.147.82:28537] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gmo.php"] [unique_id "adqQxhgoH9UWd-U3D5570QAAAIo"]
[Sun Apr 12 02:19:52.847344 2026] [:error] [pid 45064:tid 45111] [client 20.220.147.82:28506] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adqQyJcHBvLyJ6EUhUoO_QAAAVI"]
[Sun Apr 12 02:19:55.060528 2026] [:error] [pid 36938:tid 36946] [client 20.220.147.82:28489] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css/index.php"] [unique_id "adqQy4SWpa_VL1JPU6zzdwAAAYY"]
[Sun Apr 12 02:19:56.838487 2026] [:error] [pid 36938:tid 36948] [client 20.220.147.82:28589] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css/index.php"] [unique_id "adqQzISWpa_VL1JPU6zziQAAAYg"]
[Sun Apr 12 02:19:58.445430 2026] [:error] [pid 34152:tid 34172] [client 20.220.147.82:28434] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css/index.php"] [unique_id "adqQzoFtE4RhFslT1DrL9gAAABI"]
[Sun Apr 12 02:20:00.460664 2026] [:error] [pid 44700:tid 44745] [client 20.220.147.82:28615] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/css/index.php"] [unique_id "adqQ0GryPgh_uW4QPCl1swAAAME"]
[Sun Apr 12 02:20:01.692829 2026] [:error] [pid 34152:tid 34157] [client 20.220.147.82:28619] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "adqQ0YFtE4RhFslT1DrL-wAAAAM"]
[Sun Apr 12 02:20:02.605382 2026] [:error] [pid 44698:tid 44713] [client 20.220.147.82:28585] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "adqQ0hgoH9UWd-U3D5578QAAAIo"]
[Sun Apr 12 02:20:03.312509 2026] [:error] [pid 36938:tid 36942] [client 20.220.147.82:28575] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "adqQ04SWpa_VL1JPU6zzoAAAAYI"]
[Sun Apr 12 02:20:04.026372 2026] [:error] [pid 44698:tid 44716] [client 20.220.147.82:28504] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "adqQ1BgoH9UWd-U3D557_QAAAI0"]
[Sun Apr 12 02:20:04.881818 2026] [:error] [pid 36938:tid 36959] [client 20.220.147.82:28486] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/dialog.php"] [unique_id "adqQ1ISWpa_VL1JPU6zzpAAAAZM"]
[Sun Apr 12 02:20:06.688356 2026] [:error] [pid 44698:tid 44713] [client 20.220.147.82:28628] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/dialog.php"] [unique_id "adqQ1hgoH9UWd-U3D558EgAAAIo"]
[Sun Apr 12 02:20:07.764402 2026] [:error] [pid 44698:tid 44721] [client 20.220.147.82:28584] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/dialog.php"] [unique_id "adqQ1xgoH9UWd-U3D558HQAAAJI"]
[Sun Apr 12 02:20:08.802430 2026] [:error] [pid 44698:tid 44725] [client 20.220.147.82:28428] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/dialog.php"] [unique_id "adqQ2BgoH9UWd-U3D558JgAAAJY"]
[Sun Apr 12 02:20:09.808411 2026] [:error] [pid 36909:tid 36934] [client 20.220.147.82:28570] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "adqQ2UGk5GhxTCzHUOon-wAAARc"]
[Sun Apr 12 02:20:10.880848 2026] [:error] [pid 36938:tid 36961] [client 20.220.147.82:28588] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "adqQ2oSWpa_VL1JPU6zzrwAAAZU"]
[Sun Apr 12 02:20:12.070800 2026] [:error] [pid 44700:tid 44753] [client 20.220.147.82:28425] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "adqQ3GryPgh_uW4QPCl1zAAAAMk"]
[Sun Apr 12 02:20:13.649468 2026] [:error] [pid 44701:tid 44782] [client 20.220.147.82:28439] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "adqQ3RGZAP4MrlxEPFdMDAAAAEk"]
[Sun Apr 12 02:20:15.771527 2026] [:error] [pid 45064:tid 45116] [client 20.220.147.82:28531] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "adqQ35cHBvLyJ6EUhUoPEgAAAVc"]
[Sun Apr 12 02:20:17.837817 2026] [:error] [pid 44700:tid 44750] [client 20.220.147.82:28635] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index/function.php"] [unique_id "adqQ4WryPgh_uW4QPCl13AAAAMY"]
[Sun Apr 12 02:20:20.330066 2026] [:error] [pid 45064:tid 45113] [client 20.220.147.82:28444] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index/function.php"] [unique_id "adqQ5JcHBvLyJ6EUhUoPGAAAAVQ"]
[Sun Apr 12 02:20:21.278980 2026] [:error] [pid 34152:tid 34163] [client 20.220.147.82:28543] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index/function.php"] [unique_id "adqQ5YFtE4RhFslT1DrMGQAAAAk"]
[Sun Apr 12 02:20:25.400103 2026] [:error] [pid 36938:tid 36946] [client 20.220.147.82:28620] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "adqQ6YSWpa_VL1JPU6zz3AAAAYY"]
[Sun Apr 12 02:20:26.608920 2026] [:error] [pid 36938:tid 36963] [client 20.220.147.82:28545] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Sun Apr 12 02:20:27.252812 2026] [:error] [pid 36938:tid 36952] [client 20.220.147.82:28545] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Apr 12 02:20:27.684936 2026] [:error] [pid 36938:tid 36940] [client 20.220.147.82:28545] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Sun Apr 12 02:20:29.464199 2026] [:error] [pid 36938:tid 36962] [client 20.220.147.82:28545] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adqQ7YSWpa_VL1JPU6zz_AAAAZY"]
[Sun Apr 12 02:20:30.700453 2026] [:error] [pid 44700:tid 44763] [client 20.220.147.82:28611] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "adqQ7mryPgh_uW4QPCl14QAAANM"]
[Sun Apr 12 02:20:31.545553 2026] [:error] [pid 36938:tid 36940] [client 20.220.147.82:28549] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "adqQ74SWpa_VL1JPU6z0AQAAAYA"]
[Sun Apr 12 02:20:32.487638 2026] [:error] [pid 36938:tid 36959] [client 20.220.147.82:28494] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "adqQ8ISWpa_VL1JPU6z0BgAAAZM"]
[Sun Apr 12 02:20:33.039502 2026] [:error] [pid 36938:tid 36944] [client 20.220.147.82:28580] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "adqQ8YSWpa_VL1JPU6z0CgAAAYQ"]
[Sun Apr 12 02:20:33.994780 2026] [:error] [pid 36938:tid 36949] [client 20.220.147.82:28540] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adqQ8YSWpa_VL1JPU6z0DwAAAYk"]
[Sun Apr 12 02:20:34.584437 2026] [:error] [pid 44700:tid 44764] [client 20.220.147.82:28463] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adqQ8mryPgh_uW4QPCl15QAAANQ"]
[Sun Apr 12 02:20:35.192736 2026] [:error] [pid 44698:tid 44721] [client 20.220.147.82:28430] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adqQ8xgoH9UWd-U3D558TQAAAJI"]
[Sun Apr 12 02:20:35.985540 2026] [:error] [pid 36909:tid 36912] [client 20.220.147.82:28661] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adqQ80Gk5GhxTCzHUOooNAAAAQE"]
[Sun Apr 12 02:20:36.862776 2026] [:error] [pid 36938:tid 36948] [client 20.220.147.82:28631] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/admin.php"] [unique_id "adqQ9ISWpa_VL1JPU6z0GgAAAYg"]
[Sun Apr 12 02:20:37.502462 2026] [:error] [pid 36909:tid 36924] [client 20.220.147.82:28501] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/admin.php"] [unique_id "adqQ9UGk5GhxTCzHUOooOwAAAQ0"]
[Sun Apr 12 02:20:38.227810 2026] [:error] [pid 44701:tid 44774] [client 20.220.147.82:28652] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/admin.php"] [unique_id "adqQ9hGZAP4MrlxEPFdMJgAAAEI"]
[Sun Apr 12 02:20:38.873302 2026] [:error] [pid 44700:tid 44767] [client 20.220.147.82:28482] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/admin.php"] [unique_id "adqQ9mryPgh_uW4QPCl16gAAANc"]
[Sun Apr 12 02:20:40.140395 2026] [:error] [pid 36938:tid 36958] [client 20.220.147.82:28536] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "adqQ-ISWpa_VL1JPU6z0IQAAAZI"]
[Sun Apr 12 02:20:41.064934 2026] [:error] [pid 44700:tid 44748] [client 20.220.147.82:28569] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "adqQ-WryPgh_uW4QPCl18AAAAMQ"]
[Sun Apr 12 02:20:42.467352 2026] [:error] [pid 44701:tid 44786] [client 20.220.147.82:28432] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "adqQ-hGZAP4MrlxEPFdMKwAAAEw"]
[Sun Apr 12 02:20:43.575005 2026] [:error] [pid 44698:tid 44711] [client 20.220.147.82:28651] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "adqQ-xgoH9UWd-U3D558UwAAAIg"]
[Sun Apr 12 02:20:45.169538 2026] [:error] [pid 44700:tid 44765] [client 20.220.147.82:28529] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "adqQ_WryPgh_uW4QPCl1_QAAANU"]
[Sun Apr 12 02:20:46.124998 2026] [:error] [pid 36938:tid 36964] [client 20.220.147.82:28642] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "adqQ_oSWpa_VL1JPU6z0NgAAAZg"]
[Sun Apr 12 02:20:46.984639 2026] [:error] [pid 36938:tid 36950] [client 20.220.147.82:28477] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "adqQ_oSWpa_VL1JPU6z0PAAAAYo"]
[Sun Apr 12 02:20:47.555804 2026] [:error] [pid 44701:tid 44771] [client 20.220.147.82:28483] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "adqQ_xGZAP4MrlxEPFdMNAAAAEA"]
[Sun Apr 12 02:20:48.089107 2026] [:error] [pid 36909:tid 36921] [client 20.220.147.82:28564] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "adqRAEGk5GhxTCzHUOooQwAAAQo"]
[Sun Apr 12 02:20:48.781212 2026] [:error] [pid 44698:tid 44719] [client 20.220.147.82:28513] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "adqRABgoH9UWd-U3D558WAAAAJA"]
[Sun Apr 12 02:20:49.504079 2026] [:error] [pid 44698:tid 44716] [client 20.220.147.82:28646] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "adqRARgoH9UWd-U3D558YAAAAI0"]
[Sun Apr 12 02:20:50.125956 2026] [:error] [pid 44698:tid 44709] [client 20.220.147.82:28492] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "adqRAhgoH9UWd-U3D558YwAAAIY"]
[Sun Apr 12 02:20:50.768541 2026] [:error] [pid 44701:tid 44777] [client 20.220.147.82:28601] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/log.php"] [unique_id "adqRAhGZAP4MrlxEPFdMPwAAAEU"]
[Sun Apr 12 02:20:52.116621 2026] [:error] [pid 44701:tid 44791] [client 20.220.147.82:28442] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/log.php"] [unique_id "adqRBBGZAP4MrlxEPFdMSgAAAFA"]
[Sun Apr 12 02:20:52.776860 2026] [:error] [pid 44701:tid 44778] [client 20.220.147.82:28533] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/log.php"] [unique_id "adqRBBGZAP4MrlxEPFdMTwAAAEY"]
[Sun Apr 12 02:20:53.468506 2026] [:error] [pid 45064:tid 45094] [client 20.220.147.82:28420] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/log.php"] [unique_id "adqRBZcHBvLyJ6EUhUoPOwAAAUI"]
[Sun Apr 12 02:20:54.351958 2026] [:error] [pid 36938:tid 36962] [client 20.220.147.82:28449] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "adqRBoSWpa_VL1JPU6z0TAAAAZY"]
[Sun Apr 12 02:20:54.824912 2026] [:error] [pid 36909:tid 36920] [client 20.220.147.82:28593] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "adqRBkGk5GhxTCzHUOooTAAAAQk"]
[Sun Apr 12 02:20:55.832527 2026] [:error] [pid 44700:tid 44763] [client 20.220.147.82:28503] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "adqRB2ryPgh_uW4QPCl2LwAAANM"]
[Sun Apr 12 02:20:57.091907 2026] [:error] [pid 36909:tid 36914] [client 20.220.147.82:28485] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "adqRCUGk5GhxTCzHUOooVgAAAQM"]
[Sun Apr 12 02:20:57.852895 2026] [:error] [pid 36938:tid 36949] [client 20.220.147.82:28363] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless5.php"] [unique_id "adqRCYSWpa_VL1JPU6z0VgAAAYk"]
[Sun Apr 12 02:20:59.074995 2026] [:error] [pid 44698:tid 44717] [client 20.220.147.82:28451] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless5.php"] [unique_id "adqRCxgoH9UWd-U3D558fwAAAI4"]
[Sun Apr 12 02:20:59.829578 2026] [:error] [pid 36938:tid 36963] [client 20.220.147.82:28521] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless5.php"] [unique_id "adqRC4SWpa_VL1JPU6z0WwAAAZc"]
[Sun Apr 12 02:21:02.009977 2026] [:error] [pid 44701:tid 44778] [client 20.220.147.82:28462] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless5.php"] [unique_id "adqRDhGZAP4MrlxEPFdMWgAAAEY"]
[Sun Apr 12 02:21:04.961075 2026] [:error] [pid 45064:tid 45105] [client 20.220.147.82:28417] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adqREJcHBvLyJ6EUhUoPRgAAAUw"]
[Sun Apr 12 02:21:09.517417 2026] [:error] [pid 36938:tid 36954] [client 20.220.147.82:28663] [client 20.220.147.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "adqRFYSWpa_VL1JPU6z0ggAAAY4"]
[Sun Apr 12 02:21:13.110307 2026] [:error] [pid 44698:tid 44717] [client 20.220.147.82:28658] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "adqRGRgoH9UWd-U3D558lwAAAI4"]
[Sun Apr 12 02:21:14.199842 2026] [:error] [pid 45064:tid 45097] [client 20.220.147.82:28510] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "adqRGpcHBvLyJ6EUhUoPVwAAAUU"]
[Sun Apr 12 02:21:14.878612 2026] [:error] [pid 44698:tid 44727] [client 20.220.147.82:28548] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "adqRGhgoH9UWd-U3D558nQAAAJg"]
[Sun Apr 12 02:21:15.847214 2026] [:error] [pid 36909:tid 36914] [client 20.220.147.82:28354] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "adqRG0Gk5GhxTCzHUOoogAAAAQM"]
[Sun Apr 12 02:21:16.470001 2026] [:error] [pid 44698:tid 44723] [client 20.220.147.82:28660] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "adqRHBgoH9UWd-U3D558pQAAAJQ"]
[Sun Apr 12 02:21:17.451616 2026] [:error] [pid 44698:tid 44707] [client 20.220.147.82:28454] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "adqRHRgoH9UWd-U3D558rQAAAIQ"]
[Sun Apr 12 02:21:19.003281 2026] [:error] [pid 34152:tid 34163] [client 20.220.147.82:28530] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "adqRH4FtE4RhFslT1DrMOgAAAAk"]
[Sun Apr 12 02:21:21.153304 2026] [:error] [pid 34152:tid 34162] [client 20.220.147.82:28435] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o1.php"] [unique_id "adqRIYFtE4RhFslT1DrMQAAAAAg"]
[Sun Apr 12 02:21:22.081040 2026] [:error] [pid 36909:tid 36918] [client 20.220.147.82:28461] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o1.php"] [unique_id "adqRIkGk5GhxTCzHUOooiQAAAQc"]
[Sun Apr 12 02:21:24.591102 2026] [:error] [pid 45064:tid 45105] [client 20.220.147.82:28606] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o1.php"] [unique_id "adqRJJcHBvLyJ6EUhUoPdAAAAUw"]
[Sun Apr 12 02:21:25.499436 2026] [:error] [pid 45064:tid 45107] [client 20.220.147.82:28586] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o1.php"] [unique_id "adqRJZcHBvLyJ6EUhUoPewAAAU4"]
[Sun Apr 12 02:21:26.297498 2026] [:error] [pid 36909:tid 36929] [client 20.220.147.82:28644] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/juuuu.php"] [unique_id "adqRJkGk5GhxTCzHUOoojQAAARI"]
[Sun Apr 12 02:21:28.095060 2026] [:error] [pid 44701:tid 44785] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Sun Apr 12 02:21:28.306549 2026] [:error] [pid 44701:tid 44775] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Sun Apr 12 02:21:28.517155 2026] [:error] [pid 44701:tid 44800] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sun Apr 12 02:21:28.938814 2026] [:error] [pid 44701:tid 44777] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Sun Apr 12 02:21:29.199378 2026] [:error] [pid 44701:tid 44795] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Sun Apr 12 02:21:29.491461 2026] [:error] [pid 44701:tid 44771] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sun Apr 12 02:21:29.701620 2026] [:error] [pid 44701:tid 44787] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Sun Apr 12 02:21:29.911850 2026] [:error] [pid 44701:tid 44773] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Sun Apr 12 02:21:30.222030 2026] [:error] [pid 44701:tid 44799] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Apr 12 02:21:30.547198 2026] [:error] [pid 44701:tid 44781] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Apr 12 02:21:30.792910 2026] [:error] [pid 44701:tid 44798] [client 20.220.147.82:28608] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Sun Apr 12 02:21:31.021431 2026] [:error] [pid 44701:tid 44793] [client 20.220.147.82:28608] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2clas.php"] [unique_id "adqRKxGZAP4MrlxEPFdMfAAAAFI"]
[Sun Apr 12 02:21:31.601748 2026] [:error] [pid 44700:tid 44759] [client 20.220.147.82:28664] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2clas.php"] [unique_id "adqRK2ryPgh_uW4QPCl2SgAAAM8"]
[Sun Apr 12 02:21:32.319022 2026] [:error] [pid 36909:tid 36930] [client 20.220.147.82:28629] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2clas.php"] [unique_id "adqRLEGk5GhxTCzHUOoomQAAARM"]
[Sun Apr 12 02:21:33.111383 2026] [:error] [pid 36938:tid 36948] [client 20.220.147.82:28418] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2clas.php"] [unique_id "adqRLYSWpa_VL1JPU6z0mgAAAYg"]
[Sun Apr 12 02:21:33.978466 2026] [:error] [pid 44701:tid 44800] [client 20.220.147.82:28653] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ave.php"] [unique_id "adqRLRGZAP4MrlxEPFdMgwAAAFg"]
[Sun Apr 12 02:21:34.770792 2026] [:error] [pid 44698:tid 44706] [client 20.220.147.82:28360] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ave.php"] [unique_id "adqRLhgoH9UWd-U3D5585gAAAIM"]
[Sun Apr 12 02:21:35.649728 2026] [:error] [pid 44700:tid 44747] [client 20.220.147.82:28562] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ave.php"] [unique_id "adqRL2ryPgh_uW4QPCl2WQAAAMM"]
[Sun Apr 12 02:21:36.196363 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28632] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ave.php"] [unique_id "adqRMISWpa_VL1JPU6z00AAAAY8"]
[Sun Apr 12 02:21:36.827738 2026] [:error] [pid 44698:tid 44716] [client 20.220.147.82:28595] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wrt.php"] [unique_id "adqRMBgoH9UWd-U3D559GQAAAI0"]
[Sun Apr 12 02:21:37.606224 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28667] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wrt.php"] [unique_id "adqRMYSWpa_VL1JPU6z07QAAAY8"]
[Sun Apr 12 02:21:38.480641 2026] [:error] [pid 45064:tid 45092] [client 20.220.147.82:28556] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wrt.php"] [unique_id "adqRMpcHBvLyJ6EUhUoPqwAAAUA"]
[Sun Apr 12 02:21:38.914958 2026] [:error] [pid 44698:tid 44703] [client 20.220.147.82:28541] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wrt.php"] [unique_id "adqRMhgoH9UWd-U3D559RAAAAIA"]
[Sun Apr 12 02:21:39.401038 2026] [:error] [pid 44698:tid 44713] [client 20.220.147.82:28605] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bibil.php"] [unique_id "adqRMxgoH9UWd-U3D559SwAAAIo"]
[Sun Apr 12 02:21:43.024435 2026] [:error] [pid 45064:tid 45107] [client 20.220.147.82:28650] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bibil.php"] [unique_id "adqRN5cHBvLyJ6EUhUoPsQAAAU4"]
[Sun Apr 12 02:21:53.417803 2026] [:error] [pid 36938:tid 36951] [client 20.220.147.82:28636] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bibil.php"] [unique_id "adqRQYSWpa_VL1JPU6z1EAAAAYs"]
[Sun Apr 12 02:22:07.756498 2026] [:error] [pid 44700:tid 44765] [client 20.220.147.82:28647] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/radio.php"] [unique_id "adqRT2ryPgh_uW4QPCl2mgAAANU"]
[Sun Apr 12 02:22:16.834897 2026] [:error] [pid 44698:tid 44715] [client 20.220.147.82:28657] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/files.php"] [unique_id "adqRWBgoH9UWd-U3D559oAAAAIw"]
[Sun Apr 12 02:22:18.493208 2026] [:error] [pid 44698:tid 44714] [client 20.220.147.82:28655] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/files.php"] [unique_id "adqRWhgoH9UWd-U3D559qwAAAIs"]
[Sun Apr 12 02:22:19.857747 2026] [:error] [pid 44700:tid 44754] [client 20.220.147.82:28532] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/files.php"] [unique_id "adqRW2ryPgh_uW4QPCl2rgAAAMo"]
[Sun Apr 12 02:22:20.950509 2026] [:error] [pid 45064:tid 45116] [client 20.220.147.82:28621] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/files.php"] [unique_id "adqRXJcHBvLyJ6EUhUoP6wAAAVc"]
[Sun Apr 12 02:22:21.855666 2026] [:error] [pid 45064:tid 45094] [client 20.220.147.82:28591] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file7.php"] [unique_id "adqRXZcHBvLyJ6EUhUoP7gAAAUI"]
[Sun Apr 12 02:22:22.852263 2026] [:error] [pid 36909:tid 36916] [client 20.220.147.82:28558] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file7.php"] [unique_id "adqRXkGk5GhxTCzHUOopBgAAAQU"]
[Sun Apr 12 02:22:24.393958 2026] [:error] [pid 44698:tid 44713] [client 20.220.147.82:28577] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file7.php"] [unique_id "adqRYBgoH9UWd-U3D5593wAAAIo"]
[Sun Apr 12 02:22:25.444029 2026] [:error] [pid 36909:tid 36911] [client 20.220.147.82:28578] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file7.php"] [unique_id "adqRYUGk5GhxTCzHUOopDQAAAQA"]
[Sun Apr 12 02:22:26.352626 2026] [:error] [pid 44701:tid 44794] [client 20.220.147.82:28526] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "adqRYhGZAP4MrlxEPFdNQgAAAFM"]
[Sun Apr 12 02:22:27.809325 2026] [:error] [pid 36909:tid 36915] [client 20.220.147.82:28459] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "adqRY0Gk5GhxTCzHUOopEwAAAQQ"]
[Sun Apr 12 02:22:28.762797 2026] [:error] [pid 44698:tid 44705] [client 20.220.147.82:28528] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "adqRZBgoH9UWd-U3D559-wAAAII"]
[Sun Apr 12 02:22:29.465110 2026] [:error] [pid 44698:tid 44721] [client 20.220.147.82:28508] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "adqRZRgoH9UWd-U3D55-BQAAAJI"]
[Sun Apr 12 02:22:30.596967 2026] [:error] [pid 36938:tid 36956] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Sun Apr 12 02:22:30.807445 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Sun Apr 12 02:22:31.026806 2026] [:error] [pid 36938:tid 36950] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Apr 12 02:22:31.236571 2026] [:error] [pid 36938:tid 36951] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Sun Apr 12 02:22:31.444589 2026] [:error] [pid 36938:tid 36941] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Sun Apr 12 02:22:31.706949 2026] [:error] [pid 36938:tid 36963] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Sun Apr 12 02:22:31.917416 2026] [:error] [pid 36938:tid 36945] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Sun Apr 12 02:22:32.125859 2026] [:error] [pid 36938:tid 36948] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Sun Apr 12 02:22:32.368273 2026] [:error] [pid 36938:tid 36962] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sun Apr 12 02:22:32.576731 2026] [:error] [pid 36938:tid 36940] [client 20.220.147.82:28546] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Sun Apr 12 02:22:32.781921 2026] [:error] [pid 36938:tid 36952] [client 20.220.147.82:28546] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ac.php"] [unique_id "adqRaISWpa_VL1JPU6z1mQAAAYw"]
[Sun Apr 12 02:22:34.846806 2026] [:error] [pid 44698:tid 44714] [client 20.220.147.82:28547] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ac.php"] [unique_id "adqRahgoH9UWd-U3D55-HAAAAIs"]
[Sun Apr 12 02:22:36.321768 2026] [:error] [pid 44700:tid 44768] [client 20.220.147.82:28353] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ac.php"] [unique_id "adqRbGryPgh_uW4QPCl2ywAAANg"]
[Sun Apr 12 02:22:43.093800 2026] [:error] [pid 44698:tid 44707] [client 20.220.147.82:28623] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ac.php"] [unique_id "adqRcxgoH9UWd-U3D55-UgAAAIQ"]
[Sun Apr 12 02:22:44.671250 2026] [:error] [pid 36938:tid 36951] [client 20.220.147.82:28671] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new4.php"] [unique_id "adqRdISWpa_VL1JPU6z1uAAAAYs"]
[Sun Apr 12 02:22:45.741057 2026] [:error] [pid 44698:tid 44714] [client 20.220.147.82:28388] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new4.php"] [unique_id "adqRdRgoH9UWd-U3D55-YQAAAIs"]
[Sun Apr 12 02:22:47.763545 2026] [:error] [pid 36909:tid 36922] [client 20.220.147.82:28579] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new4.php"] [unique_id "adqRd0Gk5GhxTCzHUOopQAAAAQs"]
[Sun Apr 12 02:22:49.891933 2026] [:error] [pid 36938:tid 36946] [client 20.220.147.82:28577] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new4.php"] [unique_id "adqReYSWpa_VL1JPU6z1xwAAAYY"]
[Sun Apr 12 02:22:53.832441 2026] [:error] [pid 44698:tid 44720] [client 20.220.147.82:28670] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pop.php"] [unique_id "adqRfRgoH9UWd-U3D55-lQAAAJE"]
[Sun Apr 12 02:22:56.844285 2026] [:error] [pid 44698:tid 44712] [client 20.220.147.82:28641] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pop.php"] [unique_id "adqRgBgoH9UWd-U3D55-pwAAAIk"]
[Sun Apr 12 02:22:59.856675 2026] [:error] [pid 45064:tid 45099] [client 20.220.147.82:28622] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pop.php"] [unique_id "adqRg5cHBvLyJ6EUhUoQEgAAAUc"]
[Sun Apr 12 02:23:00.793974 2026] [:error] [pid 44698:tid 44704] [client 20.220.147.82:28599] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pop.php"] [unique_id "adqRhBgoH9UWd-U3D55-zAAAAIE"]
[Sun Apr 12 02:23:02.910992 2026] [:error] [pid 36938:tid 36943] [client 20.220.147.82:28648] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "adqRhoSWpa_VL1JPU6z15AAAAYM"]
[Sun Apr 12 02:23:04.937402 2026] [:error] [pid 36909:tid 36911] [client 20.220.147.82:28630] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "adqRiEGk5GhxTCzHUOopVAAAAQA"]
[Sun Apr 12 02:23:06.881763 2026] [:error] [pid 36909:tid 36923] [client 20.220.147.82:28516] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "adqRikGk5GhxTCzHUOopXQAAAQw"]
[Sun Apr 12 02:23:08.279081 2026] [:error] [pid 44698:tid 44720] [client 20.220.147.82:28638] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/az.php"] [unique_id "adqRjBgoH9UWd-U3D55-9QAAAJE"]
[Sun Apr 12 02:23:11.106662 2026] [:error] [pid 44698:tid 44711] [client 20.220.147.82:28626] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xaz.php"] [unique_id "adqRjxgoH9UWd-U3D55_CQAAAIg"]
[Sun Apr 12 02:23:12.817393 2026] [:error] [pid 36938:tid 36955] [client 20.220.147.82:28643] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xaz.php"] [unique_id "adqRkISWpa_VL1JPU6z2CQAAAY8"]
[Sun Apr 12 02:23:14.274327 2026] [:error] [pid 44698:tid 44708] [client 20.220.147.82:28574] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xaz.php"] [unique_id "adqRkhgoH9UWd-U3D55_GQAAAIU"]
[Sun Apr 12 02:23:15.056972 2026] [:error] [pid 44698:tid 44714] [client 20.220.147.82:28666] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xaz.php"] [unique_id "adqRkxgoH9UWd-U3D55_IQAAAIs"]
[Sun Apr 12 02:23:16.234691 2026] [:error] [pid 45064:tid 45116] [client 20.220.147.82:28614] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/up4.php"] [unique_id "adqRlJcHBvLyJ6EUhUoQIwAAAVc"]
[Sun Apr 12 02:23:17.571964 2026] [:error] [pid 44698:tid 44709] [client 20.220.147.82:28497] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/up4.php"] [unique_id "adqRlRgoH9UWd-U3D55_OQAAAIY"]
[Sun Apr 12 02:23:20.999599 2026] [:error] [pid 44700:tid 44753] [client 20.220.147.82:28568] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/up4.php"] [unique_id "adqRmGryPgh_uW4QPCl3CgAAAMk"]
[Sun Apr 12 02:23:24.207893 2026] [:error] [pid 44701:tid 44777] [client 20.220.147.82:28554] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/up4.php"] [unique_id "adqRnBGZAP4MrlxEPFdNVwAAAEU"]
[Sun Apr 12 02:23:27.769873 2026] [:error] [pid 44698:tid 44711] [client 20.220.147.82:28640] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1aa.php"] [unique_id "adqRnxgoH9UWd-U3D55_TwAAAIg"]
[Sun Apr 12 02:23:29.639345 2026] [:error] [pid 44700:tid 44747] [client 20.220.147.82:28590] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1aa.php"] [unique_id "adqRoWryPgh_uW4QPCl3JgAAAMM"]
[Sun Apr 12 02:23:31.193578 2026] [:error] [pid 44701:tid 44776] [client 20.220.147.82:28480] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1aa.php"] [unique_id "adqRoxGZAP4MrlxEPFdNXQAAAEQ"]
[Sun Apr 12 02:23:33.902330 2026] [:error] [pid 36938:tid 36942] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Sun Apr 12 02:23:34.110728 2026] [:error] [pid 36938:tid 36963] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Apr 12 02:23:34.381781 2026] [:error] [pid 36938:tid 36957] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Sun Apr 12 02:23:34.615105 2026] [:error] [pid 36938:tid 36945] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Sun Apr 12 02:23:35.078201 2026] [:error] [pid 36938:tid 36961] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Sun Apr 12 02:23:35.318083 2026] [:error] [pid 36938:tid 36953] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Sun Apr 12 02:23:35.560568 2026] [:error] [pid 36938:tid 36947] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sun Apr 12 02:23:35.769545 2026] [:error] [pid 36938:tid 36960] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sun Apr 12 02:23:35.999935 2026] [:error] [pid 36938:tid 36949] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sun Apr 12 02:23:36.211944 2026] [:error] [pid 36938:tid 36962] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Sun Apr 12 02:23:36.422028 2026] [:error] [pid 36938:tid 36958] [client 20.220.147.82:28396] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 12 02:23:36.631972 2026] [:error] [pid 36938:tid 36940] [client 20.220.147.82:28396] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/profile.php"] [unique_id "adqRqISWpa_VL1JPU6z2NwAAAYA"]
[Sun Apr 12 02:23:38.292140 2026] [:error] [pid 44698:tid 44725] [client 20.220.147.82:28669] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/profile.php"] [unique_id "adqRqhgoH9UWd-U3D55_hQAAAJY"]
[Sun Apr 12 02:23:39.901109 2026] [:error] [pid 44698:tid 44716] [client 20.220.147.82:28645] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/profile.php"] [unique_id "adqRqxgoH9UWd-U3D55_jAAAAI0"]
[Sun Apr 12 02:23:41.837941 2026] [:error] [pid 36938:tid 36961] [client 20.220.147.82:28596] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/profile.php"] [unique_id "adqRrYSWpa_VL1JPU6z2PQAAAZU"]
[Sun Apr 12 02:23:43.017789 2026] [:error] [pid 36938:tid 36953] [client 20.220.147.82:28625] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "adqRr4SWpa_VL1JPU6z2PwAAAY0"]
[Sun Apr 12 02:23:44.291444 2026] [:error] [pid 34152:tid 34168] [client 20.220.147.82:28561] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "adqRsIFtE4RhFslT1DrNLgAAAA4"]
[Sun Apr 12 02:23:45.035006 2026] [:error] [pid 44700:tid 44753] [client 20.220.147.82:28573] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "adqRsWryPgh_uW4QPCl3RwAAAMk"]
[Sun Apr 12 02:23:45.894485 2026] [:error] [pid 44698:tid 44705] [client 20.220.147.82:28559] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "adqRsRgoH9UWd-U3D55_ngAAAII"]
[Sun Apr 12 02:23:46.793905 2026] [:error] [pid 44698:tid 44713] [client 20.220.147.82:28553] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sites.php"] [unique_id "adqRshgoH9UWd-U3D55_owAAAIo"]
[Sun Apr 12 02:23:47.636126 2026] [:error] [pid 36938:tid 36946] [client 20.220.147.82:28552] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sites.php"] [unique_id "adqRs4SWpa_VL1JPU6z2RwAAAYY"]
[Sun Apr 12 02:23:48.432864 2026] [:error] [pid 44698:tid 44717] [client 20.220.147.82:27843] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sites.php"] [unique_id "adqRtBgoH9UWd-U3D55_qgAAAI4"]
[Sun Apr 12 02:23:49.084891 2026] [:error] [pid 44698:tid 44707] [client 20.220.147.82:28665] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sites.php"] [unique_id "adqRtRgoH9UWd-U3D55_qwAAAIQ"]
[Sun Apr 12 02:23:50.227065 2026] [:error] [pid 44698:tid 44727] [client 20.220.147.82:28551] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byp.php"] [unique_id "adqRthgoH9UWd-U3D55_swAAAJg"]
[Sun Apr 12 02:23:51.130830 2026] [:error] [pid 44700:tid 44752] [client 20.220.147.82:28426] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byp.php"] [unique_id "adqRt2ryPgh_uW4QPCl3VQAAAMg"]
[Sun Apr 12 02:23:52.515393 2026] [:error] [pid 36938:tid 36943] [client 20.220.147.82:28597] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byp.php"] [unique_id "adqRuISWpa_VL1JPU6z2YwAAAYM"]
[Sun Apr 12 02:23:53.093745 2026] [:error] [pid 44698:tid 44709] [client 20.220.147.82:28502] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byp.php"] [unique_id "adqRuRgoH9UWd-U3D55_uwAAAIY"]
[Sun Apr 12 02:23:53.880243 2026] [:error] [pid 34152:tid 34163] [client 20.220.147.82:28637] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "adqRuYFtE4RhFslT1DrNMgAAAAk"]
[Sun Apr 12 02:23:54.844757 2026] [:error] [pid 44698:tid 44711] [client 20.220.147.82:28488] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "adqRuhgoH9UWd-U3D55_ygAAAIg"]
[Sun Apr 12 02:23:55.639311 2026] [:error] [pid 44698:tid 44726] [client 20.220.147.82:28656] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "adqRuxgoH9UWd-U3D55_zgAAAJc"]
[Sun Apr 12 02:23:56.181203 2026] [:error] [pid 44701:tid 44786] [client 20.220.147.82:28464] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "adqRvBGZAP4MrlxEPFdNbgAAAEw"]
[Sun Apr 12 02:23:57.360021 2026] [:error] [pid 36938:tid 36944] [client 20.220.147.82:28544] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "adqRvYSWpa_VL1JPU6z2aAAAAYQ"]
[Sun Apr 12 02:23:58.497035 2026] [:error] [pid 44698:tid 44713] [client 20.220.147.82:28602] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "adqRvhgoH9UWd-U3D55_1wAAAIo"]
[Sun Apr 12 02:24:00.729834 2026] [:error] [pid 44698:tid 44704] [client 20.220.147.82:28662] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "adqRwBgoH9UWd-U3D55_5wAAAIE"]
[Sun Apr 12 02:24:01.917356 2026] [:error] [pid 36938:tid 36949] [client 20.220.147.82:28633] [client 20.220.147.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "adqRwYSWpa_VL1JPU6z2fAAAAYk"]
[Sun Apr 12 03:46:18.426932 2026] [:error] [pid 36938:tid 36964] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Sun Apr 12 03:46:18.684347 2026] [:error] [pid 36938:tid 36950] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Sun Apr 12 03:46:18.917986 2026] [:error] [pid 36938:tid 36957] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/flox.php
[Sun Apr 12 03:46:19.157972 2026] [:error] [pid 36938:tid 36951] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/mff.php
[Sun Apr 12 03:46:19.393588 2026] [:error] [pid 36938:tid 36952] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sun Apr 12 03:46:19.633766 2026] [:error] [pid 36938:tid 36946] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/8QXC9v.php
[Sun Apr 12 03:46:19.864958 2026] [:error] [pid 36938:tid 36949] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Apr 12 03:46:20.112632 2026] [:error] [pid 36938:tid 36959] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/panel.php
[Sun Apr 12 03:46:20.360667 2026] [:error] [pid 36938:tid 36955] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Sun Apr 12 03:46:20.592793 2026] [:error] [pid 36938:tid 36956] [client 172.213.241.51:11228] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Sun Apr 12 03:46:20.821281 2026] [:error] [pid 36938:tid 36944] [client 172.213.241.51:11228] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "adqlDISWpa_VL1JPU6wU3gAAAYQ"]
[Sun Apr 12 03:46:21.353054 2026] [:error] [pid 45064:tid 45092] [client 172.213.241.51:11154] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "adqlDZcHBvLyJ6EUhUoqcQAAAUA"]
[Sun Apr 12 03:46:21.919872 2026] [:error] [pid 45064:tid 45093] [client 172.213.241.51:11205] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "adqlDZcHBvLyJ6EUhUoqcgAAAUE"]
[Sun Apr 12 03:46:22.395783 2026] [:error] [pid 36909:tid 36933] [client 172.213.241.51:11250] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "adqlDkGk5GhxTCzHUOpbLQAAARY"]
[Sun Apr 12 03:46:23.089675 2026] [:error] [pid 36938:tid 36959] [client 172.213.241.51:11244] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "adqlD4SWpa_VL1JPU6wU6AAAAZM"]
[Sun Apr 12 03:46:23.584336 2026] [:error] [pid 36938:tid 36954] [client 172.213.241.51:11240] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "adqlD4SWpa_VL1JPU6wU7wAAAY4"]
[Sun Apr 12 03:46:24.173825 2026] [:error] [pid 36909:tid 36929] [client 172.213.241.51:11215] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "adqlEEGk5GhxTCzHUOpbMAAAARI"]
[Sun Apr 12 03:46:24.721037 2026] [:error] [pid 44701:tid 44777] [client 172.213.241.51:11202] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "adqlEBGZAP4MrlxEPFdscwAAAEU"]
[Sun Apr 12 03:46:25.315383 2026] [:error] [pid 36938:tid 36955] [client 172.213.241.51:11201] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "adqlEYSWpa_VL1JPU6wU-QAAAY8"]
[Sun Apr 12 03:46:25.796543 2026] [:error] [pid 36938:tid 36943] [client 172.213.241.51:11251] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "adqlEYSWpa_VL1JPU6wU_AAAAYM"]
[Sun Apr 12 03:46:26.405812 2026] [:error] [pid 44698:tid 44726] [client 172.213.241.51:11161] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "adqlEhgoH9UWd-U3D56lhAAAAJc"]
[Sun Apr 12 03:46:26.947513 2026] [:error] [pid 36938:tid 36940] [client 172.213.241.51:11223] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "adqlEoSWpa_VL1JPU6wVAQAAAYA"]
[Sun Apr 12 03:46:27.618951 2026] [:error] [pid 44698:tid 44715] [client 172.213.241.51:11152] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "adqlExgoH9UWd-U3D56liAAAAIw"]
[Sun Apr 12 03:46:28.158639 2026] [:error] [pid 36938:tid 36941] [client 172.213.241.51:11235] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "adqlFISWpa_VL1JPU6wVBgAAAYE"]
[Sun Apr 12 03:46:28.672926 2026] [:error] [pid 36938:tid 36945] [client 172.213.241.51:11206] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "adqlFISWpa_VL1JPU6wVDAAAAYU"]
[Sun Apr 12 03:46:29.220294 2026] [:error] [pid 36938:tid 36951] [client 172.213.241.51:11139] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "adqlFYSWpa_VL1JPU6wVDwAAAYs"]
[Sun Apr 12 03:46:29.804978 2026] [:error] [pid 36938:tid 36948] [client 172.213.241.51:11145] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "adqlFYSWpa_VL1JPU6wVFwAAAYg"]
[Sun Apr 12 03:46:30.324872 2026] [:error] [pid 36938:tid 36943] [client 172.213.241.51:11222] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "adqlFoSWpa_VL1JPU6wVHAAAAYM"]
[Sun Apr 12 03:46:30.852347 2026] [:error] [pid 44698:tid 44704] [client 172.213.241.51:11207] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "adqlFhgoH9UWd-U3D56ljwAAAIE"]
[Sun Apr 12 03:46:31.355500 2026] [:error] [pid 36938:tid 36941] [client 172.213.241.51:11156] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "adqlF4SWpa_VL1JPU6wVIwAAAYE"]
[Sun Apr 12 03:46:31.891344 2026] [:error] [pid 36938:tid 36943] [client 172.213.241.51:11151] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "adqlF4SWpa_VL1JPU6wVJQAAAYM"]
[Sun Apr 12 03:46:32.410335 2026] [:error] [pid 36938:tid 36951] [client 172.213.241.51:11252] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "adqlGISWpa_VL1JPU6wVKAAAAYs"]
[Sun Apr 12 03:46:32.958392 2026] [:error] [pid 36938:tid 36953] [client 172.213.241.51:11259] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "adqlGISWpa_VL1JPU6wVLQAAAY0"]
[Sun Apr 12 03:46:33.418571 2026] [:error] [pid 45064:tid 45116] [client 172.213.241.51:11203] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "adqlGZcHBvLyJ6EUhUoqdQAAAVc"]
[Sun Apr 12 03:46:33.914971 2026] [:error] [pid 44700:tid 44762] [client 172.213.241.51:11143] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/water.php"] [unique_id "adqlGWryPgh_uW4QPCmTpQAAANI"]
[Sun Apr 12 03:46:34.413422 2026] [:error] [pid 36938:tid 36950] [client 172.213.241.51:11165] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/water.php"] [unique_id "adqlGoSWpa_VL1JPU6wVMAAAAYo"]
[Sun Apr 12 03:46:34.942834 2026] [:error] [pid 45064:tid 45104] [client 172.213.241.51:11254] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/water.php"] [unique_id "adqlGpcHBvLyJ6EUhUoqfQAAAUs"]
[Sun Apr 12 03:46:35.417048 2026] [:error] [pid 45064:tid 45098] [client 172.213.241.51:11169] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/water.php"] [unique_id "adqlG5cHBvLyJ6EUhUoqgQAAAUY"]
[Sun Apr 12 03:46:35.895893 2026] [:error] [pid 44698:tid 44705] [client 172.213.241.51:11257] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "adqlGxgoH9UWd-U3D56lmQAAAII"]
[Sun Apr 12 03:46:36.401135 2026] [:error] [pid 44698:tid 44727] [client 172.213.241.51:11141] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "adqlHBgoH9UWd-U3D56lmwAAAJg"]
[Sun Apr 12 03:46:36.908940 2026] [:error] [pid 34152:tid 34160] [client 172.213.241.51:11200] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "adqlHIFtE4RhFslT1DrrwgAAAAY"]
[Sun Apr 12 03:46:37.376488 2026] [:error] [pid 34152:tid 34168] [client 172.213.241.51:11239] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "adqlHYFtE4RhFslT1DrrxAAAAA4"]
[Sun Apr 12 03:46:37.853545 2026] [:error] [pid 34152:tid 34159] [client 172.213.241.51:11146] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "adqlHYFtE4RhFslT1DrryQAAAAU"]
[Sun Apr 12 03:46:38.348104 2026] [:error] [pid 36909:tid 36918] [client 172.213.241.51:11226] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "adqlHkGk5GhxTCzHUOpbOQAAAQc"]
[Sun Apr 12 03:46:38.849420 2026] [:error] [pid 44700:tid 44746] [client 172.213.241.51:11255] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "adqlHmryPgh_uW4QPCmTqgAAAMI"]
[Sun Apr 12 03:46:39.364601 2026] [:error] [pid 44698:tid 44712] [client 172.213.241.51:11246] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "adqlHxgoH9UWd-U3D56loAAAAIk"]
[Sun Apr 12 03:46:39.853091 2026] [:error] [pid 44698:tid 44726] [client 172.213.241.51:11136] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wert.php"] [unique_id "adqlHxgoH9UWd-U3D56logAAAJc"]
[Sun Apr 12 03:46:40.360507 2026] [:error] [pid 44700:tid 44759] [client 172.213.241.51:11159] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wert.php"] [unique_id "adqlIGryPgh_uW4QPCmTrgAAAM8"]
[Sun Apr 12 03:46:40.830467 2026] [:error] [pid 44700:tid 44755] [client 172.213.241.51:11172] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wert.php"] [unique_id "adqlIGryPgh_uW4QPCmTsgAAAMs"]
[Sun Apr 12 03:46:41.365965 2026] [:error] [pid 36909:tid 36916] [client 172.213.241.51:11258] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wert.php"] [unique_id "adqlIUGk5GhxTCzHUOpbPQAAAQU"]
[Sun Apr 12 03:46:41.828105 2026] [:error] [pid 44700:tid 44751] [client 172.213.241.51:11216] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "adqlIWryPgh_uW4QPCmTtAAAAMc"]
[Sun Apr 12 03:46:42.381128 2026] [:error] [pid 36938:tid 36964] [client 172.213.241.51:11175] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "adqlIoSWpa_VL1JPU6wVOwAAAZg"]
[Sun Apr 12 03:46:42.914563 2026] [:error] [pid 36909:tid 36933] [client 172.213.241.51:11153] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "adqlIkGk5GhxTCzHUOpbPgAAARY"]
[Sun Apr 12 03:46:43.416639 2026] [:error] [pid 36938:tid 36960] [client 172.213.241.51:11249] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "adqlI4SWpa_VL1JPU6wVQgAAAZQ"]
[Sun Apr 12 03:46:43.898911 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:11242] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "adqlI0Gk5GhxTCzHUOpbQwAAAQ4"]
[Sun Apr 12 03:46:44.365978 2026] [:error] [pid 36909:tid 36928] [client 172.213.241.51:11170] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "adqlJEGk5GhxTCzHUOpbRgAAARE"]
[Sun Apr 12 03:46:44.841489 2026] [:error] [pid 36909:tid 36920] [client 172.213.241.51:11247] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "adqlJEGk5GhxTCzHUOpbSQAAAQk"]
[Sun Apr 12 03:46:45.340233 2026] [:error] [pid 36909:tid 36926] [client 172.213.241.51:11227] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "adqlJUGk5GhxTCzHUOpbTQAAAQ8"]
[Sun Apr 12 03:46:45.816876 2026] [:error] [pid 36938:tid 36947] [client 172.213.241.51:11193] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oij98gy.php"] [unique_id "adqlJYSWpa_VL1JPU6wVRgAAAYc"]
[Sun Apr 12 03:46:46.288026 2026] [:error] [pid 36938:tid 36943] [client 172.213.241.51:11230] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oij98gy.php"] [unique_id "adqlJoSWpa_VL1JPU6wVSgAAAYM"]
[Sun Apr 12 03:46:46.755878 2026] [:error] [pid 36938:tid 36950] [client 172.213.241.51:11211] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oij98gy.php"] [unique_id "adqlJoSWpa_VL1JPU6wVTQAAAYo"]
[Sun Apr 12 03:46:47.266328 2026] [:error] [pid 44698:tid 44708] [client 172.213.241.51:11072] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oij98gy.php"] [unique_id "adqlJxgoH9UWd-U3D56lqAAAAIU"]
[Sun Apr 12 03:46:47.754396 2026] [:error] [pid 45064:tid 45108] [client 172.213.241.51:11260] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "adqlJ5cHBvLyJ6EUhUoqkwAAAU8"]
[Sun Apr 12 03:46:48.261223 2026] [:error] [pid 45064:tid 45112] [client 172.213.241.51:11217] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "adqlKJcHBvLyJ6EUhUoqlQAAAVM"]
[Sun Apr 12 03:46:48.733326 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:11157] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "adqlKEGk5GhxTCzHUOpbXwAAAQ4"]
[Sun Apr 12 03:46:49.237825 2026] [:error] [pid 44701:tid 44776] [client 172.213.241.51:11140] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "adqlKRGZAP4MrlxEPFdsiAAAAEQ"]
[Sun Apr 12 03:46:49.831529 2026] [:error] [pid 44700:tid 44754] [client 172.213.241.51:11174] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/turkshell.php"] [unique_id "adqlKWryPgh_uW4QPCmTuQAAAMo"]
[Sun Apr 12 03:46:50.354940 2026] [:error] [pid 36909:tid 36918] [client 172.213.241.51:11158] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/turkshell.php"] [unique_id "adqlKkGk5GhxTCzHUOpbbgAAAQc"]
[Sun Apr 12 03:46:50.835401 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:11245] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/turkshell.php"] [unique_id "adqlKkGk5GhxTCzHUOpbbwAAAQ4"]
[Sun Apr 12 03:46:51.356291 2026] [:error] [pid 34152:tid 34161] [client 172.213.241.51:11243] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/turkshell.php"] [unique_id "adqlK4FtE4RhFslT1Drr0QAAAAc"]
[Sun Apr 12 03:46:51.921120 2026] [:error] [pid 36909:tid 36920] [client 172.213.241.51:11263] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "adqlK0Gk5GhxTCzHUOpbdQAAAQk"]
[Sun Apr 12 03:46:52.483722 2026] [:error] [pid 34152:tid 34160] [client 172.213.241.51:11262] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "adqlLIFtE4RhFslT1Drr1AAAAAY"]
[Sun Apr 12 03:46:52.963606 2026] [:error] [pid 34152:tid 34156] [client 172.213.241.51:11177] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "adqlLIFtE4RhFslT1Drr1wAAAAI"]
[Sun Apr 12 03:46:53.481541 2026] [:error] [pid 45064:tid 45096] [client 172.213.241.51:11179] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "adqlLZcHBvLyJ6EUhUoqnwAAAUQ"]
[Sun Apr 12 03:46:54.055384 2026] [:error] [pid 45064:tid 45092] [client 172.213.241.51:11073] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/seo.php"] [unique_id "adqlLpcHBvLyJ6EUhUoqogAAAUA"]
[Sun Apr 12 03:46:54.526813 2026] [:error] [pid 45064:tid 45112] [client 172.213.241.51:11080] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/seo.php"] [unique_id "adqlLpcHBvLyJ6EUhUoqpgAAAVM"]
[Sun Apr 12 03:46:55.017571 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:11167] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/seo.php"] [unique_id "adqlL0Gk5GhxTCzHUOpbegAAAQ4"]
[Sun Apr 12 03:46:55.478969 2026] [:error] [pid 36909:tid 36929] [client 172.213.241.51:11088] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/seo.php"] [unique_id "adqlL0Gk5GhxTCzHUOpbfAAAARI"]
[Sun Apr 12 03:46:56.034032 2026] [:error] [pid 44701:tid 44791] [client 172.213.241.51:11229] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "adqlMBGZAP4MrlxEPFdsjwAAAFA"]
[Sun Apr 12 03:46:56.547059 2026] [:error] [pid 36909:tid 36928] [client 172.213.241.51:11155] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "adqlMEGk5GhxTCzHUOpbfwAAARE"]
[Sun Apr 12 03:46:57.033475 2026] [:error] [pid 36909:tid 36919] [client 172.213.241.51:11168] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "adqlMUGk5GhxTCzHUOpbggAAAQg"]
[Sun Apr 12 03:46:57.596955 2026] [:error] [pid 45064:tid 45111] [client 172.213.241.51:11248] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "adqlMZcHBvLyJ6EUhUoqrAAAAVI"]
[Sun Apr 12 03:46:58.166963 2026] [:error] [pid 44701:tid 44794] [client 172.213.241.51:11191] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "adqlMhGZAP4MrlxEPFdslgAAAFM"]
[Sun Apr 12 03:46:58.640736 2026] [:error] [pid 36938:tid 36956] [client 172.213.241.51:11183] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "adqlMoSWpa_VL1JPU6wVZAAAAZA"]
[Sun Apr 12 03:46:59.148367 2026] [:error] [pid 36909:tid 36926] [client 172.213.241.51:11219] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "adqlM0Gk5GhxTCzHUOpbiAAAAQ8"]
[Sun Apr 12 03:46:59.669954 2026] [:error] [pid 36909:tid 36923] [client 172.213.241.51:11176] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "adqlM0Gk5GhxTCzHUOpbigAAAQw"]
[Sun Apr 12 03:47:00.140630 2026] [:error] [pid 36909:tid 36922] [client 172.213.241.51:11184] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "adqlNEGk5GhxTCzHUOpbjgAAAQs"]
[Sun Apr 12 03:47:00.607463 2026] [:error] [pid 36909:tid 36920] [client 172.213.241.51:11160] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "adqlNEGk5GhxTCzHUOpbkQAAAQk"]
[Sun Apr 12 03:47:01.106395 2026] [:error] [pid 44701:tid 44786] [client 172.213.241.51:11083] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "adqlNRGZAP4MrlxEPFdsnQAAAEw"]
[Sun Apr 12 03:47:01.573381 2026] [:error] [pid 36909:tid 36914] [client 172.213.241.51:11238] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "adqlNUGk5GhxTCzHUOpblQAAAQM"]
[Sun Apr 12 03:47:02.121350 2026] [:error] [pid 36909:tid 36935] [client 172.213.241.51:11147] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "adqlNkGk5GhxTCzHUOpblwAAARg"]
[Sun Apr 12 03:47:02.659767 2026] [:error] [pid 34152:tid 34173] [client 172.213.241.51:11111] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "adqlNoFtE4RhFslT1Drr7AAAABM"]
[Sun Apr 12 03:47:03.146782 2026] [:error] [pid 36909:tid 36916] [client 172.213.241.51:11171] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "adqlN0Gk5GhxTCzHUOpbmgAAAQU"]
[Sun Apr 12 03:47:03.621488 2026] [:error] [pid 34152:tid 34175] [client 172.213.241.51:11076] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "adqlN4FtE4RhFslT1Drr7gAAABU"]
[Sun Apr 12 03:47:04.174676 2026] [:error] [pid 44700:tid 44745] [client 172.213.241.51:11096] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "adqlOGryPgh_uW4QPCmTvgAAAME"]
[Sun Apr 12 03:47:04.647414 2026] [:error] [pid 44698:tid 44708] [client 172.213.241.51:11224] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "adqlOBgoH9UWd-U3D56luAAAAIU"]
[Sun Apr 12 03:47:05.143477 2026] [:error] [pid 44700:tid 44767] [client 172.213.241.51:11094] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "adqlOWryPgh_uW4QPCmTwAAAANc"]
[Sun Apr 12 03:47:05.619000 2026] [:error] [pid 36909:tid 36918] [client 172.213.241.51:11096] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "adqlOUGk5GhxTCzHUOpbnAAAAQc"]
[Sun Apr 12 03:47:06.159669 2026] [:error] [pid 34152:tid 34162] [client 172.213.241.51:11142] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "adqlOoFtE4RhFslT1Drr8wAAAAg"]
[Sun Apr 12 03:47:06.620433 2026] [:error] [pid 44701:tid 44791] [client 172.213.241.51:11109] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "adqlOhGZAP4MrlxEPFdsrAAAAFA"]
[Sun Apr 12 03:47:07.138582 2026] [:error] [pid 34152:tid 34176] [client 172.213.241.51:11163] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "adqlO4FtE4RhFslT1Drr9gAAABY"]
[Sun Apr 12 03:47:07.611452 2026] [:error] [pid 44701:tid 44789] [client 172.213.241.51:11082] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "adqlOxGZAP4MrlxEPFdssAAAAE4"]
[Sun Apr 12 03:47:08.129778 2026] [:error] [pid 34152:tid 34168] [client 172.213.241.51:11186] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "adqlPIFtE4RhFslT1Drr-AAAAA4"]
[Sun Apr 12 03:47:08.606809 2026] [:error] [pid 44698:tid 44721] [client 172.213.241.51:11233] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "adqlPBgoH9UWd-U3D56lwgAAAJI"]
[Sun Apr 12 03:47:09.083591 2026] [:error] [pid 36938:tid 36942] [client 172.213.241.51:11131] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "adqlPYSWpa_VL1JPU6wVbAAAAYI"]
[Sun Apr 12 03:47:09.542821 2026] [:error] [pid 36909:tid 36912] [client 172.213.241.51:11218] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "adqlPUGk5GhxTCzHUOpbpAAAAQE"]
[Sun Apr 12 03:47:10.017928 2026] [:error] [pid 36909:tid 36920] [client 172.213.241.51:11256] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/6.php"] [unique_id "adqlPkGk5GhxTCzHUOpbpgAAAQk"]
[Sun Apr 12 03:47:10.494705 2026] [:error] [pid 44700:tid 44753] [client 172.213.241.51:11197] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/6.php"] [unique_id "adqlPmryPgh_uW4QPCmTxAAAAMk"]
[Sun Apr 12 03:47:10.958017 2026] [:error] [pid 34152:tid 34174] [client 172.213.241.51:11185] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/6.php"] [unique_id "adqlPoFtE4RhFslT1Drr_wAAABQ"]
[Sun Apr 12 03:47:11.458007 2026] [:error] [pid 36909:tid 36931] [client 172.213.241.51:11089] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/6.php"] [unique_id "adqlP0Gk5GhxTCzHUOpbqAAAARQ"]
[Sun Apr 12 03:47:11.924583 2026] [:error] [pid 34152:tid 34170] [client 172.213.241.51:11231] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "adqlP4FtE4RhFslT1DrsAQAAABA"]
[Sun Apr 12 03:47:12.451465 2026] [:error] [pid 44700:tid 44761] [client 172.213.241.51:11189] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "adqlQGryPgh_uW4QPCmTxgAAANE"]
[Sun Apr 12 03:47:12.924309 2026] [:error] [pid 36909:tid 36924] [client 172.213.241.51:11085] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "adqlQEGk5GhxTCzHUOpbqgAAAQ0"]
[Sun Apr 12 03:47:13.409553 2026] [:error] [pid 36909:tid 36933] [client 172.213.241.51:11150] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "adqlQUGk5GhxTCzHUOpbrQAAARY"]
[Sun Apr 12 03:47:13.878196 2026] [:error] [pid 44700:tid 44765] [client 172.213.241.51:11128] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "adqlQWryPgh_uW4QPCmTyQAAANU"]
[Sun Apr 12 03:47:14.363731 2026] [:error] [pid 36909:tid 36915] [client 172.213.241.51:11173] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "adqlQkGk5GhxTCzHUOpbsAAAAQQ"]
[Sun Apr 12 03:47:14.820866 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:11149] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "adqlQkGk5GhxTCzHUOpbtAAAAQ4"]
[Sun Apr 12 03:47:15.284589 2026] [:error] [pid 36909:tid 36919] [client 172.213.241.51:11232] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "adqlQ0Gk5GhxTCzHUOpbtwAAAQg"]
[Sun Apr 12 03:47:15.789180 2026] [:error] [pid 44698:tid 44703] [client 172.213.241.51:11199] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.mopj.php"] [unique_id "adqlQxgoH9UWd-U3D56lzQAAAIA"]
[Sun Apr 12 03:47:16.276786 2026] [:error] [pid 44698:tid 44727] [client 172.213.241.51:11127] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.mopj.php"] [unique_id "adqlRBgoH9UWd-U3D56lzwAAAJg"]
[Sun Apr 12 03:47:16.790163 2026] [:error] [pid 34152:tid 34164] [client 172.213.241.51:11107] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.mopj.php"] [unique_id "adqlRIFtE4RhFslT1DrsCgAAAAo"]
[Sun Apr 12 03:47:17.251994 2026] [:error] [pid 36909:tid 36930] [client 172.213.241.51:11104] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.mopj.php"] [unique_id "adqlRUGk5GhxTCzHUOpbyQAAARM"]
[Sun Apr 12 03:47:17.714408 2026] [:error] [pid 44698:tid 44704] [client 172.213.241.51:11078] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "adqlRRgoH9UWd-U3D56l0AAAAIE"]
[Sun Apr 12 03:47:18.180029 2026] [:error] [pid 44698:tid 44718] [client 172.213.241.51:11114] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "adqlRhgoH9UWd-U3D56l0wAAAI8"]
[Sun Apr 12 03:47:18.646770 2026] [:error] [pid 36938:tid 36958] [client 172.213.241.51:11181] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "adqlRoSWpa_VL1JPU6wVcgAAAZI"]
[Sun Apr 12 03:47:19.169639 2026] [:error] [pid 36909:tid 36929] [client 172.213.241.51:11103] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "adqlR0Gk5GhxTCzHUOpb0QAAARI"]
[Sun Apr 12 03:47:19.630108 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:11188] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nano.php"] [unique_id "adqlR0Gk5GhxTCzHUOpb1QAAAQ4"]
[Sun Apr 12 03:47:20.169272 2026] [:error] [pid 34152:tid 34175] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/nano.php
[Sun Apr 12 03:47:20.403794 2026] [:error] [pid 34152:tid 34161] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_S.php
[Sun Apr 12 03:47:20.643643 2026] [:error] [pid 34152:tid 34160] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Sun Apr 12 03:47:20.882435 2026] [:error] [pid 34152:tid 34154] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Sun Apr 12 03:47:22.513436 2026] [:error] [pid 34152:tid 34154] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Sun Apr 12 03:47:22.747902 2026] [:error] [pid 34152:tid 34164] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Sun Apr 12 03:47:22.981871 2026] [:error] [pid 34152:tid 34169] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Sun Apr 12 03:47:23.215486 2026] [:error] [pid 34152:tid 34177] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Sun Apr 12 03:47:23.450285 2026] [:error] [pid 34152:tid 34167] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Sun Apr 12 03:47:23.684692 2026] [:error] [pid 34152:tid 34157] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Apr 12 03:47:23.918914 2026] [:error] [pid 34152:tid 34158] [client 172.213.241.51:11178] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Sun Apr 12 03:47:24.155946 2026] [:error] [pid 34152:tid 34163] [client 172.213.241.51:11178] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "adqlTIFtE4RhFslT1DrsJAAAAAk"]
[Sun Apr 12 03:47:24.625785 2026] [:error] [pid 36909:tid 36911] [client 172.213.241.51:11241] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "adqlTEGk5GhxTCzHUOpb5wAAAQA"]
[Sun Apr 12 03:47:25.130307 2026] [:error] [pid 36938:tid 36961] [client 172.213.241.51:11052] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "adqlTYSWpa_VL1JPU6wVgwAAAZU"]
[Sun Apr 12 03:47:25.620948 2026] [:error] [pid 36938:tid 36941] [client 172.213.241.51:11164] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "adqlTYSWpa_VL1JPU6wVhAAAAYE"]
[Sun Apr 12 03:47:26.103148 2026] [:error] [pid 36938:tid 36953] [client 172.213.241.51:11166] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zample.php"] [unique_id "adqlToSWpa_VL1JPU6wViAAAAY0"]
[Sun Apr 12 03:47:26.657760 2026] [:error] [pid 44701:tid 44783] [client 172.213.241.51:11131] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zample.php"] [unique_id "adqlThGZAP4MrlxEPFdszgAAAEo"]
[Sun Apr 12 03:47:27.120536 2026] [:error] [pid 36909:tid 36935] [client 172.213.241.51:11074] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zample.php"] [unique_id "adqlT0Gk5GhxTCzHUOpb6QAAARg"]
[Sun Apr 12 03:47:27.625010 2026] [:error] [pid 36909:tid 36932] [client 172.213.241.51:11106] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zample.php"] [unique_id "adqlT0Gk5GhxTCzHUOpb7AAAARU"]
[Sun Apr 12 03:47:28.157433 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:11236] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "adqlUEGk5GhxTCzHUOpb7gAAAQ4"]
[Sun Apr 12 03:47:28.678009 2026] [:error] [pid 44698:tid 44717] [client 172.213.241.51:11137] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "adqlUBgoH9UWd-U3D56l2AAAAI4"]
[Sun Apr 12 03:47:29.186297 2026] [:error] [pid 34152:tid 34171] [client 172.213.241.51:11129] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "adqlUYFtE4RhFslT1DrsKAAAABE"]
[Sun Apr 12 03:47:29.711701 2026] [:error] [pid 44698:tid 44719] [client 172.213.241.51:11126] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "adqlURgoH9UWd-U3D56l2QAAAJA"]
[Sun Apr 12 03:47:30.294852 2026] [:error] [pid 34152:tid 34162] [client 172.213.241.51:11253] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "adqlUoFtE4RhFslT1DrsKgAAAAg"]
[Sun Apr 12 03:47:30.797236 2026] [:error] [pid 44701:tid 44783] [client 172.213.241.51:11123] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "adqlUhGZAP4MrlxEPFds3QAAAEo"]
[Sun Apr 12 03:47:31.345940 2026] [:error] [pid 44701:tid 44777] [client 172.213.241.51:11039] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "adqlUxGZAP4MrlxEPFds4AAAAEU"]
[Sun Apr 12 03:47:31.896860 2026] [:error] [pid 34152:tid 34154] [client 172.213.241.51:11121] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "adqlU4FtE4RhFslT1DrsLQAAAAA"]
[Sun Apr 12 03:47:32.440606 2026] [:error] [pid 36938:tid 36960] [client 172.213.241.51:11194] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "adqlVISWpa_VL1JPU6wVlgAAAZQ"]
[Sun Apr 12 03:47:32.956099 2026] [:error] [pid 44700:tid 44764] [client 172.213.241.51:11019] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "adqlVGryPgh_uW4QPCmT0QAAANQ"]
[Sun Apr 12 03:47:33.461616 2026] [:error] [pid 45064:tid 45107] [client 172.213.241.51:11209] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "adqlVZcHBvLyJ6EUhUoqwwAAAU4"]
[Sun Apr 12 03:47:33.936717 2026] [:error] [pid 34152:tid 34169] [client 172.213.241.51:11148] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "adqlVYFtE4RhFslT1DrsLgAAAA8"]
[Sun Apr 12 03:47:34.510820 2026] [:error] [pid 44700:tid 44750] [client 172.213.241.51:11198] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "adqlVmryPgh_uW4QPCmT1gAAAMY"]
[Sun Apr 12 03:47:35.057894 2026] [:error] [pid 34152:tid 34163] [client 172.213.241.51:11108] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "adqlV4FtE4RhFslT1DrsMgAAAAk"]
[Sun Apr 12 03:47:35.553723 2026] [:error] [pid 36938:tid 36942] [client 172.213.241.51:11210] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "adqlV4SWpa_VL1JPU6wVnAAAAYI"]
[Sun Apr 12 03:47:36.081160 2026] [:error] [pid 45064:tid 45094] [client 172.213.241.51:11192] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "adqlWJcHBvLyJ6EUhUoqxwAAAUI"]
[Sun Apr 12 03:47:36.577714 2026] [:error] [pid 34152:tid 34165] [client 172.213.241.51:11070] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "adqlWIFtE4RhFslT1DrsNQAAAAs"]
[Sun Apr 12 03:47:37.100261 2026] [:error] [pid 44700:tid 44765] [client 172.213.241.51:11010] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "adqlWWryPgh_uW4QPCmT4gAAANU"]
[Sun Apr 12 03:47:37.598987 2026] [:error] [pid 44700:tid 44762] [client 172.213.241.51:11100] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "adqlWWryPgh_uW4QPCmT5AAAANI"]
[Sun Apr 12 03:47:38.111223 2026] [:error] [pid 36938:tid 36964] [client 172.213.241.51:11077] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "adqlWoSWpa_VL1JPU6wVoQAAAZg"]
[Sun Apr 12 03:47:38.623478 2026] [:error] [pid 36938:tid 36953] [client 172.213.241.51:11018] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "adqlWoSWpa_VL1JPU6wVpgAAAY0"]
[Sun Apr 12 03:47:39.169826 2026] [:error] [pid 45064:tid 45109] [client 172.213.241.51:11113] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "adqlW5cHBvLyJ6EUhUoqyAAAAVA"]
[Sun Apr 12 03:47:39.732760 2026] [:error] [pid 36909:tid 36916] [client 172.213.241.51:11138] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "adqlW0Gk5GhxTCzHUOpb_AAAAQU"]
[Sun Apr 12 03:47:40.247330 2026] [:error] [pid 44701:tid 44799] [client 172.213.241.51:11101] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "adqlXBGZAP4MrlxEPFds6gAAAFc"]
[Sun Apr 12 03:47:40.794481 2026] [:error] [pid 36909:tid 36917] [client 172.213.241.51:11190] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sf.php"] [unique_id "adqlXEGk5GhxTCzHUOpcAgAAAQY"]
[Sun Apr 12 03:47:41.462755 2026] [:error] [pid 36909:tid 36928] [client 172.213.241.51:11195] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sf.php"] [unique_id "adqlXUGk5GhxTCzHUOpcAwAAARE"]
[Sun Apr 12 03:47:42.004890 2026] [:error] [pid 45064:tid 45111] [client 172.213.241.51:11091] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sf.php"] [unique_id "adqlXpcHBvLyJ6EUhUoqywAAAVI"]
[Sun Apr 12 03:47:42.604329 2026] [:error] [pid 44698:tid 44721] [client 172.213.241.51:11017] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sf.php"] [unique_id "adqlXhgoH9UWd-U3D56l5AAAAJI"]
[Sun Apr 12 03:47:43.167818 2026] [:error] [pid 45064:tid 45116] [client 172.213.241.51:11050] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "adqlX5cHBvLyJ6EUhUoq0AAAAVc"]
[Sun Apr 12 03:47:43.704407 2026] [:error] [pid 45064:tid 45101] [client 172.213.241.51:11220] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "adqlX5cHBvLyJ6EUhUoq0gAAAUg"]
[Sun Apr 12 03:47:44.189059 2026] [:error] [pid 45064:tid 45117] [client 172.213.241.51:11182] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "adqlYJcHBvLyJ6EUhUoq1wAAAVg"]
[Sun Apr 12 03:47:44.731771 2026] [:error] [pid 44698:tid 44723] [client 172.213.241.51:11012] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "adqlYBgoH9UWd-U3D56l6wAAAJQ"]
[Sun Apr 12 03:47:45.230120 2026] [:error] [pid 44698:tid 44727] [client 172.213.241.51:11099] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "adqlYRgoH9UWd-U3D56l8AAAAJg"]
[Sun Apr 12 03:47:45.753183 2026] [:error] [pid 36909:tid 36923] [client 172.213.241.51:11093] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "adqlYUGk5GhxTCzHUOpcCwAAAQw"]
[Sun Apr 12 03:47:46.284972 2026] [:error] [pid 44701:tid 44785] [client 172.213.241.51:11075] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "adqlYhGZAP4MrlxEPFds8QAAAEs"]
[Sun Apr 12 03:47:46.764501 2026] [:error] [pid 36909:tid 36913] [client 172.213.241.51:11133] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "adqlYkGk5GhxTCzHUOpcEAAAAQI"]
[Sun Apr 12 03:47:47.276481 2026] [:error] [pid 44701:tid 44774] [client 172.213.241.51:11120] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "adqlYxGZAP4MrlxEPFds9QAAAEI"]
[Sun Apr 12 03:47:47.734423 2026] [:error] [pid 44698:tid 44709] [client 172.213.241.51:11102] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "adqlYxgoH9UWd-U3D56l9gAAAIY"]
[Sun Apr 12 03:47:48.230363 2026] [:error] [pid 45064:tid 45116] [client 172.213.241.51:11014] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "adqlZJcHBvLyJ6EUhUoq3QAAAVc"]
[Sun Apr 12 03:47:48.715304 2026] [:error] [pid 34152:tid 34160] [client 172.213.241.51:11067] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "adqlZIFtE4RhFslT1DrsRAAAAAY"]
[Sun Apr 12 03:47:49.198862 2026] [:error] [pid 44698:tid 44713] [client 172.213.241.51:11213] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "adqlZRgoH9UWd-U3D56mJgAAAIo"]
[Sun Apr 12 03:47:49.681161 2026] [:error] [pid 44701:tid 44790] [client 172.213.241.51:11214] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "adqlZRGZAP4MrlxEPFdtFAAAAE8"]
[Sun Apr 12 03:47:50.211740 2026] [:error] [pid 44700:tid 44765] [client 172.213.241.51:11125] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "adqlZmryPgh_uW4QPCmUCwAAANU"]
[Sun Apr 12 03:47:50.696547 2026] [:error] [pid 36938:tid 36956] [client 172.213.241.51:11028] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "adqlZoSWpa_VL1JPU6wV4AAAAZA"]
[Sun Apr 12 03:47:51.232416 2026] [:error] [pid 44701:tid 44794] [client 172.213.241.51:11130] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "adqlZxGZAP4MrlxEPFdtLgAAAFM"]
[Sun Apr 12 03:47:51.691152 2026] [:error] [pid 44701:tid 44787] [client 172.213.241.51:11134] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "adqlZxGZAP4MrlxEPFdtOgAAAE0"]
[Sun Apr 12 03:47:52.292205 2026] [:error] [pid 45064:tid 45097] [client 172.213.241.51:11032] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "adqlaJcHBvLyJ6EUhUorCQAAAUU"]
[Sun Apr 12 03:47:52.839989 2026] [:error] [pid 36938:tid 36944] [client 172.213.241.51:11009] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "adqlaISWpa_VL1JPU6wWDQAAAYQ"]
[Sun Apr 12 03:47:53.496414 2026] [:error] [pid 36938:tid 36948] [client 172.213.241.51:11144] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "adqlaYSWpa_VL1JPU6wWFAAAAYg"]
[Sun Apr 12 03:47:54.029682 2026] [:error] [pid 44700:tid 44766] [client 172.213.241.51:11221] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "adqlamryPgh_uW4QPCmUFgAAANY"]
[Sun Apr 12 03:47:54.556094 2026] [:error] [pid 44698:tid 44712] [client 172.213.241.51:11068] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "adqlahgoH9UWd-U3D56maAAAAIk"]
[Sun Apr 12 03:47:55.092846 2026] [:error] [pid 36938:tid 36961] [client 172.213.241.51:11118] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "adqla4SWpa_VL1JPU6wWHQAAAZU"]
[Sun Apr 12 03:47:55.628193 2026] [:error] [pid 45064:tid 45103] [client 172.213.241.51:11087] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "adqla5cHBvLyJ6EUhUorDgAAAUo"]
[Sun Apr 12 03:47:56.175666 2026] [:error] [pid 45064:tid 45094] [client 172.213.241.51:11132] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "adqlbJcHBvLyJ6EUhUorDwAAAUI"]
[Sun Apr 12 03:47:56.731006 2026] [:error] [pid 36938:tid 36948] [client 172.213.241.51:11058] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "adqlbISWpa_VL1JPU6wWJAAAAYg"]
[Sun Apr 12 03:47:57.352369 2026] [:error] [pid 36938:tid 36949] [client 172.213.241.51:11196] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "adqlbYSWpa_VL1JPU6wWKQAAAYk"]
[Sun Apr 12 03:47:57.936812 2026] [:error] [pid 44698:tid 44714] [client 172.213.241.51:11066] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "adqlbRgoH9UWd-U3D56mbAAAAIs"]
[Sun Apr 12 03:47:58.461067 2026] [:error] [pid 44698:tid 44709] [client 172.213.241.51:11084] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "adqlbhgoH9UWd-U3D56mbgAAAIY"]
[Sun Apr 12 03:47:59.015361 2026] [:error] [pid 44700:tid 44749] [client 172.213.241.51:11086] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "adqlb2ryPgh_uW4QPCmUHAAAAMU"]
[Sun Apr 12 03:47:59.485498 2026] [:error] [pid 44701:tid 44786] [client 172.213.241.51:11116] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "adqlbxGZAP4MrlxEPFdtRAAAAEw"]
[Sun Apr 12 03:48:00.187010 2026] [:error] [pid 34152:tid 34160] [client 172.213.241.51:11098] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "adqlcIFtE4RhFslT1DrsdgAAAAY"]
[Sun Apr 12 03:48:00.686103 2026] [:error] [pid 36938:tid 36960] [client 172.213.241.51:11122] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "adqlcISWpa_VL1JPU6wWNAAAAZQ"]
[Sun Apr 12 03:48:01.208286 2026] [:error] [pid 34152:tid 34157] [client 172.213.241.51:11092] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "adqlcYFtE4RhFslT1DrsewAAAAM"]
[Sun Apr 12 03:48:01.757107 2026] [:error] [pid 36938:tid 36940] [client 172.213.241.51:11060] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "adqlcYSWpa_VL1JPU6wWNgAAAYA"]
[Sun Apr 12 03:48:02.271563 2026] [:error] [pid 36938:tid 36951] [client 172.213.241.51:10952] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "adqlcoSWpa_VL1JPU6wWOgAAAYs"]
[Sun Apr 12 03:48:02.753735 2026] [:error] [pid 34152:tid 34170] [client 172.213.241.51:11044] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "adqlcoFtE4RhFslT1DrsfgAAABA"]
[Sun Apr 12 03:48:03.253617 2026] [:error] [pid 44701:tid 44796] [client 172.213.241.51:11234] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "adqlcxGZAP4MrlxEPFdtSwAAAFU"]
[Sun Apr 12 03:48:03.723216 2026] [:error] [pid 44700:tid 44755] [client 172.213.241.51:11015] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "adqlc2ryPgh_uW4QPCmUIQAAAMs"]
[Sun Apr 12 03:48:04.189857 2026] [:error] [pid 34152:tid 34171] [client 172.213.241.51:11027] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "adqldIFtE4RhFslT1DrsgQAAABE"]
[Sun Apr 12 03:48:04.659721 2026] [:error] [pid 44700:tid 44766] [client 172.213.241.51:11011] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "adqldGryPgh_uW4QPCmUJwAAANY"]
[Sun Apr 12 03:48:05.131035 2026] [:error] [pid 44700:tid 44763] [client 172.213.241.51:11051] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "adqldWryPgh_uW4QPCmUKQAAANM"]
[Sun Apr 12 03:48:05.603910 2026] [:error] [pid 36938:tid 36948] [client 172.213.241.51:11204] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "adqldYSWpa_VL1JPU6wWPwAAAYg"]
[Sun Apr 12 03:48:06.181049 2026] [:error] [pid 44700:tid 44767] [client 172.213.241.51:11013] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "adqldmryPgh_uW4QPCmULgAAANc"]
[Sun Apr 12 03:48:06.669879 2026] [:error] [pid 44701:tid 44774] [client 172.213.241.51:10951] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "adqldhGZAP4MrlxEPFdtUQAAAEI"]
[Sun Apr 12 03:48:07.197963 2026] [:error] [pid 34152:tid 34162] [client 172.213.241.51:11261] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "adqld4FtE4RhFslT1DrsgwAAAAg"]
[Sun Apr 12 03:48:07.773018 2026] [:error] [pid 44700:tid 44755] [client 172.213.241.51:11045] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "adqld2ryPgh_uW4QPCmUMgAAAMs"]
[Sun Apr 12 03:48:08.299503 2026] [:error] [pid 36938:tid 36950] [client 172.213.241.51:11187] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "adqleISWpa_VL1JPU6wWSAAAAYo"]
[Sun Apr 12 03:48:08.938588 2026] [:error] [pid 44698:tid 44705] [client 172.213.241.51:11040] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "adqleBgoH9UWd-U3D56mewAAAII"]
[Sun Apr 12 03:48:09.422764 2026] [:error] [pid 36909:tid 36915] [client 172.213.241.51:11110] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "adqleUGk5GhxTCzHUOpcWgAAAQQ"]
[Sun Apr 12 03:48:09.955197 2026] [:error] [pid 36938:tid 36942] [client 172.213.241.51:11008] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "adqleYSWpa_VL1JPU6wWUwAAAYI"]
[Sun Apr 12 03:48:10.415051 2026] [:error] [pid 36938:tid 36961] [client 172.213.241.51:11053] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "adqleoSWpa_VL1JPU6wWWgAAAZU"]
[Sun Apr 12 03:48:11.014933 2026] [:error] [pid 44698:tid 44711] [client 172.213.241.51:10967] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "adqlexgoH9UWd-U3D56mggAAAIg"]
[Sun Apr 12 03:48:11.687482 2026] [:error] [pid 36938:tid 36959] [client 172.213.241.51:10949] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "adqle4SWpa_VL1JPU6wWYgAAAZM"]
[Sun Apr 12 03:48:12.163823 2026] [:error] [pid 44698:tid 44707] [client 172.213.241.51:11059] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "adqlfBgoH9UWd-U3D56mgwAAAIQ"]
[Sun Apr 12 03:48:12.792528 2026] [:error] [pid 36938:tid 36941] [client 172.213.241.51:10959] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "adqlfISWpa_VL1JPU6wWbAAAAYE"]
[Sun Apr 12 03:48:13.586857 2026] [:error] [pid 44698:tid 44717] [client 172.213.241.51:11162] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "adqlfRgoH9UWd-U3D56mhgAAAI4"]
[Sun Apr 12 03:48:14.059019 2026] [:error] [pid 36938:tid 36955] [client 172.213.241.51:11022] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "adqlfoSWpa_VL1JPU6wWcgAAAY8"]
[Sun Apr 12 03:48:14.581821 2026] [:error] [pid 36938:tid 36948] [client 172.213.241.51:10969] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "adqlfoSWpa_VL1JPU6wWcwAAAYg"]
[Sun Apr 12 03:48:15.079178 2026] [:error] [pid 36909:tid 36932] [client 172.213.241.51:11029] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adqlf0Gk5GhxTCzHUOpcXgAAARU"]
[Sun Apr 12 03:48:15.553640 2026] [:error] [pid 44698:tid 44719] [client 172.213.241.51:11237] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adqlfxgoH9UWd-U3D56mjgAAAJA"]
[Sun Apr 12 03:48:16.153284 2026] [:error] [pid 36938:tid 36948] [client 172.213.241.51:10957] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adqlgISWpa_VL1JPU6wWfgAAAYg"]
[Sun Apr 12 03:48:16.644515 2026] [:error] [pid 36909:tid 36920] [client 172.213.241.51:11036] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adqlgEGk5GhxTCzHUOpcYgAAAQk"]
[Sun Apr 12 03:48:17.153143 2026] [:error] [pid 36909:tid 36931] [client 172.213.241.51:11065] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bless4.php"] [unique_id "adqlgUGk5GhxTCzHUOpcZQAAARQ"]
[Sun Apr 12 03:48:17.641141 2026] [:error] [pid 36909:tid 36934] [client 172.213.241.51:11023] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bless4.php"] [unique_id "adqlgUGk5GhxTCzHUOpcagAAARc"]
[Sun Apr 12 03:48:18.166267 2026] [:error] [pid 36938:tid 36941] [client 172.213.241.51:10910] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bless4.php"] [unique_id "adqlgoSWpa_VL1JPU6wWhQAAAYE"]
[Sun Apr 12 03:48:18.743825 2026] [:error] [pid 36938:tid 36944] [client 172.213.241.51:11095] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bless4.php"] [unique_id "adqlgoSWpa_VL1JPU6wWhgAAAYQ"]
[Sun Apr 12 03:48:19.232695 2026] [:error] [pid 36909:tid 36933] [client 172.213.241.51:11048] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "adqlg0Gk5GhxTCzHUOpceQAAARY"]
[Sun Apr 12 03:48:19.789501 2026] [:error] [pid 36909:tid 36923] [client 172.213.241.51:11055] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "adqlg0Gk5GhxTCzHUOpcgAAAAQw"]
[Sun Apr 12 03:48:20.332724 2026] [:error] [pid 44698:tid 44715] [client 172.213.241.51:11090] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "adqlhBgoH9UWd-U3D56mkQAAAIw"]
[Sun Apr 12 03:48:20.840213 2026] [:error] [pid 44698:tid 44716] [client 172.213.241.51:11149] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "adqlhBgoH9UWd-U3D56mkgAAAI0"]
[Sun Apr 12 03:48:21.315454 2026] [:error] [pid 36909:tid 36920] [client 172.213.241.51:10994] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "adqlhUGk5GhxTCzHUOpchwAAAQk"]
[Sun Apr 12 03:48:21.818814 2026] [:error] [pid 44701:tid 44776] [client 172.213.241.51:11081] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "adqlhRGZAP4MrlxEPFdtVQAAAEQ"]
[Sun Apr 12 03:48:22.303788 2026] [:error] [pid 36938:tid 36944] [client 172.213.241.51:11016] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "adqlhoSWpa_VL1JPU6wWkQAAAYQ"]
[Sun Apr 12 03:48:22.873333 2026] [:error] [pid 36938:tid 36955] [client 172.213.241.51:11024] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "adqlhoSWpa_VL1JPU6wWlgAAAY8"]
[Sun Apr 12 03:48:23.362270 2026] [:error] [pid 44700:tid 44762] [client 172.213.241.51:11035] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Sun Apr 12 03:48:23.606083 2026] [:error] [pid 44700:tid 44751] [client 172.213.241.51:11035] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Sun Apr 12 03:48:23.846652 2026] [:error] [pid 44700:tid 44766] [client 172.213.241.51:11035] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Apr 12 03:48:24.322859 2026] [:error] [pid 44700:tid 44760] [client 172.213.241.51:11035] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Sun Apr 12 03:48:24.555814 2026] [:error] [pid 44700:tid 44756] [client 172.213.241.51:11035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Sun Apr 12 03:48:24.788514 2026] [:error] [pid 44700:tid 44744] [client 172.213.241.51:11035] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Sun Apr 12 03:48:25.020653 2026] [:error] [pid 44700:tid 44767] [client 172.213.241.51:11035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Apr 12 03:48:25.719503 2026] [:error] [pid 44700:tid 44747] [client 172.213.241.51:11035] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sun Apr 12 03:48:25.954591 2026] [:error] [pid 44700:tid 44749] [client 172.213.241.51:11035] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "adqliWryPgh_uW4QPCmUTwAAAMU"]
[Sun Apr 12 03:48:26.421552 2026] [:error] [pid 36938:tid 36954] [client 172.213.241.51:10992] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "adqlioSWpa_VL1JPU6wWsQAAAY4"]
[Sun Apr 12 03:48:26.892843 2026] [:error] [pid 45064:tid 45096] [client 172.213.241.51:11041] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "adqlipcHBvLyJ6EUhUorJAAAAUQ"]
[Sun Apr 12 03:48:27.387909 2026] [:error] [pid 44698:tid 44715] [client 172.213.241.51:10996] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "adqlixgoH9UWd-U3D56moAAAAIw"]
[Sun Apr 12 03:48:27.881349 2026] [:error] [pid 36938:tid 36955] [client 172.213.241.51:10964] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "adqli4SWpa_VL1JPU6wWvAAAAY8"]
[Sun Apr 12 03:48:28.431552 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:10980] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "adqljEGk5GhxTCzHUOpclwAAAQ4"]
[Sun Apr 12 03:48:28.974952 2026] [:error] [pid 34152:tid 34156] [client 172.213.241.51:11069] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "adqljIFtE4RhFslT1DrsowAAAAI"]
[Sun Apr 12 03:48:29.496082 2026] [:error] [pid 45064:tid 45103] [client 172.213.241.51:10960] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "adqljZcHBvLyJ6EUhUorLQAAAUo"]
[Sun Apr 12 03:48:29.993019 2026] [:error] [pid 36909:tid 36929] [client 172.213.241.51:11033] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "adqljUGk5GhxTCzHUOpcnAAAARI"]
[Sun Apr 12 03:48:30.476109 2026] [:error] [pid 36938:tid 36958] [client 172.213.241.51:10956] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "adqljoSWpa_VL1JPU6wWwQAAAZI"]
[Sun Apr 12 03:48:30.973283 2026] [:error] [pid 36938:tid 36940] [client 172.213.241.51:11020] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "adqljoSWpa_VL1JPU6wWyAAAAYA"]
[Sun Apr 12 03:48:31.455868 2026] [:error] [pid 36938:tid 36959] [client 172.213.241.51:11124] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "adqlj4SWpa_VL1JPU6wWzQAAAZM"]
[Sun Apr 12 03:48:31.967064 2026] [:error] [pid 44698:tid 44704] [client 172.213.241.51:11057] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "adqljxgoH9UWd-U3D56mrgAAAIE"]
[Sun Apr 12 03:48:32.455953 2026] [:error] [pid 44698:tid 44706] [client 172.213.241.51:11004] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "adqlkBgoH9UWd-U3D56msAAAAIM"]
[Sun Apr 12 03:48:32.930225 2026] [:error] [pid 36938:tid 36958] [client 172.213.241.51:10973] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "adqlkISWpa_VL1JPU6wW1AAAAZI"]
[Sun Apr 12 03:48:33.400072 2026] [:error] [pid 36938:tid 36960] [client 172.213.241.51:11026] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "adqlkYSWpa_VL1JPU6wW2AAAAZQ"]
[Sun Apr 12 03:48:33.916399 2026] [:error] [pid 36938:tid 36959] [client 172.213.241.51:11071] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adqlkYSWpa_VL1JPU6wW4QAAAZM"]
[Sun Apr 12 03:48:34.392597 2026] [:error] [pid 44701:tid 44781] [client 172.213.241.51:10995] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adqlkhGZAP4MrlxEPFdtWQAAAEg"]
[Sun Apr 12 03:48:34.924604 2026] [:error] [pid 44698:tid 44720] [client 172.213.241.51:10989] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adqlkhgoH9UWd-U3D56muAAAAJE"]
[Sun Apr 12 03:48:35.455848 2026] [:error] [pid 36938:tid 36944] [client 172.213.241.51:10945] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "adqlk4SWpa_VL1JPU6wW7gAAAYQ"]
[Sun Apr 12 03:48:35.993696 2026] [:error] [pid 44698:tid 44704] [client 172.213.241.51:11034] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "adqlkxgoH9UWd-U3D56mugAAAIE"]
[Sun Apr 12 03:48:36.545319 2026] [:error] [pid 44698:tid 44715] [client 172.213.241.51:11180] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "adqllBgoH9UWd-U3D56mvAAAAIw"]
[Sun Apr 12 03:48:37.040323 2026] [:error] [pid 36909:tid 36918] [client 172.213.241.51:10950] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "adqllUGk5GhxTCzHUOpcpwAAAQc"]
[Sun Apr 12 03:48:37.556586 2026] [:error] [pid 36938:tid 36942] [client 172.213.241.51:11064] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "adqllYSWpa_VL1JPU6wW_QAAAYI"]
[Sun Apr 12 03:48:38.073850 2026] [:error] [pid 36938:tid 36947] [client 172.213.241.51:11056] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "adqlloSWpa_VL1JPU6wXBgAAAYc"]
[Sun Apr 12 03:48:38.547712 2026] [:error] [pid 36938:tid 36955] [client 172.213.241.51:11047] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "adqlloSWpa_VL1JPU6wXDwAAAY8"]
[Sun Apr 12 03:48:39.101918 2026] [:error] [pid 36938:tid 36961] [client 172.213.241.51:11049] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "adqll4SWpa_VL1JPU6wXFwAAAZU"]
[Sun Apr 12 03:48:39.570283 2026] [:error] [pid 44700:tid 44747] [client 172.213.241.51:10955] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "adqll2ryPgh_uW4QPCmUXgAAAMM"]
[Sun Apr 12 03:48:40.127882 2026] [:error] [pid 44701:tid 44793] [client 172.213.241.51:11054] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "adqlmBGZAP4MrlxEPFdtXQAAAFI"]
[Sun Apr 12 03:48:40.593542 2026] [:error] [pid 44698:tid 44703] [client 172.213.241.51:10987] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "adqlmBgoH9UWd-U3D56mwQAAAIA"]
[Sun Apr 12 03:48:41.126243 2026] [:error] [pid 36938:tid 36959] [client 172.213.241.51:11115] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "adqlmYSWpa_VL1JPU6wXKAAAAZM"]
[Sun Apr 12 03:48:41.617867 2026] [:error] [pid 44698:tid 44714] [client 172.213.241.51:10888] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "adqlmRgoH9UWd-U3D56mxQAAAIs"]
[Sun Apr 12 03:48:42.178509 2026] [:error] [pid 34152:tid 34162] [client 172.213.241.51:10981] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "adqlmoFtE4RhFslT1DrsrwAAAAg"]
[Sun Apr 12 03:48:42.662146 2026] [:error] [pid 44701:tid 44773] [client 172.213.241.51:10954] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "adqlmhGZAP4MrlxEPFdtXwAAAEE"]
[Sun Apr 12 03:48:43.164840 2026] [:error] [pid 44701:tid 44786] [client 172.213.241.51:10913] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "adqlmxGZAP4MrlxEPFdtYQAAAEw"]
[Sun Apr 12 03:48:43.679198 2026] [:error] [pid 44701:tid 44781] [client 172.213.241.51:10917] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "adqlmxGZAP4MrlxEPFdtZQAAAEg"]
[Sun Apr 12 03:48:44.170186 2026] [:error] [pid 44700:tid 44757] [client 172.213.241.51:10948] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "adqlnGryPgh_uW4QPCmUYwAAAM0"]
[Sun Apr 12 03:48:44.655644 2026] [:error] [pid 34152:tid 34168] [client 172.213.241.51:10923] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "adqlnIFtE4RhFslT1DrsuAAAAA4"]
[Sun Apr 12 03:48:45.174641 2026] [:error] [pid 45064:tid 45099] [client 172.213.241.51:11043] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "adqlnZcHBvLyJ6EUhUorOAAAAUc"]
[Sun Apr 12 03:48:45.651089 2026] [:error] [pid 45064:tid 45105] [client 172.213.241.51:10897] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "adqlnZcHBvLyJ6EUhUorOgAAAUw"]
[Sun Apr 12 03:48:46.127991 2026] [:error] [pid 44698:tid 44720] [client 172.213.241.51:10944] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-michan.php"] [unique_id "adqlnhgoH9UWd-U3D56m0AAAAJE"]
[Sun Apr 12 03:48:46.594685 2026] [:error] [pid 44698:tid 44704] [client 172.213.241.51:10978] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-michan.php"] [unique_id "adqlnhgoH9UWd-U3D56m1AAAAIE"]
[Sun Apr 12 03:48:47.155569 2026] [:error] [pid 36909:tid 36935] [client 172.213.241.51:11002] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-michan.php"] [unique_id "adqln0Gk5GhxTCzHUOpcxwAAARg"]
[Sun Apr 12 03:48:47.621588 2026] [:error] [pid 44700:tid 44766] [client 172.213.241.51:11038] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-michan.php"] [unique_id "adqln2ryPgh_uW4QPCmUZAAAANY"]
[Sun Apr 12 03:48:48.135930 2026] [:error] [pid 44701:tid 44795] [client 172.213.241.51:10886] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "adqloBGZAP4MrlxEPFdtcAAAAFQ"]
[Sun Apr 12 03:48:48.737219 2026] [:error] [pid 44701:tid 44791] [client 172.213.241.51:11061] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "adqloBGZAP4MrlxEPFdtdgAAAFA"]
[Sun Apr 12 03:48:49.259658 2026] [:error] [pid 44698:tid 44717] [client 172.213.241.51:10834] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "adqloRgoH9UWd-U3D56m2wAAAI4"]
[Sun Apr 12 03:48:49.754603 2026] [:error] [pid 45064:tid 45102] [client 172.213.241.51:11225] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "adqloZcHBvLyJ6EUhUorQwAAAUk"]
[Sun Apr 12 03:48:50.249628 2026] [:error] [pid 45064:tid 45093] [client 172.213.241.51:10891] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adqlopcHBvLyJ6EUhUorRQAAAUE"]
[Sun Apr 12 03:48:50.821813 2026] [:error] [pid 36909:tid 36931] [client 172.213.241.51:11031] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adqlokGk5GhxTCzHUOpc3QAAARQ"]
[Sun Apr 12 03:48:51.326867 2026] [:error] [pid 44700:tid 44744] [client 172.213.241.51:10946] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adqlo2ryPgh_uW4QPCmUawAAAMA"]
[Sun Apr 12 03:48:51.843714 2026] [:error] [pid 36909:tid 36918] [client 172.213.241.51:10958] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "adqlo0Gk5GhxTCzHUOpc4wAAAQc"]
[Sun Apr 12 03:48:52.472414 2026] [:error] [pid 44698:tid 44718] [client 172.213.241.51:10977] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "adqlpBgoH9UWd-U3D56m3AAAAI8"]
[Sun Apr 12 03:48:53.000745 2026] [:error] [pid 34152:tid 34170] [client 172.213.241.51:10895] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "adqlpIFtE4RhFslT1DrsxAAAABA"]
[Sun Apr 12 03:48:53.492196 2026] [:error] [pid 45064:tid 45109] [client 172.213.241.51:10916] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "adqlpZcHBvLyJ6EUhUorRwAAAVA"]
[Sun Apr 12 03:48:54.137817 2026] [:error] [pid 44698:tid 44719] [client 172.213.241.51:10999] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "adqlphgoH9UWd-U3D56m4AAAAJA"]
[Sun Apr 12 03:48:54.678719 2026] [:error] [pid 34152:tid 34169] [client 172.213.241.51:11030] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adqlpoFtE4RhFslT1DrsygAAAA8"]
[Sun Apr 12 03:48:55.263285 2026] [:error] [pid 34152:tid 34164] [client 172.213.241.51:10881] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adqlp4FtE4RhFslT1DrszAAAAAo"]
[Sun Apr 12 03:48:55.767921 2026] [:error] [pid 44701:tid 44775] [client 172.213.241.51:10966] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adqlpxGZAP4MrlxEPFdtggAAAEM"]
[Sun Apr 12 03:48:56.427147 2026] [:error] [pid 44698:tid 44711] [client 172.213.241.51:10982] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "adqlqBgoH9UWd-U3D56m4gAAAIg"]
[Sun Apr 12 03:48:57.028562 2026] [:error] [pid 36909:tid 36921] [client 172.213.241.51:11025] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "adqlqUGk5GhxTCzHUOpdAwAAAQo"]
[Sun Apr 12 03:48:57.544660 2026] [:error] [pid 44701:tid 44794] [client 172.213.241.51:10890] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "adqlqRGZAP4MrlxEPFdthQAAAFM"]
[Sun Apr 12 03:48:58.178928 2026] [:error] [pid 44701:tid 44776] [client 172.213.241.51:10982] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "adqlqhGZAP4MrlxEPFdtiAAAAEQ"]
[Sun Apr 12 03:48:58.676728 2026] [:error] [pid 44698:tid 44722] [client 172.213.241.51:10905] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "adqlqhgoH9UWd-U3D56m5gAAAJM"]
[Sun Apr 12 03:48:59.216871 2026] [:error] [pid 34152:tid 34172] [client 172.213.241.51:11208] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adqlq4FtE4RhFslT1Drs0wAAABI"]
[Sun Apr 12 03:48:59.727292 2026] [:error] [pid 36909:tid 36933] [client 172.213.241.51:11021] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adqlq0Gk5GhxTCzHUOpdCQAAARY"]
[Sun Apr 12 03:49:00.329806 2026] [:error] [pid 44701:tid 44771] [client 172.213.241.51:10889] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adqlrBGZAP4MrlxEPFdtjgAAAEA"]
[Sun Apr 12 03:49:00.823886 2026] [:error] [pid 36938:tid 36962] [client 172.213.241.51:10968] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "adqlrISWpa_VL1JPU6wXMQAAAZY"]
[Sun Apr 12 03:49:01.326396 2026] [:error] [pid 36938:tid 36941] [client 172.213.241.51:11112] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adqlrYSWpa_VL1JPU6wXNgAAAYE"]
[Sun Apr 12 03:49:01.846064 2026] [:error] [pid 34152:tid 34166] [client 172.213.241.51:10885] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adqlrYFtE4RhFslT1Drs1gAAAAw"]
[Sun Apr 12 03:49:02.334734 2026] [:error] [pid 44698:tid 44718] [client 172.213.241.51:11105] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adqlrhgoH9UWd-U3D56m7AAAAI8"]
[Sun Apr 12 03:49:02.875591 2026] [:error] [pid 44701:tid 44779] [client 172.213.241.51:10934] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adqlrhGZAP4MrlxEPFdtlQAAAEc"]
[Sun Apr 12 03:49:03.366676 2026] [:error] [pid 44698:tid 44704] [client 172.213.241.51:11062] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "adqlrxgoH9UWd-U3D56m9QAAAIE"]
[Sun Apr 12 03:49:03.860570 2026] [:error] [pid 44698:tid 44725] [client 172.213.241.51:10934] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "adqlrxgoH9UWd-U3D56m-AAAAJY"]
[Sun Apr 12 03:49:04.325296 2026] [:error] [pid 44700:tid 44753] [client 172.213.241.51:10988] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "adqlsGryPgh_uW4QPCmUgwAAAMk"]
[Sun Apr 12 03:49:04.831676 2026] [:error] [pid 44700:tid 44745] [client 172.213.241.51:11063] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "adqlsGryPgh_uW4QPCmUhAAAAME"]
[Sun Apr 12 03:49:05.333470 2026] [:error] [pid 45064:tid 45102] [client 172.213.241.51:10970] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adqlsZcHBvLyJ6EUhUorUAAAAUk"]
[Sun Apr 12 03:49:05.839160 2026] [:error] [pid 45064:tid 45093] [client 172.213.241.51:10997] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adqlsZcHBvLyJ6EUhUorUQAAAUE"]
[Sun Apr 12 03:49:06.426096 2026] [:error] [pid 36909:tid 36935] [client 172.213.241.51:11000] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adqlskGk5GhxTCzHUOpdEAAAARg"]
[Sun Apr 12 03:49:06.923774 2026] [:error] [pid 34152:tid 34163] [client 172.213.241.51:11037] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adqlsoFtE4RhFslT1Drs2wAAAAk"]
[Sun Apr 12 03:49:07.487828 2026] [:error] [pid 44701:tid 44783] [client 172.213.241.51:11046] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "adqlsxGZAP4MrlxEPFdtqwAAAEo"]
[Sun Apr 12 03:49:07.972111 2026] [:error] [pid 34152:tid 34161] [client 172.213.241.51:11005] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "adqls4FtE4RhFslT1Drs3AAAAAc"]
[Sun Apr 12 03:49:08.456082 2026] [:error] [pid 45064:tid 45111] [client 172.213.241.51:11079] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "adqltJcHBvLyJ6EUhUorVwAAAVI"]
[Sun Apr 12 03:49:08.970692 2026] [:error] [pid 34152:tid 34157] [client 172.213.241.51:11097] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "adqltIFtE4RhFslT1Drs4gAAAAM"]
[Sun Apr 12 03:49:09.498278 2026] [:error] [pid 34152:tid 34172] [client 172.213.241.51:10976] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "adqltYFtE4RhFslT1Drs4wAAABI"]
[Sun Apr 12 03:49:09.976791 2026] [:error] [pid 44701:tid 44791] [client 172.213.241.51:10894] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "adqltRGZAP4MrlxEPFdtsgAAAFA"]
[Sun Apr 12 03:49:10.455231 2026] [:error] [pid 44698:tid 44710] [client 172.213.241.51:10991] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "adqlthgoH9UWd-U3D56nEAAAAIc"]
[Sun Apr 12 03:49:10.918039 2026] [:error] [pid 44698:tid 44707] [client 172.213.241.51:10816] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "adqlthgoH9UWd-U3D56nEgAAAIQ"]
[Sun Apr 12 03:49:11.416433 2026] [:error] [pid 36909:tid 36916] [client 172.213.241.51:10963] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "adqlt0Gk5GhxTCzHUOpdFgAAAQU"]
[Sun Apr 12 03:49:11.912011 2026] [:error] [pid 44700:tid 44751] [client 172.213.241.51:10990] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "adqlt2ryPgh_uW4QPCmUhgAAAMc"]
[Sun Apr 12 03:49:12.408914 2026] [:error] [pid 44698:tid 44712] [client 172.213.241.51:10972] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "adqluBgoH9UWd-U3D56nFgAAAIk"]
[Sun Apr 12 03:49:12.917755 2026] [:error] [pid 34152:tid 34164] [client 172.213.241.51:10817] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "adqluIFtE4RhFslT1Drs6QAAAAo"]
[Sun Apr 12 03:49:13.471769 2026] [:error] [pid 34152:tid 34159] [client 172.213.241.51:10961] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "adqluYFtE4RhFslT1Drs6gAAAAU"]
[Sun Apr 12 03:49:14.021805 2026] [:error] [pid 34152:tid 34178] [client 172.213.241.51:10953] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "adqluoFtE4RhFslT1Drs6wAAABg"]
[Sun Apr 12 03:49:14.495811 2026] [:error] [pid 44701:tid 44786] [client 172.213.241.51:10930] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "adqluhGZAP4MrlxEPFdtvQAAAEw"]
[Sun Apr 12 03:49:14.991934 2026] [:error] [pid 44700:tid 44758] [client 172.213.241.51:10975] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "adqlumryPgh_uW4QPCmUhwAAAM4"]
[Sun Apr 12 03:49:15.506811 2026] [:error] [pid 44701:tid 44796] [client 172.213.241.51:11212] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "adqluxGZAP4MrlxEPFdtwwAAAFU"]
[Sun Apr 12 03:49:16.085589 2026] [:error] [pid 36909:tid 36917] [client 172.213.241.51:10974] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "adqlvEGk5GhxTCzHUOpdHwAAAQY"]
[Sun Apr 12 03:49:16.609350 2026] [:error] [pid 44700:tid 44757] [client 172.213.241.51:10883] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "adqlvGryPgh_uW4QPCmUiAAAAM0"]
[Sun Apr 12 03:49:17.098782 2026] [:error] [pid 44700:tid 44766] [client 172.213.241.51:10921] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "adqlvWryPgh_uW4QPCmUiQAAANY"]
[Sun Apr 12 03:49:17.655279 2026] [:error] [pid 44698:tid 44714] [client 172.213.241.51:11006] [client 172.213.241.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adqlvRgoH9UWd-U3D56nMgAAAIs"]
[Sun Apr 12 03:49:18.204967 2026] [:error] [pid 44701:tid 44777] [client 172.213.241.51:10912] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "adqlvhGZAP4MrlxEPFdt0gAAAEU"]
[Sun Apr 12 03:49:18.689081 2026] [:error] [pid 36938:tid 36964] [client 172.213.241.51:10920] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "adqlvoSWpa_VL1JPU6wXUQAAAZg"]
[Sun Apr 12 03:49:19.231539 2026] [:error] [pid 36938:tid 36950] [client 172.213.241.51:10880] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "adqlv4SWpa_VL1JPU6wXVQAAAYo"]
[Sun Apr 12 03:49:19.714721 2026] [:error] [pid 36938:tid 36942] [client 172.213.241.51:11117] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "adqlv4SWpa_VL1JPU6wXWQAAAYI"]
[Sun Apr 12 03:49:20.272833 2026] [:error] [pid 44700:tid 44746] [client 172.213.241.51:10838] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adqlwGryPgh_uW4QPCmUjAAAAMI"]
[Sun Apr 12 03:49:20.788296 2026] [:error] [pid 44701:tid 44790] [client 172.213.241.51:10845] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adqlwBGZAP4MrlxEPFdt1wAAAE8"]
[Sun Apr 12 03:49:21.458050 2026] [:error] [pid 34152:tid 34165] [client 172.213.241.51:10908] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adqlwYFtE4RhFslT1Drs8gAAAAs"]
[Sun Apr 12 03:49:22.043193 2026] [:error] [pid 36938:tid 36964] [client 172.213.241.51:10965] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adqlwoSWpa_VL1JPU6wXXQAAAZg"]
[Sun Apr 12 03:49:22.619092 2026] [:error] [pid 45064:tid 45105] [client 172.213.241.51:10884] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adqlwpcHBvLyJ6EUhUorZAAAAUw"]
[Sun Apr 12 03:49:23.250201 2026] [:error] [pid 44700:tid 44767] [client 172.213.241.51:10896] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adqlw2ryPgh_uW4QPCmUkQAAANc"]
[Sun Apr 12 03:49:23.916510 2026] [:error] [pid 36938:tid 36955] [client 172.213.241.51:10962] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adqlw4SWpa_VL1JPU6wXZAAAAY8"]
[Sun Apr 12 03:49:24.571126 2026] [:error] [pid 44700:tid 44763] [client 172.213.241.51:10843] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adqlxGryPgh_uW4QPCmUkwAAANM"]
[Sun Apr 12 03:49:25.055679 2026] [:error] [pid 44698:tid 44718] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Sun Apr 12 03:49:25.294898 2026] [:error] [pid 44698:tid 44707] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sun Apr 12 03:49:25.529166 2026] [:error] [pid 44698:tid 44726] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Sun Apr 12 03:49:25.763545 2026] [:error] [pid 44698:tid 44712] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Sun Apr 12 03:49:26.000538 2026] [:error] [pid 44698:tid 44721] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Sun Apr 12 03:49:26.234799 2026] [:error] [pid 44698:tid 44723] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Sun Apr 12 03:49:26.482075 2026] [:error] [pid 44698:tid 44727] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sun Apr 12 03:49:26.722884 2026] [:error] [pid 44698:tid 44704] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Apr 12 03:49:26.956610 2026] [:error] [pid 44698:tid 44724] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Sun Apr 12 03:49:27.433129 2026] [:error] [pid 44698:tid 44722] [client 172.213.241.51:10985] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Sun Apr 12 03:49:27.663615 2026] [:error] [pid 44698:tid 44714] [client 172.213.241.51:10985] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "adqlxxgoH9UWd-U3D56nawAAAIs"]
[Sun Apr 12 03:49:28.289462 2026] [:error] [pid 36938:tid 36948] [client 172.213.241.51:10830] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "adqlyISWpa_VL1JPU6wXeQAAAYg"]
[Sun Apr 12 03:49:28.785555 2026] [:error] [pid 44698:tid 44718] [client 172.213.241.51:10947] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "adqlyBgoH9UWd-U3D56nbAAAAI8"]
[Sun Apr 12 03:49:29.287554 2026] [:error] [pid 36938:tid 36950] [client 172.213.241.51:11042] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "adqlyYSWpa_VL1JPU6wXgwAAAYo"]
[Sun Apr 12 03:49:29.852354 2026] [:error] [pid 36909:tid 36926] [client 172.213.241.51:10929] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "adqlyUGk5GhxTCzHUOpdOAAAAQ8"]
[Sun Apr 12 03:49:30.325639 2026] [:error] [pid 44698:tid 44719] [client 172.213.241.51:10999] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "adqlyhgoH9UWd-U3D56nbQAAAJA"]
[Sun Apr 12 03:49:30.885452 2026] [:error] [pid 36938:tid 36950] [client 172.213.241.51:10926] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "adqlyoSWpa_VL1JPU6wXigAAAYo"]
[Sun Apr 12 03:49:31.528550 2026] [:error] [pid 36909:tid 36923] [client 172.213.241.51:10931] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "adqly0Gk5GhxTCzHUOpdPAAAAQw"]
[Sun Apr 12 03:49:32.091310 2026] [:error] [pid 34152:tid 34161] [client 172.213.241.51:11007] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "adqlzIFtE4RhFslT1Drs_QAAAAc"]
[Sun Apr 12 03:49:32.586136 2026] [:error] [pid 44700:tid 44766] [client 172.213.241.51:10903] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "adqlzGryPgh_uW4QPCmUmQAAANY"]
[Sun Apr 12 03:49:33.148118 2026] [:error] [pid 44700:tid 44746] [client 172.213.241.51:11007] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "adqlzWryPgh_uW4QPCmUmwAAAMI"]
[Sun Apr 12 03:49:33.910771 2026] [:error] [pid 44698:tid 44709] [client 172.213.241.51:10826] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "adqlzRgoH9UWd-U3D56newAAAIY"]
[Sun Apr 12 03:49:34.479350 2026] [:error] [pid 36909:tid 36917] [client 172.213.241.51:10984] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "adqlzkGk5GhxTCzHUOpdPQAAAQY"]
[Sun Apr 12 03:49:35.026637 2026] [:error] [pid 44698:tid 44710] [client 172.213.241.51:10986] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "adqlzxgoH9UWd-U3D56ngAAAAIc"]
[Sun Apr 12 03:49:35.628446 2026] [:error] [pid 36909:tid 36927] [client 172.213.241.51:10933] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "adqlz0Gk5GhxTCzHUOpdQAAAARA"]
[Sun Apr 12 03:49:36.336298 2026] [:error] [pid 36909:tid 36916] [client 172.213.241.51:10993] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "adql0EGk5GhxTCzHUOpdQgAAAQU"]
[Sun Apr 12 03:49:36.949054 2026] [:error] [pid 44701:tid 44800] [client 172.213.241.51:10828] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "adql0BGZAP4MrlxEPFdt6gAAAFg"]
[Sun Apr 12 03:49:37.562103 2026] [:error] [pid 36938:tid 36945] [client 172.213.241.51:10831] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "adql0YSWpa_VL1JPU6wXkgAAAYU"]
[Sun Apr 12 03:49:38.149937 2026] [:error] [pid 45064:tid 45093] [client 172.213.241.51:10998] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "adql0pcHBvLyJ6EUhUorcAAAAUE"]
[Sun Apr 12 03:49:39.711407 2026] [:error] [pid 44700:tid 44747] [client 172.213.241.51:10936] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "adql02ryPgh_uW4QPCmUogAAAMM"]
[Sun Apr 12 03:49:40.632282 2026] [:error] [pid 45064:tid 45111] [client 172.213.241.51:10900] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "adql1JcHBvLyJ6EUhUordgAAAVI"]
[Sun Apr 12 03:49:41.251768 2026] [:error] [pid 36938:tid 36961] [client 172.213.241.51:11003] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "adql1YSWpa_VL1JPU6wXlQAAAZU"]
[Sun Apr 12 03:49:41.921318 2026] [:error] [pid 44698:tid 44716] [client 172.213.241.51:10911] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "adql1RgoH9UWd-U3D56niwAAAI0"]
[Sun Apr 12 03:49:42.499453 2026] [:error] [pid 34152:tid 34174] [client 172.213.241.51:10927] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "adql1oFtE4RhFslT1DrtEwAAABQ"]
[Sun Apr 12 03:49:43.051756 2026] [:error] [pid 34152:tid 34169] [client 172.213.241.51:10899] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "adql14FtE4RhFslT1DrtGAAAAA8"]
[Sun Apr 12 03:49:43.592956 2026] [:error] [pid 44698:tid 44725] [client 172.213.241.51:10860] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "adql1xgoH9UWd-U3D56nlAAAAJY"]
[Sun Apr 12 03:49:44.167276 2026] [:error] [pid 34152:tid 34160] [client 172.213.241.51:10925] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "adql2IFtE4RhFslT1DrtHgAAAAY"]
[Sun Apr 12 03:49:44.671697 2026] [:error] [pid 34152:tid 34173] [client 172.213.241.51:10909] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "adql2IFtE4RhFslT1DrtIQAAABM"]
[Sun Apr 12 03:49:45.221475 2026] [:error] [pid 34152:tid 34170] [client 172.213.241.51:10922] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "adql2YFtE4RhFslT1DrtJAAAABA"]
[Sun Apr 12 03:49:45.749413 2026] [:error] [pid 44698:tid 44722] [client 172.213.241.51:10836] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "adql2RgoH9UWd-U3D56nlgAAAJM"]
[Sun Apr 12 03:49:46.248583 2026] [:error] [pid 34152:tid 34160] [client 172.213.241.51:11135] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "adql2oFtE4RhFslT1DrtLAAAAAY"]
[Sun Apr 12 03:49:46.789507 2026] [:error] [pid 44698:tid 44706] [client 172.213.241.51:10983] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "adql2hgoH9UWd-U3D56nmgAAAIM"]
[Sun Apr 12 03:49:47.368001 2026] [:error] [pid 44698:tid 44710] [client 172.213.241.51:10904] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "adql2xgoH9UWd-U3D56nngAAAIc"]
[Sun Apr 12 03:49:47.875664 2026] [:error] [pid 44700:tid 44758] [client 172.213.241.51:10819] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "adql22ryPgh_uW4QPCmUqAAAAM4"]
[Sun Apr 12 03:49:48.385083 2026] [:error] [pid 36909:tid 36912] [client 172.213.241.51:10914] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "adql3EGk5GhxTCzHUOpdVAAAAQE"]
[Sun Apr 12 03:49:48.886322 2026] [:error] [pid 44698:tid 44724] [client 172.213.241.51:10824] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "adql3BgoH9UWd-U3D56n3wAAAJU"]
[Sun Apr 12 03:49:49.381089 2026] [:error] [pid 36938:tid 36947] [client 172.213.241.51:10759] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "adql3YSWpa_VL1JPU6wXoAAAAYc"]
[Sun Apr 12 03:49:49.928625 2026] [:error] [pid 36938:tid 36951] [client 172.213.241.51:10928] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "adql3YSWpa_VL1JPU6wXpgAAAYs"]
[Sun Apr 12 03:49:50.493468 2026] [:error] [pid 44701:tid 44789] [client 172.213.241.51:10918] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "adql3hGZAP4MrlxEPFdt9gAAAE4"]
[Sun Apr 12 03:49:50.974129 2026] [:error] [pid 44698:tid 44709] [client 172.213.241.51:10920] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "adql3hgoH9UWd-U3D56n6wAAAIY"]
[Sun Apr 12 03:49:51.592310 2026] [:error] [pid 44701:tid 44798] [client 172.213.241.51:10887] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class20.php"] [unique_id "adql3xGZAP4MrlxEPFdt9wAAAFY"]
[Sun Apr 12 03:49:52.170739 2026] [:error] [pid 45064:tid 45094] [client 172.213.241.51:10825] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class20.php"] [unique_id "adql4JcHBvLyJ6EUhUornwAAAUI"]
[Sun Apr 12 03:49:52.743082 2026] [:error] [pid 45064:tid 45116] [client 172.213.241.51:10864] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class20.php"] [unique_id "adql4JcHBvLyJ6EUhUoroQAAAVc"]
[Sun Apr 12 03:49:53.278003 2026] [:error] [pid 44698:tid 44714] [client 172.213.241.51:10906] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class20.php"] [unique_id "adql4RgoH9UWd-U3D56n7gAAAIs"]
[Sun Apr 12 03:49:53.854592 2026] [:error] [pid 34152:tid 34174] [client 172.213.241.51:10823] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file18.php"] [unique_id "adql4YFtE4RhFslT1DrtRgAAABQ"]
[Sun Apr 12 03:49:54.384204 2026] [:error] [pid 34152:tid 34166] [client 172.213.241.51:11001] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file18.php"] [unique_id "adql4oFtE4RhFslT1DrtSQAAAAw"]
[Sun Apr 12 03:49:54.844201 2026] [:error] [pid 34152:tid 34169] [client 172.213.241.51:10848] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file18.php"] [unique_id "adql4oFtE4RhFslT1DrtSwAAAA8"]
[Sun Apr 12 03:49:55.386607 2026] [:error] [pid 34152:tid 34154] [client 172.213.241.51:10872] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file18.php"] [unique_id "adql44FtE4RhFslT1DrtTQAAAAA"]
[Sun Apr 12 03:49:55.847041 2026] [:error] [pid 44698:tid 44713] [client 172.213.241.51:10775] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/vee.php"] [unique_id "adql4xgoH9UWd-U3D56n8AAAAIo"]
[Sun Apr 12 03:49:56.420621 2026] [:error] [pid 34152:tid 34162] [client 172.213.241.51:10919] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/vee.php"] [unique_id "adql5IFtE4RhFslT1DrtUwAAAAg"]
[Sun Apr 12 03:49:57.061177 2026] [:error] [pid 36909:tid 36922] [client 172.213.241.51:10773] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/vee.php"] [unique_id "adql5UGk5GhxTCzHUOpdYQAAAQs"]
[Sun Apr 12 03:49:57.614524 2026] [:error] [pid 36909:tid 36912] [client 172.213.241.51:10700] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/vee.php"] [unique_id "adql5UGk5GhxTCzHUOpdYwAAAQE"]
[Sun Apr 12 03:49:58.231889 2026] [:error] [pid 44701:tid 44771] [client 172.213.241.51:10932] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cabs.php"] [unique_id "adql5hGZAP4MrlxEPFdt_gAAAEA"]
[Sun Apr 12 03:49:58.740851 2026] [:error] [pid 45064:tid 45110] [client 172.213.241.51:10893] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cabs.php"] [unique_id "adql5pcHBvLyJ6EUhUorrAAAAVE"]
[Sun Apr 12 03:49:59.285272 2026] [:error] [pid 34152:tid 34156] [client 172.213.241.51:10971] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cabs.php"] [unique_id "adql54FtE4RhFslT1DrtVwAAAAI"]
[Sun Apr 12 03:49:59.813652 2026] [:error] [pid 36938:tid 36946] [client 172.213.241.51:10818] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cabs.php"] [unique_id "adql54SWpa_VL1JPU6wXugAAAYY"]
[Sun Apr 12 03:50:00.427137 2026] [:error] [pid 36909:tid 36934] [client 172.213.241.51:10770] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "adql6EGk5GhxTCzHUOpdbAAAARc"]
[Sun Apr 12 03:50:01.019867 2026] [:error] [pid 36909:tid 36920] [client 172.213.241.51:10847] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "adql6UGk5GhxTCzHUOpdbQAAAQk"]
[Sun Apr 12 03:50:01.536503 2026] [:error] [pid 36938:tid 36954] [client 172.213.241.51:10924] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "adql6YSWpa_VL1JPU6wXxQAAAY4"]
[Sun Apr 12 03:50:02.061199 2026] [:error] [pid 36938:tid 36944] [client 172.213.241.51:10877] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "adql6oSWpa_VL1JPU6wX0wAAAYQ"]
[Sun Apr 12 03:50:02.594892 2026] [:error] [pid 36909:tid 36925] [client 172.213.241.51:10901] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/x1da.php"] [unique_id "adql6kGk5GhxTCzHUOpdfwAAAQ4"]
[Sun Apr 12 03:50:03.079676 2026] [:error] [pid 36909:tid 36929] [client 172.213.241.51:10850] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/x1da.php"] [unique_id "adql60Gk5GhxTCzHUOpdhAAAARI"]
[Sun Apr 12 03:50:03.555779 2026] [:error] [pid 44698:tid 44708] [client 172.213.241.51:10841] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/x1da.php"] [unique_id "adql6xgoH9UWd-U3D56n9AAAAIU"]
[Sun Apr 12 03:50:04.019116 2026] [:error] [pid 44698:tid 44725] [client 172.213.241.51:10979] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/x1da.php"] [unique_id "adql7BgoH9UWd-U3D56n9QAAAJY"]
[Sun Apr 12 03:50:04.542803 2026] [:error] [pid 36938:tid 36947] [client 172.213.241.51:10729] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "adql7ISWpa_VL1JPU6wX_wAAAYc"]
[Sun Apr 12 03:50:05.061059 2026] [:error] [pid 36938:tid 36950] [client 172.213.241.51:10867] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "adql7YSWpa_VL1JPU6wYBAAAAYo"]
[Sun Apr 12 03:50:05.676943 2026] [:error] [pid 44698:tid 44707] [client 172.213.241.51:10940] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "adql7RgoH9UWd-U3D56n-gAAAIQ"]
[Sun Apr 12 03:50:06.151573 2026] [:error] [pid 36938:tid 36956] [client 172.213.241.51:10813] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jp.php"] [unique_id "adql7oSWpa_VL1JPU6wYCQAAAZA"]
[Sun Apr 12 03:50:06.751768 2026] [:error] [pid 44701:tid 44798] [client 172.213.241.51:10846] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "adql7hGZAP4MrlxEPFduLAAAAFY"]
[Sun Apr 12 03:50:07.397728 2026] [:error] [pid 44701:tid 44799] [client 172.213.241.51:10907] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "adql7xGZAP4MrlxEPFduMAAAAFc"]
[Sun Apr 12 03:50:07.910850 2026] [:error] [pid 44698:tid 44711] [client 172.213.241.51:10774] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "adql7xgoH9UWd-U3D56oAAAAAIg"]
[Sun Apr 12 03:50:08.606545 2026] [:error] [pid 36909:tid 36934] [client 172.213.241.51:11119] [client 172.213.241.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "adql8EGk5GhxTCzHUOpdjwAAARc"]
[Sun Apr 12 17:51:26.756991 2026] [:error] [pid 25328:tid 25391] [client 143.110.240.70:56899] [client 143.110.240.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/"] [unique_id "adtrHsxUaQZxT-e0YsD9igAAAFE"], referer: binance.com
[Sun Apr 12 18:06:26.045804 2026] [:error] [pid 25437:tid 25446] [client 143.110.240.70:51560] [client 143.110.240.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/images/"] [unique_id "adtuonf97wYZje1ep_MsPgAAAMc"], referer: binance.com
[Sun Apr 12 18:06:33.477900 2026] [:error] [pid 60280:tid 60304] [client 143.110.240.70:53230] [client 143.110.240.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/files/"] [unique_id "adtuqXBlLnDOYuIykkhYwQAAAdY"], referer: binance.com
[Tue Apr 14 04:57:16.695075 2026] [:error] [pid 64393:tid 64409] [client 216.73.216.167:47321] [client 216.73.216.167] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||windfc.windfarmcoolants.com.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/robots.txt"] [unique_id "ad1YrOClKltJhW50hKO6BQAAAQ4"]
[Tue Apr 14 05:17:09.178891 2026] [:error] [pid 19687:tid 19698] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Apr 14 05:17:09.404306 2026] [:error] [pid 19687:tid 19703] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Tue Apr 14 05:17:09.613965 2026] [:error] [pid 19687:tid 19712] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/ll.php
[Tue Apr 14 05:17:10.813189 2026] [:error] [pid 19687:tid 19699] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/hh.php
[Tue Apr 14 05:17:11.047772 2026] [:error] [pid 19687:tid 19710] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/rt.php
[Tue Apr 14 05:17:11.258369 2026] [:error] [pid 19687:tid 19706] [client 20.220.62.139:63378] [client 20.220.62.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.62.139, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "ad1dV2BZImnR12CCWFo0vwAAAAo"]
[Tue Apr 14 05:17:11.265177 2026] [:error] [pid 19687:tid 19706] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 14 05:17:11.475068 2026] [:error] [pid 19687:tid 19715] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/ex.php
[Tue Apr 14 05:17:11.710848 2026] [:error] [pid 19687:tid 19713] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Apr 14 05:17:12.162394 2026] [:error] [pid 19687:tid 19707] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 14 05:17:12.374273 2026] [:error] [pid 19687:tid 19704] [client 20.220.62.139:63378] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 14 05:17:12.580890 2026] [:error] [pid 19687:tid 19711] [client 20.220.62.139:63378] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pages.php"] [unique_id "ad1dWGBZImnR12CCWFo0yAAAAA8"]
[Tue Apr 14 05:17:16.100763 2026] [:error] [pid 19689:tid 19771] [client 20.220.62.139:63373] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pages.php"] [unique_id "ad1dXJWU15arjG3aJyRW-AAAAJA"]
[Tue Apr 14 05:17:18.033119 2026] [:error] [pid 19793:tid 19801] [client 20.220.62.139:63380] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pages.php"] [unique_id "ad1dXgGEQsZw9TkmIA4YOgAAAMY"]
[Tue Apr 14 05:17:18.637316 2026] [:error] [pid 19793:tid 19817] [client 20.220.62.139:63477] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pages.php"] [unique_id "ad1dXgGEQsZw9TkmIA4YPAAAANY"]
[Tue Apr 14 05:17:20.721161 2026] [:error] [pid 19688:tid 19745] [client 20.220.62.139:63365] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mah.php"] [unique_id "ad1dYIHoi57o76xPstK7swAAAFE"]
[Tue Apr 14 05:17:22.359963 2026] [:error] [pid 19687:tid 19698] [client 20.220.62.139:63455] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mah.php"] [unique_id "ad1dYmBZImnR12CCWFo0zQAAAAI"]
[Tue Apr 14 05:17:23.740551 2026] [:error] [pid 64393:tid 64403] [client 20.220.62.139:63371] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mah.php"] [unique_id "ad1dY-ClKltJhW50hKPFfQAAAQg"]
[Tue Apr 14 05:17:27.765902 2026] [:error] [pid 19793:tid 19800] [client 20.220.62.139:63442] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mah.php"] [unique_id "ad1dZwGEQsZw9TkmIA4YRQAAAMU"]
[Tue Apr 14 05:17:30.035789 2026] [:error] [pid 19793:tid 19812] [client 20.220.62.139:63486] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "ad1dagGEQsZw9TkmIA4YSgAAANE"]
[Tue Apr 14 05:17:31.651045 2026] [:error] [pid 64393:tid 64399] [client 20.220.62.139:63474] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "ad1da-ClKltJhW50hKPFkAAAAQQ"]
[Tue Apr 14 05:17:34.211196 2026] [:error] [pid 19793:tid 19797] [client 20.220.62.139:63367] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "ad1dbgGEQsZw9TkmIA4YTQAAAMI"]
[Tue Apr 14 05:17:37.374581 2026] [:error] [pid 19793:tid 19799] [client 20.220.62.139:63366] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "ad1dcQGEQsZw9TkmIA4YTwAAAMQ"]
[Tue Apr 14 05:17:39.805036 2026] [:error] [pid 64393:tid 64396] [client 20.220.62.139:63383] [client 20.220.62.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/functions.php"] [unique_id "ad1dc-ClKltJhW50hKPFnAAAAQE"]
[Tue Apr 14 05:17:41.413489 2026] [:error] [pid 19687:tid 19713] [client 20.220.62.139:63481] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ad1ddWBZImnR12CCWFo03gAAABE"]
[Tue Apr 14 05:17:45.029713 2026] [:error] [pid 19793:tid 19801] [client 20.220.62.139:63382] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ad1deQGEQsZw9TkmIA4YWQAAAMY"]
[Tue Apr 14 05:17:48.084220 2026] [:error] [pid 64393:tid 64419] [client 20.220.62.139:63389] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ad1dfOClKltJhW50hKPFzgAAARg"]
[Tue Apr 14 05:17:50.005488 2026] [:error] [pid 19687:tid 19699] [client 20.220.62.139:9952] [client 20.220.62.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-config.php"] [unique_id "ad1dfmBZImnR12CCWFo04gAAAAM"]
[Tue Apr 14 05:17:51.971064 2026] [:error] [pid 19688:tid 19732] [client 20.220.62.139:63458] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-settings.php"] [unique_id "ad1df4Hoi57o76xPstK8XwAAAEQ"]
[Tue Apr 14 05:17:53.097155 2026] [:error] [pid 19793:tid 19797] [client 20.220.62.139:63470] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-settings.php"] [unique_id "ad1dgQGEQsZw9TkmIA4YjAAAAMI"]
[Tue Apr 14 05:17:54.376209 2026] [:error] [pid 64393:tid 64401] [client 20.220.62.139:63466] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-settings.php"] [unique_id "ad1dguClKltJhW50hKPF-AAAAQY"]
[Tue Apr 14 05:17:55.696515 2026] [:error] [pid 64393:tid 64412] [client 20.220.62.139:63377] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-settings.php"] [unique_id "ad1dg-ClKltJhW50hKPF_QAAARE"]
[Tue Apr 14 05:17:56.991292 2026] [:error] [pid 64393:tid 64414] [client 20.220.62.139:63438] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error.php"] [unique_id "ad1dhOClKltJhW50hKPGAAAAARM"]
[Tue Apr 14 05:17:58.440344 2026] [:error] [pid 19687:tid 19698] [client 20.220.62.139:63437] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error.php"] [unique_id "ad1dhmBZImnR12CCWFo06gAAAAI"]
[Tue Apr 14 05:18:00.187184 2026] [:error] [pid 64393:tid 64407] [client 20.220.62.139:63386] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error.php"] [unique_id "ad1diOClKltJhW50hKPGBAAAAQw"]
[Tue Apr 14 05:18:03.407372 2026] [:error] [pid 64393:tid 64419] [client 20.220.62.139:63441] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error.php"] [unique_id "ad1di-ClKltJhW50hKPGCwAAARg"]
[Tue Apr 14 05:18:05.628385 2026] [:error] [pid 64393:tid 64400] [client 20.220.62.139:63456] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/post.php"] [unique_id "ad1djeClKltJhW50hKPGDgAAAQU"]
[Tue Apr 14 05:18:09.232604 2026] [:error] [pid 19688:tid 19730] [client 20.220.62.139:63476] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/post.php"] [unique_id "ad1dkYHoi57o76xPstK8aQAAAEI"]
[Tue Apr 14 05:18:12.938495 2026] [:error] [pid 19689:tid 19762] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue Apr 14 05:18:13.181856 2026] [:error] [pid 19689:tid 19778] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Tue Apr 14 05:18:13.408990 2026] [:error] [pid 19689:tid 19767] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Tue Apr 14 05:18:13.625139 2026] [:error] [pid 19689:tid 19772] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Tue Apr 14 05:18:13.960453 2026] [:error] [pid 19689:tid 19761] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Tue Apr 14 05:18:14.385269 2026] [:error] [pid 19689:tid 19779] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 14 05:18:14.594367 2026] [:error] [pid 19689:tid 19758] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Tue Apr 14 05:18:14.810360 2026] [:error] [pid 19689:tid 19776] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/\xe2\x80\x89goods.php
[Tue Apr 14 05:18:15.019251 2026] [:error] [pid 19689:tid 19770] [client 20.220.62.139:63375] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 14 05:18:15.225954 2026] [:error] [pid 19689:tid 19777] [client 20.220.62.139:63375] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index/chosen.php"] [unique_id "ad1dl5WU15arjG3aJyRXOwAAAJY"]
[Tue Apr 14 05:18:18.253360 2026] [:error] [pid 19689:tid 19762] [client 20.220.62.139:63369] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index/chosen.php"] [unique_id "ad1dmpWU15arjG3aJyRXRAAAAIc"]
[Tue Apr 14 05:18:23.261983 2026] [:error] [pid 19793:tid 19816] [client 20.220.62.139:63461] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index/chosen.php"] [unique_id "ad1dnwGEQsZw9TkmIA4YuwAAANU"]
[Tue Apr 14 05:18:25.400960 2026] [:error] [pid 64393:tid 64403] [client 20.220.62.139:63440] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index/chosen.php"] [unique_id "ad1doeClKltJhW50hKPGWwAAAQg"]
[Tue Apr 14 05:18:28.478746 2026] [:error] [pid 64393:tid 64409] [client 20.220.62.139:63396] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about/chosen.php"] [unique_id "ad1dpOClKltJhW50hKPGaQAAAQ4"]
[Tue Apr 14 05:18:33.530119 2026] [:error] [pid 64393:tid 64399] [client 20.220.62.139:63381] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about/chosen.php"] [unique_id "ad1dqeClKltJhW50hKPGdAAAAQQ"]
[Tue Apr 14 05:18:36.060135 2026] [:error] [pid 19688:tid 19735] [client 20.220.62.139:63465] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about/chosen.php"] [unique_id "ad1drIHoi57o76xPstK8fgAAAEc"]
[Tue Apr 14 05:18:46.938187 2026] [:error] [pid 64393:tid 64409] [client 20.220.62.139:63436] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as/chosen.php"] [unique_id "ad1dtuClKltJhW50hKPGhAAAAQ4"]
[Tue Apr 14 05:18:49.883416 2026] [:error] [pid 19689:tid 19767] [client 20.220.62.139:63376] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as/chosen.php"] [unique_id "ad1duZWU15arjG3aJyRXUwAAAIw"]
[Tue Apr 14 05:18:53.024737 2026] [:error] [pid 64393:tid 64402] [client 20.220.62.139:63370] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as/chosen.php"] [unique_id "ad1dveClKltJhW50hKPGjAAAAQc"]
[Tue Apr 14 05:18:56.875437 2026] [:error] [pid 64393:tid 64404] [client 20.220.62.139:63404] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as/chosen.php"] [unique_id "ad1dwOClKltJhW50hKPGlQAAAQk"]
[Tue Apr 14 05:18:57.707560 2026] [:error] [pid 64393:tid 64396] [client 20.220.62.139:63379] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file/chosen.php"] [unique_id "ad1dweClKltJhW50hKPGmAAAAQE"]
[Tue Apr 14 05:18:58.526247 2026] [:error] [pid 19793:tid 19813] [client 20.220.62.139:63428] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file/chosen.php"] [unique_id "ad1dwgGEQsZw9TkmIA4Y5gAAANI"]
[Tue Apr 14 05:18:59.902276 2026] [:error] [pid 64393:tid 64412] [client 20.220.62.139:63423] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file/chosen.php"] [unique_id "ad1dw-ClKltJhW50hKPGnQAAARE"]
[Tue Apr 14 05:19:01.609443 2026] [:error] [pid 64393:tid 64402] [client 20.220.62.139:63395] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file/chosen.php"] [unique_id "ad1dxeClKltJhW50hKPGpAAAAQc"]
[Tue Apr 14 05:19:04.811168 2026] [:error] [pid 19689:tid 19765] [client 20.220.62.139:63368] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chosen/chosen.php"] [unique_id "ad1dyJWU15arjG3aJyRXXgAAAIo"]
[Tue Apr 14 05:19:08.338426 2026] [:error] [pid 19688:tid 19751] [client 20.220.62.139:63400] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chosen/chosen.php"] [unique_id "ad1dzIHoi57o76xPstK8kQAAAFc"]
[Tue Apr 14 05:19:09.868495 2026] [:error] [pid 19688:tid 19736] [client 20.220.62.139:63443] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chosen/chosen.php"] [unique_id "ad1dzYHoi57o76xPstK8lgAAAEg"]
[Tue Apr 14 05:19:14.143718 2026] [:error] [pid 19688:tid 19751] [client 20.220.62.139:9947] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chosen/chosen.php"] [unique_id "ad1d0oHoi57o76xPstK8nQAAAFc"]
[Tue Apr 14 05:19:21.787829 2026] [:error] [pid 19793:tid 19810] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Apr 14 05:19:22.020706 2026] [:error] [pid 19793:tid 19808] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 14 05:19:22.257357 2026] [:error] [pid 19793:tid 19802] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Tue Apr 14 05:19:22.469900 2026] [:error] [pid 19793:tid 19815] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Apr 14 05:19:22.685962 2026] [:error] [pid 19793:tid 19809] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Apr 14 05:19:22.902067 2026] [:error] [pid 19793:tid 19818] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Apr 14 05:19:23.325625 2026] [:error] [pid 19793:tid 19811] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Apr 14 05:19:23.536312 2026] [:error] [pid 19793:tid 19798] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/bootstrap.php
[Tue Apr 14 05:19:23.750120 2026] [:error] [pid 19793:tid 19800] [client 20.220.62.139:63467] File does not exist: /usr/local/apache/htdocs/suspended-page/config-backup.php
[Tue Apr 14 05:19:23.957543 2026] [:error] [pid 19793:tid 19797] [client 20.220.62.139:63467] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "ad1d2wGEQsZw9TkmIA4ZEAAAAMI"]
[Tue Apr 14 05:19:27.235277 2026] [:error] [pid 19687:tid 19717] [client 20.220.62.139:63397] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "ad1d32BZImnR12CCWFo1FgAAABU"]
[Tue Apr 14 05:19:31.916334 2026] [:error] [pid 64393:tid 64409] [client 20.220.62.139:63475] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "ad1d4-ClKltJhW50hKPG2AAAAQ4"]
[Tue Apr 14 05:19:34.050003 2026] [:error] [pid 19689:tid 19755] [client 20.220.62.139:63408] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "ad1d5pWU15arjG3aJyRXbAAAAIA"]
[Tue Apr 14 05:19:45.475848 2026] [:error] [pid 19687:tid 19719] [client 20.220.62.139:63361] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "ad1d8WBZImnR12CCWFo1JQAAABc"]
[Tue Apr 14 05:20:09.578729 2026] [:error] [pid 19688:tid 19752] [client 20.220.62.139:63384] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/index/function.php"] [unique_id "ad1eCYHoi57o76xPstK8yQAAAFg"]
[Tue Apr 14 05:20:59.514178 2026] [:error] [pid 19793:tid 19801] [client 20.220.62.139:63430] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Apr 14 05:21:00.331475 2026] [:error] [pid 19793:tid 19819] [client 20.220.62.139:63430] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Tue Apr 14 05:21:00.554315 2026] [:error] [pid 19793:tid 19798] [client 20.220.62.139:63430] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conffg.php
[Tue Apr 14 05:21:00.800062 2026] [:error] [pid 19793:tid 19817] [client 20.220.62.139:63430] File does not exist: /usr/local/apache/htdocs/suspended-page/bb.php
[Tue Apr 14 05:21:01.008812 2026] [:error] [pid 19793:tid 19806] [client 20.220.62.139:63430] File does not exist: /usr/local/apache/htdocs/suspended-page/lf.php
[Tue Apr 14 05:21:01.757602 2026] [:error] [pid 19793:tid 19814] [client 20.220.62.139:63430] File does not exist: /usr/local/apache/htdocs/suspended-page/WSO.php
[Tue Apr 14 05:21:04.449498 2026] [:error] [pid 19793:tid 19800] [client 20.220.62.139:63430] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Tue Apr 14 05:21:04.718260 2026] [:error] [pid 19793:tid 19813] [client 20.220.62.139:63430] File does not exist: /usr/local/apache/htdocs/suspended-page/hello.php
[Tue Apr 14 05:21:04.970425 2026] [:error] [pid 19793:tid 19804] [client 20.220.62.139:63430] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ok.php"] [unique_id "ad1eQAGEQsZw9TkmIA4ZYwAAAMk"]
[Tue Apr 14 05:21:07.806313 2026] [:error] [pid 19689:tid 19760] [client 20.220.62.139:63457] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ok.php"] [unique_id "ad1eQ5WU15arjG3aJyRXuAAAAIU"]
[Tue Apr 14 05:21:10.825206 2026] [:error] [pid 19793:tid 19812] [client 20.220.62.139:9929] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ok.php"] [unique_id "ad1eRgGEQsZw9TkmIA4ZZgAAANE"]
[Tue Apr 14 05:21:13.132676 2026] [:error] [pid 19689:tid 19762] [client 20.220.62.139:63406] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ok.php"] [unique_id "ad1eSZWU15arjG3aJyRXwAAAAIc"]
[Tue Apr 14 05:21:15.927358 2026] [:error] [pid 64393:tid 64399] [client 20.220.62.139:63469] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/if.php"] [unique_id "ad1eS-ClKltJhW50hKPHlgAAAQQ"]
[Tue Apr 14 05:21:17.957789 2026] [:error] [pid 19688:tid 19743] [client 20.220.62.139:63473] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/if.php"] [unique_id "ad1eTYHoi57o76xPstK8_QAAAE8"]
[Tue Apr 14 05:21:21.036221 2026] [:error] [pid 64393:tid 64411] [client 20.220.62.139:63385] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/if.php"] [unique_id "ad1eUeClKltJhW50hKPHqwAAARA"]
[Tue Apr 14 05:21:28.034543 2026] [:error] [pid 64393:tid 64398] [client 20.220.62.139:63391] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/if.php"] [unique_id "ad1eWOClKltJhW50hKPHuAAAAQM"]
[Tue Apr 14 05:21:36.050297 2026] [:error] [pid 19689:tid 19765] [client 20.220.62.139:9968] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mrjn.php"] [unique_id "ad1eYJWU15arjG3aJyRX2AAAAIo"]
[Tue Apr 14 05:21:42.202998 2026] [:error] [pid 19689:tid 19770] [client 20.220.62.139:63429] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mrjn.php"] [unique_id "ad1eZpWU15arjG3aJyRX5AAAAI8"]
[Tue Apr 14 05:21:44.164255 2026] [:error] [pid 64393:tid 64403] [client 20.220.62.139:63471] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kn.php"] [unique_id "ad1eaOClKltJhW50hKPHyQAAAQg"]
[Tue Apr 14 05:21:47.316678 2026] [:error] [pid 64393:tid 64400] [client 20.220.62.139:63472] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kn.php"] [unique_id "ad1ea-ClKltJhW50hKPH0QAAAQU"]
[Tue Apr 14 05:21:52.902510 2026] [:error] [pid 19687:tid 19696] [client 20.220.62.139:9936] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kn.php"] [unique_id "ad1ecGBZImnR12CCWFo1WQAAAAA"]
[Tue Apr 14 05:21:57.018812 2026] [:error] [pid 19688:tid 19732] [client 20.220.62.139:63372] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kn.php"] [unique_id "ad1edYHoi57o76xPstK9DwAAAEQ"]
[Tue Apr 14 05:22:07.271997 2026] [:error] [pid 19793:tid 19810] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/3301.php
[Tue Apr 14 05:22:07.502748 2026] [:error] [pid 19793:tid 19803] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Tue Apr 14 05:22:07.713425 2026] [:error] [pid 19793:tid 19798] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/alex.php
[Tue Apr 14 05:22:07.952997 2026] [:error] [pid 19793:tid 19811] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/mailer.php
[Tue Apr 14 05:22:08.997623 2026] [:error] [pid 19793:tid 19801] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/anone.php
[Tue Apr 14 05:22:09.206690 2026] [:error] [pid 19793:tid 19800] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configer.php
[Tue Apr 14 05:22:09.424915 2026] [:error] [pid 19793:tid 19809] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ad.php
[Tue Apr 14 05:22:09.661016 2026] [:error] [pid 19793:tid 19805] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/send.php
[Tue Apr 14 05:22:09.884714 2026] [:error] [pid 19793:tid 19808] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Tue Apr 14 05:22:10.122495 2026] [:error] [pid 19793:tid 19796] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/.wp-cache.php
[Tue Apr 14 05:22:10.331166 2026] [:error] [pid 19793:tid 19816] [client 20.220.62.139:63451] File does not exist: /usr/local/apache/htdocs/suspended-page/sendmail.php
[Tue Apr 14 05:22:10.551642 2026] [:error] [pid 19793:tid 19803] [client 20.220.62.139:63451] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rahma.php"] [unique_id "ad1eggGEQsZw9TkmIA4ZyAAAAMg"]
[Tue Apr 14 05:22:20.483440 2026] [:error] [pid 64393:tid 64400] [client 20.220.62.139:9964] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rahma.php"] [unique_id "ad1ejOClKltJhW50hKPILQAAAQU"]
[Tue Apr 14 05:22:25.638669 2026] [:error] [pid 19687:tid 19704] [client 20.220.62.139:63387] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rahma.php"] [unique_id "ad1ekWBZImnR12CCWFo1cgAAAAg"]
[Tue Apr 14 05:22:27.560294 2026] [:error] [pid 19689:tid 19773] [client 20.220.62.139:9931] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nasgor.php"] [unique_id "ad1ek5WU15arjG3aJyRYFgAAAJI"]
[Tue Apr 14 05:22:29.018880 2026] [:error] [pid 19689:tid 19769] [client 20.220.62.139:63422] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nasgor.php"] [unique_id "ad1elZWU15arjG3aJyRYGgAAAI4"]
[Tue Apr 14 05:22:31.024774 2026] [:error] [pid 19687:tid 19710] [client 20.220.62.139:63365] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nasgor.php"] [unique_id "ad1el2BZImnR12CCWFo1dQAAAA4"]
[Tue Apr 14 05:22:33.238029 2026] [:error] [pid 19793:tid 19804] [client 20.220.62.139:9937] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nasgor.php"] [unique_id "ad1emQGEQsZw9TkmIA4Z5QAAAMk"]
[Tue Apr 14 05:22:34.986825 2026] [:error] [pid 19688:tid 19744] [client 20.220.62.139:63388] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-confirm.php"] [unique_id "ad1emoHoi57o76xPstK9JgAAAFA"]
[Tue Apr 14 05:22:36.852781 2026] [:error] [pid 19793:tid 19799] [client 20.220.62.139:63483] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-confirm.php"] [unique_id "ad1enAGEQsZw9TkmIA4Z6AAAAMQ"]
[Tue Apr 14 05:22:39.876583 2026] [:error] [pid 19793:tid 19808] [client 20.220.62.139:63363] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-confirm.php"] [unique_id "ad1enwGEQsZw9TkmIA4Z8QAAAM0"]
[Tue Apr 14 05:22:43.733963 2026] [:error] [pid 64393:tid 64395] [client 20.220.62.139:9973] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-confirm.php"] [unique_id "ad1eo-ClKltJhW50hKPIRQAAAQA"]
[Tue Apr 14 05:22:46.752488 2026] [:error] [pid 19793:tid 19816] [client 20.220.62.139:63458] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa123.php"] [unique_id "ad1epgGEQsZw9TkmIA4Z9QAAANU"]
[Tue Apr 14 05:22:50.047585 2026] [:error] [pid 19793:tid 19802] [client 20.220.62.139:63477] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa123.php"] [unique_id "ad1eqgGEQsZw9TkmIA4Z-gAAAMc"]
[Tue Apr 14 05:22:58.127033 2026] [:error] [pid 19688:tid 19739] [client 20.220.62.139:9920] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa123.php"] [unique_id "ad1esoHoi57o76xPstK9PAAAAEs"]
[Tue Apr 14 05:24:03.076858 2026] [:error] [pid 19687:tid 19703] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Apr 14 05:24:03.332376 2026] [:error] [pid 19687:tid 19713] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-one.php
[Tue Apr 14 05:24:03.566914 2026] [:error] [pid 19687:tid 19715] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/alexus.php
[Tue Apr 14 05:24:04.992977 2026] [:error] [pid 19687:tid 19715] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/wso1337.php
[Tue Apr 14 05:24:05.227407 2026] [:error] [pid 19687:tid 19702] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Tue Apr 14 05:24:05.436010 2026] [:error] [pid 19687:tid 19717] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/it.php
[Tue Apr 14 05:24:05.656508 2026] [:error] [pid 19687:tid 19705] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/kiss.php
[Tue Apr 14 05:24:05.876978 2026] [:error] [pid 19687:tid 19700] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Tue Apr 14 05:24:06.135120 2026] [:error] [pid 19687:tid 19708] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/owl.php
[Tue Apr 14 05:24:06.344292 2026] [:error] [pid 19687:tid 19699] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Tue Apr 14 05:24:06.564041 2026] [:error] [pid 19687:tid 19711] [client 20.220.62.139:63424] File does not exist: /usr/local/apache/htdocs/suspended-page/ohayo.php
[Tue Apr 14 05:24:06.770316 2026] [:error] [pid 19687:tid 19716] [client 20.220.62.139:63424] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms.php"] [unique_id "ad1e9mBZImnR12CCWFo1tAAAABQ"]
[Tue Apr 14 05:24:10.776333 2026] [:error] [pid 19793:tid 19801] [client 20.220.62.139:9888] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms.php"] [unique_id "ad1e-gGEQsZw9TkmIA4aSwAAAMY"]
[Tue Apr 14 05:24:12.345552 2026] [:error] [pid 19687:tid 19713] [client 20.220.62.139:63426] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms.php"] [unique_id "ad1e_GBZImnR12CCWFo1vgAAABE"]
[Tue Apr 14 05:24:14.236477 2026] [:error] [pid 19793:tid 19800] [client 20.220.62.139:63396] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms.php"] [unique_id "ad1e_gGEQsZw9TkmIA4aUwAAAMU"]
[Tue Apr 14 05:24:19.465529 2026] [:error] [pid 64393:tid 64407] [client 20.220.62.139:63476] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-uploads.php"] [unique_id "ad1fA-ClKltJhW50hKPJUgAAAQw"]
[Tue Apr 14 05:24:21.149822 2026] [:error] [pid 19688:tid 19741] [client 20.220.62.139:63481] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-uploads.php"] [unique_id "ad1fBYHoi57o76xPstK-JwAAAE0"]
[Tue Apr 14 05:24:23.797064 2026] [:error] [pid 19689:tid 19774] [client 20.220.62.139:63478] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-uploads.php"] [unique_id "ad1fB5WU15arjG3aJyRYkAAAAJM"]
[Tue Apr 14 05:24:25.970903 2026] [:error] [pid 19689:tid 19756] [client 20.220.62.139:63448] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-uploads.php"] [unique_id "ad1fCZWU15arjG3aJyRYlwAAAIE"]
[Tue Apr 14 05:24:31.208469 2026] [:error] [pid 64393:tid 64416] [client 20.220.62.139:63427] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Gel.php"] [unique_id "ad1fD-ClKltJhW50hKPJdAAAARU"]
[Tue Apr 14 05:24:33.755447 2026] [:error] [pid 19793:tid 19808] [client 20.220.62.139:63382] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Gel.php"] [unique_id "ad1fEQGEQsZw9TkmIA4avwAAAM0"]
[Tue Apr 14 05:24:37.860290 2026] [:error] [pid 64393:tid 64409] [client 20.220.62.139:63470] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Gel.php"] [unique_id "ad1fFeClKltJhW50hKPJfgAAAQ4"]
[Tue Apr 14 05:24:41.056055 2026] [:error] [pid 19793:tid 19813] [client 20.220.62.139:63456] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Gel.php"] [unique_id "ad1fGQGEQsZw9TkmIA4azwAAANI"]
[Tue Apr 14 05:24:44.994965 2026] [:error] [pid 64393:tid 64414] [client 20.220.62.139:63459] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/41.php"] [unique_id "ad1fHOClKltJhW50hKPJjgAAARM"]
[Tue Apr 14 05:24:59.999141 2026] [:error] [pid 64393:tid 64401] [client 20.220.62.139:63409] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4price.php"] [unique_id "ad1fK-ClKltJhW50hKPJuwAAAQY"]
[Tue Apr 14 05:25:01.722180 2026] [:error] [pid 19688:tid 19731] [client 20.220.62.139:63375] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4price.php"] [unique_id "ad1fLYHoi57o76xPstK-SwAAAEM"]
[Tue Apr 14 05:25:03.105613 2026] [:error] [pid 64393:tid 64403] [client 20.220.62.139:9965] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4price.php"] [unique_id "ad1fL-ClKltJhW50hKPJyQAAAQg"]
[Tue Apr 14 05:25:04.242512 2026] [:error] [pid 19688:tid 19748] [client 20.220.62.139:63414] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4price.php"] [unique_id "ad1fMIHoi57o76xPstK-UAAAAFQ"]
[Tue Apr 14 05:25:05.981970 2026] [:error] [pid 64393:tid 64419] [client 20.220.62.139:9969] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/MARIJUANA.php"] [unique_id "ad1fMeClKltJhW50hKPJ0AAAARg"]
[Tue Apr 14 05:25:08.312926 2026] [:error] [pid 19689:tid 19779] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/MARIJUANA.php
[Tue Apr 14 05:25:08.525031 2026] [:error] [pid 19689:tid 19762] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/.fk.php
[Tue Apr 14 05:25:08.732137 2026] [:error] [pid 19689:tid 19768] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Tue Apr 14 05:25:08.948658 2026] [:error] [pid 19689:tid 19760] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/alexuse.php
[Tue Apr 14 05:25:09.172735 2026] [:error] [pid 19689:tid 19756] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/Sendemail.php
[Tue Apr 14 05:25:10.153869 2026] [:error] [pid 19689:tid 19755] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Apr 14 05:25:10.364102 2026] [:error] [pid 19689:tid 19775] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/olu.php
[Tue Apr 14 05:25:11.020954 2026] [:error] [pid 19689:tid 19769] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Tue Apr 14 05:25:11.249252 2026] [:error] [pid 19689:tid 19759] [client 20.220.62.139:9861] File does not exist: /usr/local/apache/htdocs/suspended-page/alexusmailer 2.0.php
[Tue Apr 14 05:25:11.466248 2026] [:error] [pid 19689:tid 19768] [client 20.220.62.139:9861] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rss.php"] [unique_id "ad1fN5WU15arjG3aJyRY6QAAAI0"]
[Tue Apr 14 05:25:13.642256 2026] [:error] [pid 64393:tid 64416] [client 20.220.62.139:63425] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rss.php"] [unique_id "ad1fOeClKltJhW50hKPJ1QAAARU"]
[Tue Apr 14 05:25:16.456016 2026] [:error] [pid 64393:tid 64413] [client 20.220.62.139:63411] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rss.php"] [unique_id "ad1fPOClKltJhW50hKPJ3gAAARI"]
[Tue Apr 14 05:25:17.999307 2026] [:error] [pid 19688:tid 19740] [client 20.220.62.139:63415] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rss.php"] [unique_id "ad1fPYHoi57o76xPstK-WwAAAEw"]
[Tue Apr 14 05:25:21.108068 2026] [:error] [pid 19793:tid 19810] [client 20.220.62.139:63416] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-file.php"] [unique_id "ad1fQQGEQsZw9TkmIA4bEwAAAM8"]
[Tue Apr 14 05:25:22.561383 2026] [:error] [pid 64393:tid 64412] [client 20.220.62.139:63397] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-file.php"] [unique_id "ad1fQuClKltJhW50hKPJ7wAAARE"]
[Tue Apr 14 05:25:25.804552 2026] [:error] [pid 19689:tid 19779] [client 20.220.62.139:9935] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-file.php"] [unique_id "ad1fRZWU15arjG3aJyRZAQAAAJg"]
[Tue Apr 14 05:25:27.197910 2026] [:error] [pid 19689:tid 19764] [client 20.220.62.139:63420] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-file.php"] [unique_id "ad1fR5WU15arjG3aJyRZBAAAAIk"]
[Tue Apr 14 05:25:29.696757 2026] [:error] [pid 64393:tid 64410] [client 20.220.62.139:9951] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wso2.php"] [unique_id "ad1fSeClKltJhW50hKPKBAAAAQ8"]
[Tue Apr 14 05:25:32.498874 2026] [:error] [pid 19689:tid 19775] [client 20.220.62.139:63432] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wso2.php"] [unique_id "ad1fTJWU15arjG3aJyRZCwAAAJQ"]
[Tue Apr 14 05:25:36.270802 2026] [:error] [pid 19689:tid 19756] [client 20.220.62.139:63386] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wso2.php"] [unique_id "ad1fUJWU15arjG3aJyRZDwAAAIE"]
[Tue Apr 14 05:25:41.414900 2026] [:error] [pid 19793:tid 19815] [client 20.220.62.139:63368] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wso2.php"] [unique_id "ad1fVQGEQsZw9TkmIA4bNgAAANQ"]
[Tue Apr 14 05:25:44.922960 2026] [:error] [pid 19687:tid 19703] [client 20.220.62.139:63410] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wso1.php"] [unique_id "ad1fWGBZImnR12CCWFo1_QAAAAc"]
[Tue Apr 14 05:25:46.141645 2026] [:error] [pid 64393:tid 64398] [client 20.220.62.139:63468] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wso1.php"] [unique_id "ad1fWuClKltJhW50hKPKGgAAAQM"]
[Tue Apr 14 05:25:47.831360 2026] [:error] [pid 64393:tid 64407] [client 20.220.62.139:63401] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wso1.php"] [unique_id "ad1fW-ClKltJhW50hKPKIAAAAQw"]
[Tue Apr 14 05:25:50.167473 2026] [:error] [pid 19687:tid 19696] [client 20.220.62.139:63362] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wso1.php"] [unique_id "ad1fXmBZImnR12CCWFo2AgAAAAA"]
[Tue Apr 14 05:25:55.561157 2026] [:error] [pid 64393:tid 64414] [client 20.220.62.139:9938] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/olux.php"] [unique_id "ad1fY-ClKltJhW50hKPKIwAAARM"]
[Tue Apr 14 05:25:56.204391 2026] [:error] [pid 19687:tid 19718] [client 20.220.62.139:63367] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/olux.php"] [unique_id "ad1fZGBZImnR12CCWFo2EAAAABY"]
[Tue Apr 14 05:26:15.755055 2026] [:error] [pid 19689:tid 19771] [client 20.220.62.139:63380] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Tue Apr 14 05:26:15.964479 2026] [:error] [pid 19689:tid 19764] [client 20.220.62.139:63380] File does not exist: /usr/local/apache/htdocs/suspended-page/xl.php
[Tue Apr 14 05:26:16.238830 2026] [:error] [pid 19689:tid 19756] [client 20.220.62.139:63380] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-confiig.php
[Tue Apr 14 05:26:16.458101 2026] [:error] [pid 19689:tid 19762] [client 20.220.62.139:63380] File does not exist: /usr/local/apache/htdocs/suspended-page/file-manager.php
[Tue Apr 14 05:26:16.692598 2026] [:error] [pid 19689:tid 19768] [client 20.220.62.139:63380] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Tue Apr 14 05:26:18.395127 2026] [:error] [pid 19689:tid 19768] [client 20.220.62.139:63380] File does not exist: /usr/local/apache/htdocs/suspended-page/leafmailer.php
[Tue Apr 14 05:26:18.815177 2026] [:error] [pid 19689:tid 19760] [client 20.220.62.139:63380] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Tue Apr 14 05:26:19.066373 2026] [:error] [pid 19689:tid 19773] [client 20.220.62.139:63380] File does not exist: /usr/local/apache/htdocs/suspended-page/pomo.php
[Tue Apr 14 05:26:19.294430 2026] [:error] [pid 19689:tid 19771] [client 20.220.62.139:63380] [client 20.220.62.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/pomo.php"] [unique_id "ad1fe5WU15arjG3aJyRZPwAAAJA"]
[Tue Apr 14 05:26:39.360827 2026] [:error] [pid 19688:tid 19751] [client 20.220.62.139:63446] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kk.php"] [unique_id "ad1fj4Hoi57o76xPstK-iwAAAFc"]
[Tue Apr 14 05:26:41.286342 2026] [:error] [pid 19689:tid 19772] [client 20.220.62.139:63475] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kk.php"] [unique_id "ad1fkZWU15arjG3aJyRZcAAAAJE"]
[Tue Apr 14 05:26:43.984598 2026] [:error] [pid 19793:tid 19802] [client 20.220.62.139:9875] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kk.php"] [unique_id "ad1fkwGEQsZw9TkmIA4bgQAAAMc"]
[Tue Apr 14 05:26:46.920777 2026] [:error] [pid 19793:tid 19814] [client 20.220.62.139:63390] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kk.php"] [unique_id "ad1flgGEQsZw9TkmIA4bhwAAANM"]
[Tue Apr 14 05:26:50.177752 2026] [:error] [pid 64393:tid 64395] [client 20.220.62.139:63463] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin.php"] [unique_id "ad1fmuClKltJhW50hKPKuwAAAQA"]
[Tue Apr 14 05:26:53.301051 2026] [:error] [pid 64393:tid 64407] [client 20.220.62.139:63454] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin.php"] [unique_id "ad1fneClKltJhW50hKPK1QAAAQw"]
[Tue Apr 14 05:26:56.091753 2026] [:error] [pid 19793:tid 19818] [client 20.220.62.139:63376] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin.php"] [unique_id "ad1foAGEQsZw9TkmIA4buwAAANc"]
[Tue Apr 14 05:26:58.762974 2026] [:error] [pid 64393:tid 64416] [client 20.220.62.139:9922] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin.php"] [unique_id "ad1fouClKltJhW50hKPK7QAAARU"]
[Tue Apr 14 05:27:01.304706 2026] [:error] [pid 19793:tid 19817] [client 20.220.62.139:63406] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "ad1fpQGEQsZw9TkmIA4b2AAAANY"]
[Tue Apr 14 05:27:04.052931 2026] [:error] [pid 64393:tid 64414] [client 20.220.62.139:63447] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "ad1fqOClKltJhW50hKPK9gAAARM"]
[Tue Apr 14 05:27:06.366975 2026] [:error] [pid 19689:tid 19769] [client 20.220.62.139:63438] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "ad1fqpWU15arjG3aJyRZfwAAAI4"]
[Tue Apr 14 05:27:08.937839 2026] [:error] [pid 19689:tid 19770] [client 20.220.62.139:63437] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "ad1frJWU15arjG3aJyRZhAAAAI8"]
[Tue Apr 14 05:27:10.712423 2026] [:error] [pid 64393:tid 64410] [client 20.220.62.139:63391] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ad1fruClKltJhW50hKPLCQAAAQ8"]
[Tue Apr 14 05:27:12.658880 2026] [:error] [pid 19689:tid 19766] [client 20.220.62.139:63370] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ad1fsJWU15arjG3aJyRZhwAAAIs"]
[Tue Apr 14 05:27:14.950535 2026] [:error] [pid 19793:tid 19807] [client 20.220.62.139:63431] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ad1fsgGEQsZw9TkmIA4b-QAAAMw"]
[Tue Apr 14 05:27:18.337314 2026] [:error] [pid 19793:tid 19796] [client 20.220.62.139:63472] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ad1ftgGEQsZw9TkmIA4b_AAAAME"]
[Tue Apr 14 05:27:21.487686 2026] [:error] [pid 19793:tid 19813] [client 20.220.62.139:63466] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/index.php"] [unique_id "ad1fuQGEQsZw9TkmIA4cBwAAANI"]
[Tue Apr 14 05:27:32.866289 2026] [:error] [pid 64393:tid 64395] [client 20.220.62.139:63379] [client 20.220.62.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/index.php"] [unique_id "ad1fxOClKltJhW50hKPLQAAAAQA"]
[Tue Apr 14 05:27:40.743262 2026] [:error] [pid 19793:tid 19797] [client 20.220.62.139:63482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 14 05:27:40.968865 2026] [:error] [pid 19793:tid 19795] [client 20.220.62.139:63482] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Tue Apr 14 05:27:42.474832 2026] [:error] [pid 19793:tid 19795] [client 20.220.62.139:63482] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 14 05:27:42.686516 2026] [:error] [pid 19793:tid 19799] [client 20.220.62.139:63482] File does not exist: /usr/local/apache/htdocs/suspended-page/\xe2\x80\x89goods.php
[Tue Apr 14 05:27:44.692429 2026] [:error] [pid 19793:tid 19796] [client 20.220.62.139:63482] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 14 05:27:46.164327 2026] [:error] [pid 19793:tid 19803] [client 20.220.62.139:63482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 14 05:27:46.372989 2026] [:error] [pid 19793:tid 19795] [client 20.220.62.139:63482] [client 20.220.62.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.62.139, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "ad1f0gGEQsZw9TkmIA4cOAAAAMA"]
[Tue Apr 14 05:27:46.376471 2026] [:error] [pid 19793:tid 19795] [client 20.220.62.139:63482] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 14 06:04:01.145229 2026] [:error] [pid 64393:tid 64414] [client 40.89.166.87:7124] [client 40.89.166.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad1oUeClKltJhW50hKPc6QAAARM"]
[Tue Apr 14 06:04:02.656630 2026] [:error] [pid 19689:tid 19773] [client 40.89.166.87:17115] [client 40.89.166.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad1oUpWU15arjG3aJyRi-QAAAJI"]
[Tue Apr 14 06:04:03.534144 2026] [:error] [pid 64393:tid 64413] [client 40.89.166.87:7128] [client 40.89.166.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad1oU-ClKltJhW50hKPc8QAAARI"]
[Tue Apr 14 06:04:05.397524 2026] [:error] [pid 64393:tid 64399] [client 40.89.166.87:17150] [client 40.89.166.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad1oVeClKltJhW50hKPc-AAAAQQ"]
[Tue Apr 14 06:10:13.900935 2026] [:error] [pid 19688:tid 19748] [client 216.73.216.167:53494] [client 216.73.216.167] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.windfc.windfarmcoolants.com.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/robots.txt"] [unique_id "ad1pxYHoi57o76xPstLIGAAAAFQ"]
[Tue Apr 14 22:18:44.405315 2026] [:error] [pid 59986:tid 60021] [client 154.54.100.171:46064] [client 154.54.100.171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ad5MxJ6axKeW6bX4H7efSAAAAEE"]
[Wed Apr 15 04:01:23.962478 2026] [:error] [pid 4066:tid 4128] [client 216.81.248.211:46414] [client 216.81.248.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ad6dE4C2YXfSPsC9O_BFrwAAAFg"]
[Wed Apr 15 11:45:08.005688 2026] [:error] [pid 30644:tid 30654] [client 159.89.55.133:58380] [client 159.89.55.133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ad8JxK8vuyJ0N41zsM8hcQAAAMQ"]
[Wed Apr 15 21:20:56.362538 2026] [:error] [pid 37370:tid 37374] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Wed Apr 15 21:20:56.727174 2026] [:error] [pid 37370:tid 37379] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 15 21:20:56.989814 2026] [:error] [pid 37370:tid 37377] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Apr 15 21:20:57.274504 2026] [:error] [pid 37370:tid 37380] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Wed Apr 15 21:20:57.587011 2026] [:error] [pid 37370:tid 37396] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Wed Apr 15 21:20:58.081930 2026] [:error] [pid 37370:tid 37379] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Wed Apr 15 21:20:58.320418 2026] [:error] [pid 37370:tid 37394] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Wed Apr 15 21:20:58.614683 2026] [:error] [pid 37370:tid 37395] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 15 21:20:58.852264 2026] [:error] [pid 37370:tid 37380] [client 4.232.83.105:18096] File does not exist: /usr/local/apache/htdocs/suspended-page/admlo.php
[Wed Apr 15 21:20:59.128409 2026] [:error] [pid 37370:tid 37381] [client 4.232.83.105:18096] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "ad-Qu3g-gnM2Ga0cGABewAAAAQk"]
[Wed Apr 15 21:20:59.848227 2026] [:error] [pid 31053:tid 31061] [client 4.232.83.105:10709] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "ad-QuxcEkLCmvF0fjDftOQAAAIU"]
[Wed Apr 15 21:21:00.614735 2026] [:error] [pid 30958:tid 31021] [client 4.232.83.105:61898] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "ad-QvMeG3wSKTO7NWFG5lgAAAMU"]
[Wed Apr 15 21:21:01.836157 2026] [:error] [pid 37370:tid 37380] [client 4.232.83.105:18157] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "ad-QvXg-gnM2Ga0cGABeyAAAAQg"]
[Wed Apr 15 21:21:03.127291 2026] [:error] [pid 30957:tid 31005] [client 4.232.83.105:10734] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "ad-Qv35gwVEVXHfVSiqXXQAAAFA"]
[Wed Apr 15 21:21:03.800169 2026] [:error] [pid 37370:tid 37380] [client 4.232.83.105:53412] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "ad-Qv3g-gnM2Ga0cGABe1wAAAQg"]
[Wed Apr 15 21:21:04.555046 2026] [:error] [pid 37370:tid 37372] [client 4.232.83.105:16945] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "ad-QwHg-gnM2Ga0cGABe4wAAAQA"]
[Wed Apr 15 21:21:05.244702 2026] [:error] [pid 31053:tid 31061] [client 4.232.83.105:22951] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "ad-QwRcEkLCmvF0fjDftZQAAAIU"]
[Wed Apr 15 21:21:05.968757 2026] [:error] [pid 37370:tid 37395] [client 4.232.83.105:30744] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "ad-QwXg-gnM2Ga0cGABe9gAAARc"]
[Wed Apr 15 21:21:06.717749 2026] [:error] [pid 37370:tid 37385] [client 4.232.83.105:10703] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "ad-Qwng-gnM2Ga0cGABfBgAAAQ0"]
[Wed Apr 15 21:21:07.856384 2026] [:error] [pid 30958:tid 31020] [client 4.232.83.105:11994] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "ad-Qw8eG3wSKTO7NWFG5qwAAAMQ"]
[Wed Apr 15 21:21:09.587526 2026] [:error] [pid 30956:tid 30968] [client 4.232.83.105:5474] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "ad-QxUBGUpjaWntNYq2CEgAAAAg"]
[Wed Apr 15 21:21:10.553124 2026] [:error] [pid 37370:tid 37379] [client 4.232.83.105:20442] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "ad-Qxng-gnM2Ga0cGABfHAAAAQc"]
[Wed Apr 15 21:21:11.679345 2026] [:error] [pid 31053:tid 31058] [client 4.232.83.105:21746] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "ad-QxxcEkLCmvF0fjDftoAAAAII"]
[Wed Apr 15 21:21:12.542439 2026] [:error] [pid 37370:tid 37383] [client 4.232.83.105:12010] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "ad-QyHg-gnM2Ga0cGABfJQAAAQs"]
[Wed Apr 15 21:21:13.205988 2026] [:error] [pid 30958:tid 31023] [client 4.232.83.105:21711] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "ad-QyceG3wSKTO7NWFG5yAAAAMc"]
[Wed Apr 15 21:21:13.833111 2026] [:error] [pid 30956:tid 30969] [client 4.232.83.105:17487] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ad-QyUBGUpjaWntNYq2CIwAAAAk"]
[Wed Apr 15 21:21:14.450585 2026] [:error] [pid 31053:tid 31072] [client 4.232.83.105:10717] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ad-QyhcEkLCmvF0fjDfttgAAAJA"]
[Wed Apr 15 21:21:15.389696 2026] [:error] [pid 37370:tid 37386] [client 4.232.83.105:16908] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ad-Qy3g-gnM2Ga0cGABfNwAAAQ4"]
[Wed Apr 15 21:21:16.131311 2026] [:error] [pid 37370:tid 37388] [client 4.232.83.105:20428] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ad-QzHg-gnM2Ga0cGABfRQAAARA"]
[Wed Apr 15 21:21:17.126881 2026] [:error] [pid 37370:tid 37373] [client 4.232.83.105:15610] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ad-QzXg-gnM2Ga0cGABfWAAAAQE"]
[Wed Apr 15 21:21:18.108768 2026] [:error] [pid 30956:tid 30973] [client 4.232.83.105:31939] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ad-QzkBGUpjaWntNYq2CLwAAAA0"]
[Wed Apr 15 21:21:18.872790 2026] [:error] [pid 30956:tid 30963] [client 4.232.83.105:5445] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ad-QzkBGUpjaWntNYq2CMgAAAAM"]
[Wed Apr 15 21:21:19.428370 2026] [:error] [pid 31053:tid 31063] [client 4.232.83.105:30756] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ad-QzxcEkLCmvF0fjDft0wAAAIc"]
[Wed Apr 15 21:21:20.339649 2026] [:error] [pid 30956:tid 30981] [client 4.232.83.105:28645] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "ad-Q0EBGUpjaWntNYq2COwAAABU"]
[Wed Apr 15 21:21:21.122718 2026] [:error] [pid 30957:tid 31000] [client 4.232.83.105:34058] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "ad-Q0X5gwVEVXHfVSiqXsQAAAEs"]
[Wed Apr 15 21:21:21.740897 2026] [:error] [pid 30958:tid 31029] [client 4.232.83.105:15564] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "ad-Q0ceG3wSKTO7NWFG59gAAAM0"]
[Wed Apr 15 21:21:22.440014 2026] [:error] [pid 30956:tid 30960] [client 4.232.83.105:16958] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "ad-Q0kBGUpjaWntNYq2CSgAAAAA"]
[Wed Apr 15 21:21:22.999285 2026] [:error] [pid 31053:tid 31077] [client 4.232.83.105:25434] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "ad-Q0hcEkLCmvF0fjDft7QAAAJU"]
[Wed Apr 15 21:21:23.498478 2026] [:error] [pid 31053:tid 31060] [client 4.232.83.105:18061] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "ad-Q0xcEkLCmvF0fjDft9gAAAIQ"]
[Wed Apr 15 21:21:24.120009 2026] [:error] [pid 30957:tid 30989] [client 4.232.83.105:52766] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "ad-Q1H5gwVEVXHfVSiqXuwAAAEA"]
[Wed Apr 15 21:21:24.700836 2026] [:error] [pid 37370:tid 37396] [client 4.232.83.105:18134] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "ad-Q1Hg-gnM2Ga0cGABfhgAAARg"]
[Wed Apr 15 21:21:25.840413 2026] [:error] [pid 31053:tid 31063] [client 4.232.83.105:12021] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "ad-Q1RcEkLCmvF0fjDfuEAAAAIc"]
[Wed Apr 15 21:21:27.638341 2026] [:error] [pid 30956:tid 30961] [client 4.232.83.105:20420] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "ad-Q10BGUpjaWntNYq2CYAAAAAE"]
[Wed Apr 15 21:21:28.698378 2026] [:error] [pid 37370:tid 37393] [client 4.232.83.105:11999] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "ad-Q2Hg-gnM2Ga0cGABfsAAAARU"]
[Wed Apr 15 21:21:29.437779 2026] [:error] [pid 37370:tid 37380] [client 4.232.83.105:5970] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "ad-Q2Xg-gnM2Ga0cGABfwQAAAQg"]
[Wed Apr 15 21:21:30.299767 2026] [:error] [pid 30957:tid 31010] [client 4.232.83.105:21476] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "ad-Q2n5gwVEVXHfVSiqX0wAAAFU"]
[Wed Apr 15 21:21:30.946884 2026] [:error] [pid 37370:tid 37387] [client 4.232.83.105:16942] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "ad-Q2ng-gnM2Ga0cGABf0QAAAQ8"]
[Wed Apr 15 21:21:31.446724 2026] [:error] [pid 30958:tid 31033] [client 4.232.83.105:28608] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "ad-Q28eG3wSKTO7NWFG6DwAAANE"]
[Wed Apr 15 21:21:32.013091 2026] [:error] [pid 37370:tid 37384] [client 4.232.83.105:9410] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "ad-Q3Hg-gnM2Ga0cGABf3gAAAQw"]
[Wed Apr 15 21:21:33.588293 2026] [:error] [pid 37370:tid 37391] [client 4.232.83.105:30034] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "ad-Q3Xg-gnM2Ga0cGABf6AAAARM"]
[Wed Apr 15 21:21:35.240448 2026] [:error] [pid 30957:tid 31001] [client 4.232.83.105:20442] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "ad-Q335gwVEVXHfVSiqX6wAAAEw"]
[Wed Apr 15 21:21:36.700895 2026] [:error] [pid 31053:tid 31071] [client 4.232.83.105:40149] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "ad-Q4BcEkLCmvF0fjDfubwAAAI8"]
[Wed Apr 15 21:21:38.121635 2026] [:error] [pid 37370:tid 37386] [client 4.232.83.105:16929] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "ad-Q4ng-gnM2Ga0cGABgGQAAAQ4"]
[Wed Apr 15 21:21:38.836893 2026] [:error] [pid 30957:tid 31003] [client 4.232.83.105:52755] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "ad-Q4n5gwVEVXHfVSiqX9wAAAE4"]
[Wed Apr 15 21:21:40.022574 2026] [:error] [pid 30956:tid 30980] [client 4.232.83.105:20466] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "ad-Q5EBGUpjaWntNYq2CggAAABQ"]
[Wed Apr 15 21:21:40.938110 2026] [:error] [pid 30956:tid 30973] [client 4.232.83.105:28637] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "ad-Q5EBGUpjaWntNYq2CiwAAAA0"]
[Wed Apr 15 21:21:41.677038 2026] [:error] [pid 30956:tid 30962] [client 4.232.83.105:8606] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "ad-Q5UBGUpjaWntNYq2CkAAAAAI"]
[Wed Apr 15 21:21:42.466664 2026] [:error] [pid 30957:tid 30996] [client 4.232.83.105:20670] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "ad-Q5n5gwVEVXHfVSiqYDwAAAEc"]
[Wed Apr 15 21:21:43.118371 2026] [:error] [pid 31053:tid 31064] [client 4.232.83.105:21473] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "ad-Q5xcEkLCmvF0fjDfuiAAAAIg"]
[Wed Apr 15 21:21:43.622680 2026] [:error] [pid 37370:tid 37394] [client 4.232.83.105:12012] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "ad-Q53g-gnM2Ga0cGABgQAAAARY"]
[Wed Apr 15 21:21:44.352330 2026] [:error] [pid 31053:tid 31080] [client 4.232.83.105:30023] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "ad-Q6BcEkLCmvF0fjDfujAAAAJg"]
[Wed Apr 15 21:21:44.961659 2026] [:error] [pid 30957:tid 30999] [client 4.232.83.105:20424] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "ad-Q6H5gwVEVXHfVSiqYIgAAAEo"]
[Wed Apr 15 21:21:45.513627 2026] [:error] [pid 31053:tid 31067] [client 4.232.83.105:18309] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "ad-Q6RcEkLCmvF0fjDfumAAAAIs"]
[Wed Apr 15 21:21:46.383538 2026] [:error] [pid 37370:tid 37383] [client 4.232.83.105:18355] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "ad-Q6ng-gnM2Ga0cGABgYgAAAQs"]
[Wed Apr 15 21:21:46.881178 2026] [:error] [pid 31053:tid 31061] [client 4.232.83.105:27987] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "ad-Q6hcEkLCmvF0fjDfupAAAAIU"]
[Wed Apr 15 21:21:48.217446 2026] [:error] [pid 30958:tid 31016] [client 4.232.83.105:18360] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "ad-Q7MeG3wSKTO7NWFG6RQAAAMA"]
[Wed Apr 15 21:21:49.068809 2026] [:error] [pid 30958:tid 31036] [client 4.232.83.105:20422] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "ad-Q7ceG3wSKTO7NWFG6SQAAANQ"]
[Wed Apr 15 21:21:49.545989 2026] [:error] [pid 30958:tid 31023] [client 4.232.83.105:21448] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "ad-Q7ceG3wSKTO7NWFG6TAAAAMc"]
[Wed Apr 15 21:21:50.727541 2026] [:error] [pid 37370:tid 37396] [client 4.232.83.105:15554] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "ad-Q7ng-gnM2Ga0cGABgdwAAARg"]
[Wed Apr 15 21:21:51.764384 2026] [:error] [pid 30956:tid 30981] [client 4.232.83.105:18337] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "ad-Q70BGUpjaWntNYq2CqgAAABU"]
[Wed Apr 15 21:22:05.031439 2026] [:error] [pid 37370:tid 37376] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Wed Apr 15 21:22:05.268530 2026] [:error] [pid 37370:tid 37378] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/bmi.php
[Wed Apr 15 21:22:05.602610 2026] [:error] [pid 37370:tid 37386] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Apr 15 21:22:05.880803 2026] [:error] [pid 37370:tid 37387] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Apr 15 21:22:06.178641 2026] [:error] [pid 37370:tid 37393] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Wed Apr 15 21:22:06.492002 2026] [:error] [pid 37370:tid 37384] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Wed Apr 15 21:22:06.797078 2026] [:error] [pid 37370:tid 37377] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Wed Apr 15 21:22:07.115895 2026] [:error] [pid 37370:tid 37378] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Wed Apr 15 21:22:07.359519 2026] [:error] [pid 37370:tid 37382] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Wed Apr 15 21:22:07.669090 2026] [:error] [pid 37370:tid 37392] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Wed Apr 15 21:22:07.943957 2026] [:error] [pid 37370:tid 37396] [client 4.232.83.105:28661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Wed Apr 15 21:22:08.206832 2026] [:error] [pid 37370:tid 37373] [client 4.232.83.105:28661] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ad-RAHg-gnM2Ga0cGABhfAAAAQE"]
[Wed Apr 15 21:22:32.407877 2026] [:error] [pid 37370:tid 37384] [client 4.232.83.105:13260] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "ad-RGHg-gnM2Ga0cGABitgAAAQw"]
[Wed Apr 15 21:22:37.171357 2026] [:error] [pid 30957:tid 31003] [client 4.232.83.105:17235] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "ad-RHX5gwVEVXHfVSiqZRgAAAE4"]
[Wed Apr 15 21:22:39.155356 2026] [:error] [pid 37370:tid 37392] [client 4.232.83.105:13284] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "ad-RH3g-gnM2Ga0cGABjMgAAARQ"]
[Wed Apr 15 21:22:39.688623 2026] [:error] [pid 31053:tid 31056] [client 4.232.83.105:12931] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "ad-RHxcEkLCmvF0fjDfwjwAAAIA"]
[Wed Apr 15 21:22:40.522373 2026] [:error] [pid 30958:tid 31020] [client 4.232.83.105:10979] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "ad-RIMeG3wSKTO7NWFG7LwAAAMQ"]
[Wed Apr 15 21:22:41.577623 2026] [:error] [pid 31053:tid 31078] [client 4.232.83.105:15302] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "ad-RIRcEkLCmvF0fjDfwlgAAAJY"]
[Wed Apr 15 21:22:42.476948 2026] [:error] [pid 31053:tid 31057] [client 4.232.83.105:13489] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "ad-RIhcEkLCmvF0fjDfwmwAAAIE"]
[Wed Apr 15 21:22:43.208221 2026] [:error] [pid 31053:tid 31079] [client 4.232.83.105:17219] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/vx.php"] [unique_id "ad-RIxcEkLCmvF0fjDfwpQAAAJc"]
[Wed Apr 15 21:22:44.676925 2026] [:error] [pid 30956:tid 30961] [client 4.232.83.105:17226] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "ad-RJEBGUpjaWntNYq2DcwAAAAE"]
[Wed Apr 15 21:22:45.923173 2026] [:error] [pid 30956:tid 30972] [client 4.232.83.105:13448] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "ad-RJUBGUpjaWntNYq2DfQAAAAw"]
[Wed Apr 15 21:22:46.847264 2026] [:error] [pid 31053:tid 31059] [client 4.232.83.105:10998] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "ad-RJhcEkLCmvF0fjDfwuQAAAIM"]
[Wed Apr 15 21:22:47.712416 2026] [:error] [pid 30957:tid 30991] [client 4.232.83.105:13248] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "ad-RJ35gwVEVXHfVSiqZdwAAAEI"]
[Wed Apr 15 21:22:48.278857 2026] [:error] [pid 30956:tid 30971] [client 4.232.83.105:5403] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "ad-RKEBGUpjaWntNYq2DkAAAAAs"]
[Wed Apr 15 21:22:49.304067 2026] [:error] [pid 31053:tid 31069] [client 4.232.83.105:9778] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "ad-RKRcEkLCmvF0fjDfwzQAAAI0"]
[Wed Apr 15 21:22:50.422934 2026] [:error] [pid 31053:tid 31078] [client 4.232.83.105:19040] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "ad-RKhcEkLCmvF0fjDfw0gAAAJY"]
[Wed Apr 15 21:22:50.917601 2026] [:error] [pid 30958:tid 31020] [client 4.232.83.105:16076] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "ad-RKseG3wSKTO7NWFG7cQAAAMQ"]
[Wed Apr 15 21:22:51.819498 2026] [:error] [pid 30958:tid 31026] [client 4.232.83.105:11760] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ad-RK8eG3wSKTO7NWFG7dQAAAMo"]
[Wed Apr 15 21:22:52.407956 2026] [:error] [pid 31053:tid 31066] [client 4.232.83.105:17723] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ad-RLBcEkLCmvF0fjDfw2gAAAIo"]
[Wed Apr 15 21:22:52.882221 2026] [:error] [pid 31053:tid 31077] [client 4.232.83.105:5394] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ad-RLBcEkLCmvF0fjDfw3AAAAJU"]
[Wed Apr 15 21:22:54.300465 2026] [:error] [pid 30956:tid 30977] [client 4.232.83.105:14039] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ad-RLkBGUpjaWntNYq2DogAAABE"]
[Wed Apr 15 21:22:55.316161 2026] [:error] [pid 30957:tid 30989] [client 4.232.83.105:29987] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "ad-RL35gwVEVXHfVSiqZkwAAAEA"]
[Wed Apr 15 21:22:55.942753 2026] [:error] [pid 30956:tid 30967] [client 4.232.83.105:30013] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "ad-RL0BGUpjaWntNYq2DrQAAAAc"]
[Wed Apr 15 21:22:56.554330 2026] [:error] [pid 37370:tid 37378] [client 4.232.83.105:5657] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "ad-RMHg-gnM2Ga0cGABjeAAAAQY"]
[Wed Apr 15 21:22:59.264008 2026] [:error] [pid 31053:tid 31066] [client 4.232.83.105:10683] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "ad-RMxcEkLCmvF0fjDfxDAAAAIo"]
[Wed Apr 15 21:23:00.458025 2026] [:error] [pid 37370:tid 37378] [client 4.232.83.105:51692] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index.php"] [unique_id "ad-RNHg-gnM2Ga0cGABjmQAAAQY"]
[Wed Apr 15 21:23:01.254262 2026] [:error] [pid 30956:tid 30972] [client 4.232.83.105:29325] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index.php"] [unique_id "ad-RNUBGUpjaWntNYq2DtwAAAAw"]
[Wed Apr 15 21:23:02.504438 2026] [:error] [pid 31053:tid 31079] [client 4.232.83.105:63777] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index.php"] [unique_id "ad-RNhcEkLCmvF0fjDfxIgAAAJc"]
[Wed Apr 15 21:23:04.384794 2026] [:error] [pid 30958:tid 31028] [client 4.232.83.105:35880] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index.php"] [unique_id "ad-ROMeG3wSKTO7NWFG7swAAAMw"]
[Wed Apr 15 21:23:06.440142 2026] [:error] [pid 30958:tid 31020] [client 4.232.83.105:32639] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "ad-ROseG3wSKTO7NWFG7wgAAAMQ"]
[Wed Apr 15 21:23:06.951665 2026] [:error] [pid 30958:tid 31037] [client 4.232.83.105:17738] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "ad-ROseG3wSKTO7NWFG7xAAAANU"]
[Wed Apr 15 21:23:08.096974 2026] [:error] [pid 30956:tid 30961] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Apr 15 21:23:08.334200 2026] [:error] [pid 30956:tid 30979] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/900.php
[Wed Apr 15 21:23:08.874412 2026] [:error] [pid 30956:tid 30969] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Wed Apr 15 21:23:09.114507 2026] [:error] [pid 30956:tid 30962] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Wed Apr 15 21:23:09.408157 2026] [:error] [pid 30956:tid 30977] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Wed Apr 15 21:23:09.648248 2026] [:error] [pid 30956:tid 30973] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Wed Apr 15 21:23:09.884936 2026] [:error] [pid 30956:tid 30972] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Wed Apr 15 21:23:10.120842 2026] [:error] [pid 30956:tid 30965] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/aboutc.php
[Wed Apr 15 21:23:10.357720 2026] [:error] [pid 30956:tid 30960] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Wed Apr 15 21:23:10.661267 2026] [:error] [pid 30956:tid 30968] [client 4.232.83.105:43940] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Wed Apr 15 21:23:11.314310 2026] [:error] [pid 30956:tid 30980] [client 4.232.83.105:43940] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws48.php"] [unique_id "ad-RP0BGUpjaWntNYq2D5wAAABQ"]
[Wed Apr 15 21:23:11.947213 2026] [:error] [pid 37370:tid 37373] [client 4.232.83.105:51763] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws48.php"] [unique_id "ad-RP3g-gnM2Ga0cGABj_wAAAQE"]
[Wed Apr 15 21:23:12.862462 2026] [:error] [pid 30957:tid 31003] [client 4.232.83.105:5283] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws48.php"] [unique_id "ad-RQH5gwVEVXHfVSiqZ5QAAAE4"]
[Wed Apr 15 21:23:13.718829 2026] [:error] [pid 37370:tid 37376] [client 4.232.83.105:23013] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws48.php"] [unique_id "ad-RQXg-gnM2Ga0cGABkIAAAAQQ"]
[Wed Apr 15 21:23:14.719052 2026] [:error] [pid 37370:tid 37388] [client 4.232.83.105:17768] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "ad-RQng-gnM2Ga0cGABkNAAAARA"]
[Wed Apr 15 21:23:15.858757 2026] [:error] [pid 37370:tid 37375] [client 4.232.83.105:39427] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "ad-RQ3g-gnM2Ga0cGABkUwAAAQM"]
[Wed Apr 15 21:23:16.441196 2026] [:error] [pid 31053:tid 31074] [client 4.232.83.105:11952] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "ad-RRBcEkLCmvF0fjDfxQgAAAJI"]
[Wed Apr 15 21:23:17.109087 2026] [:error] [pid 30956:tid 30981] [client 4.232.83.105:35872] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "ad-RRUBGUpjaWntNYq2D8AAAABU"]
[Wed Apr 15 21:23:17.680002 2026] [:error] [pid 30956:tid 30968] [client 4.232.83.105:37953] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "ad-RRUBGUpjaWntNYq2D8wAAAAg"]
[Wed Apr 15 21:23:18.587253 2026] [:error] [pid 30956:tid 30982] [client 4.232.83.105:51747] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "ad-RRkBGUpjaWntNYq2D_AAAABY"]
[Wed Apr 15 21:23:19.142670 2026] [:error] [pid 30957:tid 31001] [client 4.232.83.105:23490] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "ad-RR35gwVEVXHfVSiqZ_AAAAEw"]
[Wed Apr 15 21:23:19.863620 2026] [:error] [pid 30956:tid 30962] [client 4.232.83.105:19769] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "ad-RR0BGUpjaWntNYq2EBAAAAAI"]
[Wed Apr 15 21:23:20.421147 2026] [:error] [pid 30958:tid 31024] [client 4.232.83.105:5292] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "ad-RSMeG3wSKTO7NWFG8BQAAAMg"]
[Wed Apr 15 21:23:20.925945 2026] [:error] [pid 37370:tid 37376] [client 4.232.83.105:15023] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "ad-RSHg-gnM2Ga0cGABkfQAAAQQ"]
[Wed Apr 15 21:23:21.606883 2026] [:error] [pid 37370:tid 37396] [client 4.232.83.105:51726] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "ad-RSXg-gnM2Ga0cGABkhgAAARg"]
[Wed Apr 15 21:23:22.270305 2026] [:error] [pid 31053:tid 31057] [client 4.232.83.105:23029] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "ad-RShcEkLCmvF0fjDfxbAAAAIE"]
[Wed Apr 15 21:23:23.001511 2026] [:error] [pid 31053:tid 31064] [client 4.232.83.105:23538] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "ad-RSxcEkLCmvF0fjDfxbwAAAIg"]
[Wed Apr 15 21:23:23.730683 2026] [:error] [pid 30958:tid 31038] [client 4.232.83.105:14779] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "ad-RS8eG3wSKTO7NWFG8GgAAANY"]
[Wed Apr 15 21:23:24.231661 2026] [:error] [pid 30957:tid 31005] [client 4.232.83.105:43934] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "ad-RTH5gwVEVXHfVSiqaCwAAAFA"]
[Wed Apr 15 21:23:24.897975 2026] [:error] [pid 30957:tid 31004] [client 4.232.83.105:43949] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "ad-RTH5gwVEVXHfVSiqaDwAAAE8"]
[Wed Apr 15 21:23:25.439494 2026] [:error] [pid 30956:tid 30962] [client 4.232.83.105:37954] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "ad-RTUBGUpjaWntNYq2EFAAAAAI"]
[Wed Apr 15 21:23:26.306997 2026] [:error] [pid 37370:tid 37392] [client 4.232.83.105:39425] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "ad-RTng-gnM2Ga0cGABkwwAAARQ"]
[Wed Apr 15 21:23:26.822473 2026] [:error] [pid 37370:tid 37387] [client 4.232.83.105:16929] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "ad-RTng-gnM2Ga0cGABkzQAAAQ8"]
[Wed Apr 15 21:23:27.368026 2026] [:error] [pid 30958:tid 31033] [client 4.232.83.105:51689] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "ad-RT8eG3wSKTO7NWFG8KwAAANE"]
[Wed Apr 15 21:23:27.870249 2026] [:error] [pid 30958:tid 31029] [client 4.232.83.105:23527] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad-RT8eG3wSKTO7NWFG8MQAAAM0"]
[Wed Apr 15 21:23:28.440958 2026] [:error] [pid 31053:tid 31057] [client 4.232.83.105:35906] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad-RUBcEkLCmvF0fjDfxjQAAAIE"]
[Wed Apr 15 21:23:29.087806 2026] [:error] [pid 37370:tid 37384] [client 4.232.83.105:32610] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad-RUXg-gnM2Ga0cGABk5AAAAQw"]
[Wed Apr 15 21:23:29.831664 2026] [:error] [pid 37370:tid 37385] [client 4.232.83.105:32578] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ad-RUXg-gnM2Ga0cGABk8AAAAQ0"]
[Wed Apr 15 21:23:31.159361 2026] [:error] [pid 37370:tid 37373] [client 4.232.83.105:19733] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "ad-RU3g-gnM2Ga0cGABlEAAAAQE"]
[Wed Apr 15 21:23:32.025089 2026] [:error] [pid 30958:tid 31034] [client 4.232.83.105:24731] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "ad-RVMeG3wSKTO7NWFG8PQAAANI"]
[Wed Apr 15 21:23:32.600353 2026] [:error] [pid 30956:tid 30971] [client 4.232.83.105:12468] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "ad-RVEBGUpjaWntNYq2EKQAAAAs"]
[Wed Apr 15 21:23:33.101438 2026] [:error] [pid 37370:tid 37376] [client 4.232.83.105:12460] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "ad-RVXg-gnM2Ga0cGABlKAAAAQQ"]
[Wed Apr 15 21:23:33.637414 2026] [:error] [pid 30958:tid 31039] [client 4.232.83.105:29996] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "ad-RVceG3wSKTO7NWFG8SwAAANc"]
[Wed Apr 15 21:23:34.127641 2026] [:error] [pid 30957:tid 31011] [client 4.232.83.105:21436] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "ad-RVn5gwVEVXHfVSiqaNwAAAFY"]
[Wed Apr 15 21:23:34.628326 2026] [:error] [pid 30957:tid 30991] [client 4.232.83.105:19013] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "ad-RVn5gwVEVXHfVSiqaOwAAAEI"]
[Wed Apr 15 21:23:35.294639 2026] [:error] [pid 30956:tid 30961] [client 4.232.83.105:14027] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "ad-RV0BGUpjaWntNYq2EMAAAAAE"]
[Wed Apr 15 21:23:35.835849 2026] [:error] [pid 37370:tid 37376] [client 4.232.83.105:36516] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "ad-RV3g-gnM2Ga0cGABlRQAAAQQ"]
[Wed Apr 15 21:23:36.325887 2026] [:error] [pid 37370:tid 37379] [client 4.232.83.105:14028] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "ad-RWHg-gnM2Ga0cGABlUAAAAQc"]
[Wed Apr 15 21:23:36.914536 2026] [:error] [pid 37370:tid 37392] [client 4.232.83.105:9351] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "ad-RWHg-gnM2Ga0cGABlWQAAARQ"]
[Wed Apr 15 21:23:37.500457 2026] [:error] [pid 30958:tid 31017] [client 4.232.83.105:17706] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "ad-RWceG3wSKTO7NWFG8WAAAAME"]
[Wed Apr 15 21:23:38.589201 2026] [:error] [pid 37370:tid 37380] [client 4.232.83.105:16069] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "ad-RWng-gnM2Ga0cGABlbwAAAQg"]
[Wed Apr 15 21:23:41.163746 2026] [:error] [pid 31053:tid 31070] [client 4.232.83.105:17253] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "ad-RXRcEkLCmvF0fjDfxwgAAAI4"]
[Wed Apr 15 21:23:42.032029 2026] [:error] [pid 37370:tid 37389] [client 4.232.83.105:33177] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "ad-RXng-gnM2Ga0cGABlnwAAARE"]
[Wed Apr 15 21:23:42.559527 2026] [:error] [pid 31053:tid 31072] [client 4.232.83.105:33191] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "ad-RXhcEkLCmvF0fjDfxxQAAAJA"]
[Wed Apr 15 21:23:43.062995 2026] [:error] [pid 31053:tid 31079] [client 4.232.83.105:18737] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "ad-RXxcEkLCmvF0fjDfxzAAAAJc"]
[Wed Apr 15 21:23:43.636342 2026] [:error] [pid 30958:tid 31023] [client 4.232.83.105:33209] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "ad-RX8eG3wSKTO7NWFG8kQAAAMc"]
[Wed Apr 15 21:23:44.246200 2026] [:error] [pid 30958:tid 31040] [client 4.232.83.105:63833] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "ad-RYMeG3wSKTO7NWFG8mQAAANg"]
[Wed Apr 15 21:23:44.771048 2026] [:error] [pid 30958:tid 31035] [client 4.232.83.105:11255] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "ad-RYMeG3wSKTO7NWFG8pgAAANM"]
[Wed Apr 15 21:23:45.712570 2026] [:error] [pid 30957:tid 30994] [client 4.232.83.105:8661] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "ad-RYX5gwVEVXHfVSiqacgAAAEU"]
[Wed Apr 15 21:23:46.547690 2026] [:error] [pid 30958:tid 31029] [client 4.232.83.105:11202] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "ad-RYseG3wSKTO7NWFG8vAAAAM0"]
[Wed Apr 15 21:23:47.979207 2026] [:error] [pid 30958:tid 31029] [client 4.232.83.105:19490] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "ad-RY8eG3wSKTO7NWFG8ygAAAM0"]
[Wed Apr 15 21:23:49.763278 2026] [:error] [pid 30956:tid 30965] [client 4.232.83.105:20868] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "ad-RZUBGUpjaWntNYq2EWAAAAAU"]
[Wed Apr 15 21:23:50.968697 2026] [:error] [pid 37370:tid 37389] [client 4.232.83.105:31985] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "ad-RZng-gnM2Ga0cGABl_wAAARE"]
[Wed Apr 15 21:23:51.529838 2026] [:error] [pid 37370:tid 37379] [client 4.232.83.105:15566] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "ad-RZ3g-gnM2Ga0cGABmAwAAAQc"]
[Wed Apr 15 21:23:52.186943 2026] [:error] [pid 37370:tid 37373] [client 4.232.83.105:18349] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "ad-RaHg-gnM2Ga0cGABmCgAAAQE"]
[Wed Apr 15 21:23:53.290860 2026] [:error] [pid 30958:tid 31019] [client 4.232.83.105:8618] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "ad-RaceG3wSKTO7NWFG86gAAAMM"]
[Wed Apr 15 21:23:54.276654 2026] [:error] [pid 37370:tid 37386] [client 4.232.83.105:42410] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "ad-Rang-gnM2Ga0cGABmHQAAAQ4"]
[Wed Apr 15 21:23:55.156987 2026] [:error] [pid 37370:tid 37393] [client 4.232.83.105:11982] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "ad-Ra3g-gnM2Ga0cGABmKAAAARU"]
[Wed Apr 15 21:23:57.512184 2026] [:error] [pid 31053:tid 31068] [client 4.232.83.105:20419] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "ad-RbRcEkLCmvF0fjDfx_AAAAIw"]
[Wed Apr 15 21:24:01.048820 2026] [:error] [pid 30956:tid 30967] [client 4.232.83.105:52754] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "ad-RcUBGUpjaWntNYq2EcwAAAAc"]
[Wed Apr 15 21:24:02.337308 2026] [:error] [pid 31053:tid 31066] [client 4.232.83.105:40148] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/yw5bi63u.php"] [unique_id "ad-RchcEkLCmvF0fjDfyEgAAAIo"]
[Wed Apr 15 21:24:03.498194 2026] [:error] [pid 30956:tid 30966] [client 4.232.83.105:8623] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/yw5bi63u.php"] [unique_id "ad-Rc0BGUpjaWntNYq2EfQAAAAY"]
[Wed Apr 15 21:24:04.231394 2026] [:error] [pid 31053:tid 31069] [client 4.232.83.105:11997] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/yw5bi63u.php"] [unique_id "ad-RdBcEkLCmvF0fjDfyGAAAAI0"]
[Wed Apr 15 21:24:05.089804 2026] [:error] [pid 30958:tid 31028] [client 4.232.83.105:20432] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/yw5bi63u.php"] [unique_id "ad-RdceG3wSKTO7NWFG9GQAAAMw"]
[Wed Apr 15 21:24:05.677267 2026] [:error] [pid 30958:tid 31020] [client 4.232.83.105:8588] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "ad-RdceG3wSKTO7NWFG9HQAAAMQ"]
[Wed Apr 15 21:24:06.480859 2026] [:error] [pid 31053:tid 31068] [client 4.232.83.105:20897] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "ad-RdhcEkLCmvF0fjDfyIAAAAIw"]
[Wed Apr 15 21:24:06.997420 2026] [:error] [pid 30958:tid 31016] [client 4.232.83.105:52783] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "ad-RdseG3wSKTO7NWFG9JQAAAMA"]
[Wed Apr 15 21:24:08.317088 2026] [:error] [pid 37370:tid 37381] [client 4.232.83.105:20886] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "ad-ReHg-gnM2Ga0cGABmjwAAAQk"]
[Wed Apr 15 21:24:09.325896 2026] [:error] [pid 37370:tid 37382] [client 4.232.83.105:5988] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "ad-ReXg-gnM2Ga0cGABmkwAAAQo"]
[Wed Apr 15 21:24:10.065554 2026] [:error] [pid 37370:tid 37396] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Wed Apr 15 21:24:10.324662 2026] [:error] [pid 37370:tid 37384] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Wed Apr 15 21:24:10.562418 2026] [:error] [pid 37370:tid 37380] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/ws66.php
[Wed Apr 15 21:24:10.870483 2026] [:error] [pid 37370:tid 37378] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Wed Apr 15 21:24:11.107536 2026] [:error] [pid 37370:tid 37373] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Wed Apr 15 21:24:11.359642 2026] [:error] [pid 37370:tid 37381] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Wed Apr 15 21:24:11.729156 2026] [:error] [pid 37370:tid 37372] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Wed Apr 15 21:24:11.969854 2026] [:error] [pid 37370:tid 37375] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/set.php
[Wed Apr 15 21:24:12.206471 2026] [:error] [pid 37370:tid 37374] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/hroxw.php
[Wed Apr 15 21:24:12.446587 2026] [:error] [pid 37370:tid 37381] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Wed Apr 15 21:24:12.872045 2026] [:error] [pid 37370:tid 37380] [client 4.232.83.105:52799] File does not exist: /usr/local/apache/htdocs/suspended-page/zoo.php
[Wed Apr 15 21:24:13.162866 2026] [:error] [pid 37370:tid 37396] [client 4.232.83.105:52799] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gaza.php"] [unique_id "ad-RfXg-gnM2Ga0cGABmzwAAARg"]
[Wed Apr 15 21:24:14.063770 2026] [:error] [pid 31053:tid 31077] [client 4.232.83.105:11985] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gaza.php"] [unique_id "ad-RfhcEkLCmvF0fjDfyTQAAAJU"]
[Wed Apr 15 21:24:14.836935 2026] [:error] [pid 31053:tid 31057] [client 4.232.83.105:42388] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gaza.php"] [unique_id "ad-RfhcEkLCmvF0fjDfyUgAAAIE"]
[Wed Apr 15 21:24:15.426142 2026] [:error] [pid 37370:tid 37386] [client 4.232.83.105:36602] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gaza.php"] [unique_id "ad-Rf3g-gnM2Ga0cGABm5QAAAQ4"]
[Wed Apr 15 21:24:16.519986 2026] [:error] [pid 30957:tid 31002] [client 4.232.83.105:32610] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "ad-RgH5gwVEVXHfVSiqbAAAAAE0"]
[Wed Apr 15 21:24:19.079373 2026] [:error] [pid 31053:tid 31068] [client 4.232.83.105:20864] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "ad-RgxcEkLCmvF0fjDfybQAAAIw"]
[Wed Apr 15 21:24:20.750095 2026] [:error] [pid 37370:tid 37388] [client 4.232.83.105:20417] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "ad-RhHg-gnM2Ga0cGABnJwAAARA"]
[Wed Apr 15 21:24:21.738565 2026] [:error] [pid 37370:tid 37394] [client 4.232.83.105:12017] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "ad-RhXg-gnM2Ga0cGABnOgAAARY"]
[Wed Apr 15 21:24:22.617748 2026] [:error] [pid 37370:tid 37383] [client 4.232.83.105:40187] [client 4.232.83.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "ad-Rhng-gnM2Ga0cGABnRQAAAQs"]
[Wed Apr 15 21:24:23.246462 2026] [:error] [pid 30956:tid 30960] [client 4.232.83.105:20433] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "ad-Rh0BGUpjaWntNYq2ExAAAAAA"]
[Wed Apr 15 21:24:23.968973 2026] [:error] [pid 30957:tid 30996] [client 4.232.83.105:28666] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "ad-Rh35gwVEVXHfVSiqbKAAAAEc"]
[Wed Apr 15 21:24:24.906091 2026] [:error] [pid 30957:tid 31003] [client 4.232.83.105:10056] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "ad-RiH5gwVEVXHfVSiqbMAAAAE4"]
[Wed Apr 15 21:24:25.409940 2026] [:error] [pid 30956:tid 30983] [client 4.232.83.105:36571] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "ad-RiUBGUpjaWntNYq2EzwAAABc"]
[Wed Apr 15 21:24:26.091868 2026] [:error] [pid 30957:tid 31011] [client 4.232.83.105:5973] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "ad-Rin5gwVEVXHfVSiqbOwAAAFY"]
[Wed Apr 15 21:24:26.818354 2026] [:error] [pid 31053:tid 31074] [client 4.232.83.105:8616] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "ad-RihcEkLCmvF0fjDfyeQAAAJI"]
[Wed Apr 15 21:24:28.286050 2026] [:error] [pid 30957:tid 30989] [client 4.232.83.105:42368] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "ad-RjH5gwVEVXHfVSiqbUAAAAEA"]
[Wed Apr 15 21:24:29.177181 2026] [:error] [pid 30957:tid 31013] [client 4.232.83.105:52780] [client 4.232.83.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "ad-RjX5gwVEVXHfVSiqbXgAAAFg"]
[Thu Apr 16 02:40:41.015295 2026] [:error] [pid 20548:tid 20554] [client 172.68.193.205:11918] [client 172.68.193.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ad_bqakpqgnqCHq6bJbJwAAAAIM"]
[Thu Apr 16 02:40:42.910599 2026] [:error] [pid 54814:tid 54827] [client 172.71.172.190:14068] [client 172.71.172.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ad_bqjrHu_-tAAe-BOW8SwAAAYc"]
[Thu Apr 16 02:43:18.730400 2026] [:error] [pid 20548:tid 20562] [client 91.200.101.138:57975] [client 91.200.101.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/graphql"] [unique_id "ad_cRqkpqgnqCHq6bJbKugAAAIs"]
[Thu Apr 16 02:43:18.799464 2026] [:error] [pid 54814:tid 54841] [client 91.200.101.138:62070] [client 91.200.101.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/graphql"] [unique_id "ad_cRjrHu_-tAAe-BOW9nQAAAZU"]
[Thu Apr 16 03:50:24.963664 2026] [ssl:error] [pid 57639:tid 57660] [client 143.244.47.83:49084] AH02032: Hostname www.firstmortgageloans.com provided via SNI and hostname www.windfc.windfarmcoolants.com.au provided via HTTP have no compatible SSL setup
[Thu Apr 16 04:59:56.431170 2026] [:error] [pid 57538:tid 57620] [client 172.202.102.211:23616] [client 172.202.102.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ad_8TMuMaiEF5SVR2BcRfwAAAJI"], referer: https://mail.google.com/
[Thu Apr 16 05:49:07.194861 2026] [:error] [pid 49094:tid 49111] [client 57.151.128.210:20544] [client 57.151.128.210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aeAH0zbDwvcXorHR_Mx8QQAAAU8"]
[Thu Apr 16 07:47:55.136944 2026] [ssl:error] [pid 57538:tid 57611] [client 143.244.47.83:27749] AH02032: Hostname img1.wsimg.com provided via SNI and hostname windfc.windfarmcoolants.com.au provided via HTTP have no compatible SSL setup
[Thu Apr 16 07:59:57.650441 2026] [:error] [pid 57536:tid 57552] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Thu Apr 16 07:59:57.917917 2026] [:error] [pid 57536:tid 57559] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 16 07:59:58.180656 2026] [:error] [pid 57536:tid 57558] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 16 07:59:58.443292 2026] [:error] [pid 57536:tid 57560] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Thu Apr 16 08:00:00.062628 2026] [:error] [pid 57536:tid 57560] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Thu Apr 16 08:00:00.620407 2026] [:error] [pid 57536:tid 57550] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Thu Apr 16 08:00:00.887876 2026] [:error] [pid 57536:tid 57563] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Thu Apr 16 08:00:01.152017 2026] [:error] [pid 57536:tid 57570] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Apr 16 08:00:02.965999 2026] [:error] [pid 57536:tid 57570] [client 4.219.0.8:37350] File does not exist: /usr/local/apache/htdocs/suspended-page/admlo.php
[Thu Apr 16 08:00:03.225626 2026] [:error] [pid 57536:tid 57565] [client 4.219.0.8:37350] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "aeAmgyQU4faGja6jpDuQ7wAAABE"]
[Thu Apr 16 08:00:03.842879 2026] [:error] [pid 57537:tid 57583] [client 4.219.0.8:58706] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "aeAmg1VQRS8nm73ENAlGWAAAAEg"]
[Thu Apr 16 08:00:04.370517 2026] [:error] [pid 57538:tid 57625] [client 4.219.0.8:1226] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "aeAmhMuMaiEF5SVR2BdT9wAAAJc"]
[Thu Apr 16 08:00:05.017080 2026] [:error] [pid 57639:tid 57654] [client 4.219.0.8:9440] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "aeAmhaMCQoTw7TsxWunstQAAAMg"]
[Thu Apr 16 08:00:05.557362 2026] [:error] [pid 57639:tid 57667] [client 4.219.0.8:58802] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "aeAmhaMCQoTw7TsxWunsvAAAANU"]
[Thu Apr 16 08:00:06.093590 2026] [:error] [pid 57538:tid 57604] [client 4.219.0.8:32218] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "aeAmhsuMaiEF5SVR2BdT-QAAAII"]
[Thu Apr 16 08:00:06.712737 2026] [:error] [pid 29603:tid 29614] [client 4.219.0.8:21785] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "aeAmhlfGOR6fpTWUAzrtwAAAAQk"]
[Thu Apr 16 08:00:07.370315 2026] [:error] [pid 57536:tid 57555] [client 4.219.0.8:29499] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "aeAmhyQU4faGja6jpDuQ8gAAAAc"]
[Thu Apr 16 08:00:08.121497 2026] [:error] [pid 57639:tid 57646] [client 4.219.0.8:27674] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "aeAmiKMCQoTw7TsxWunszAAAAMA"]
[Thu Apr 16 08:00:08.785184 2026] [:error] [pid 57538:tid 57607] [client 4.219.0.8:17282] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "aeAmiMuMaiEF5SVR2BdT_gAAAIU"]
[Thu Apr 16 08:00:09.324549 2026] [:error] [pid 57537:tid 57580] [client 4.219.0.8:17336] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "aeAmiVVQRS8nm73ENAlGYQAAAEU"]
[Thu Apr 16 08:00:09.927908 2026] [:error] [pid 57639:tid 57662] [client 4.219.0.8:9668] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "aeAmiaMCQoTw7TsxWuns1AAAANA"]
[Thu Apr 16 08:00:10.709986 2026] [:error] [pid 57537:tid 57590] [client 4.219.0.8:9441] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "aeAmilVQRS8nm73ENAlGYwAAAE8"]
[Thu Apr 16 08:00:11.246870 2026] [:error] [pid 29603:tid 29612] [client 4.219.0.8:37320] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "aeAmi1fGOR6fpTWUAzrtxgAAAQc"]
[Thu Apr 16 08:00:11.823006 2026] [:error] [pid 57538:tid 57624] [client 4.219.0.8:58696] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "aeAmi8uMaiEF5SVR2BdUAgAAAJY"]
[Thu Apr 16 08:00:12.387514 2026] [:error] [pid 57639:tid 57649] [client 4.219.0.8:28822] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "aeAmjKMCQoTw7TsxWuns4QAAAMM"]
[Thu Apr 16 08:00:12.959879 2026] [:error] [pid 57639:tid 57667] [client 4.219.0.8:9450] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeAmjKMCQoTw7TsxWuns5AAAANU"]
[Thu Apr 16 08:00:13.559779 2026] [:error] [pid 57639:tid 57648] [client 4.219.0.8:1901] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeAmjaMCQoTw7TsxWuns5gAAAMI"]
[Thu Apr 16 08:00:14.104488 2026] [:error] [pid 57538:tid 57610] [client 4.219.0.8:29451] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeAmjsuMaiEF5SVR2BdUBAAAAIg"]
[Thu Apr 16 08:00:14.651445 2026] [:error] [pid 49094:tid 49118] [client 4.219.0.8:26390] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeAmjjbDwvcXorHR_MzEZQAAAVY"]
[Thu Apr 16 08:00:15.242477 2026] [:error] [pid 57639:tid 57662] [client 4.219.0.8:26387] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeAmj6MCQoTw7TsxWuns6QAAANA"]
[Thu Apr 16 08:00:15.788985 2026] [:error] [pid 49094:tid 49104] [client 4.219.0.8:20247] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeAmjzbDwvcXorHR_MzEZgAAAUg"]
[Thu Apr 16 08:00:16.434456 2026] [:error] [pid 29603:tid 29622] [client 4.219.0.8:20267] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeAmkFfGOR6fpTWUAzrtywAAARE"]
[Thu Apr 16 08:00:17.004823 2026] [:error] [pid 49094:tid 49097] [client 4.219.0.8:17320] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeAmkTbDwvcXorHR_MzEagAAAUE"]
[Thu Apr 16 08:00:17.600042 2026] [:error] [pid 49094:tid 49117] [client 4.219.0.8:29482] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeAmkTbDwvcXorHR_MzEbgAAAVU"]
[Thu Apr 16 08:00:18.126989 2026] [:error] [pid 49094:tid 49110] [client 4.219.0.8:29461] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeAmkjbDwvcXorHR_MzEcAAAAU4"]
[Thu Apr 16 08:00:18.691569 2026] [:error] [pid 29603:tid 29616] [client 4.219.0.8:9436] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeAmklfGOR6fpTWUAzrtzwAAAQs"]
[Thu Apr 16 08:00:19.234423 2026] [:error] [pid 49094:tid 49112] [client 4.219.0.8:17300] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeAmkzbDwvcXorHR_MzEcgAAAVA"]
[Thu Apr 16 08:00:19.805813 2026] [:error] [pid 49094:tid 49098] [client 4.219.0.8:10528] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "aeAmkzbDwvcXorHR_MzEcwAAAUI"]
[Thu Apr 16 08:00:20.332442 2026] [:error] [pid 29603:tid 29614] [client 4.219.0.8:9283] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "aeAmlFfGOR6fpTWUAzrt0AAAAQk"]
[Thu Apr 16 08:00:20.950131 2026] [:error] [pid 57537:tid 57583] [client 4.219.0.8:27680] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "aeAmlFVQRS8nm73ENAlGaQAAAEg"]
[Thu Apr 16 08:00:21.480155 2026] [:error] [pid 57639:tid 57666] [client 4.219.0.8:14703] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tool.php"] [unique_id "aeAmlaMCQoTw7TsxWuns9wAAANQ"]
[Thu Apr 16 08:00:22.036577 2026] [:error] [pid 57537:tid 57589] [client 4.219.0.8:37324] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "aeAmllVQRS8nm73ENAlGawAAAE4"]
[Thu Apr 16 08:00:22.614935 2026] [:error] [pid 57537:tid 57586] [client 4.219.0.8:1904] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "aeAmllVQRS8nm73ENAlGbwAAAEs"]
[Thu Apr 16 08:00:23.148626 2026] [:error] [pid 29603:tid 29613] [client 4.219.0.8:37351] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "aeAml1fGOR6fpTWUAzrt2gAAAQg"]
[Thu Apr 16 08:00:23.797189 2026] [:error] [pid 57536:tid 57563] [client 4.219.0.8:34989] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blogs.php"] [unique_id "aeAmlyQU4faGja6jpDuQ_QAAAA8"]
[Thu Apr 16 08:00:24.380378 2026] [:error] [pid 57536:tid 57565] [client 4.219.0.8:19252] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aeAmmCQU4faGja6jpDuQ_wAAABE"]
[Thu Apr 16 08:00:24.999168 2026] [:error] [pid 57536:tid 57567] [client 4.219.0.8:26425] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aeAmmCQU4faGja6jpDuRAQAAABM"]
[Thu Apr 16 08:00:25.523291 2026] [:error] [pid 57538:tid 57611] [client 4.219.0.8:29444] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aeAmmcuMaiEF5SVR2BdUDwAAAIk"]
[Thu Apr 16 08:00:26.072199 2026] [:error] [pid 57536:tid 57564] [client 4.219.0.8:19208] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aeAmmiQU4faGja6jpDuRBAAAABA"]
[Thu Apr 16 08:00:26.610751 2026] [:error] [pid 49094:tid 49104] [client 4.219.0.8:50096] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "aeAmmjbDwvcXorHR_MzEdgAAAUg"]
[Thu Apr 16 08:00:27.146329 2026] [:error] [pid 29603:tid 29615] [client 4.219.0.8:29446] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "aeAmm1fGOR6fpTWUAzrt4gAAAQo"]
[Thu Apr 16 08:00:27.666173 2026] [:error] [pid 57537:tid 57582] [client 4.219.0.8:37368] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "aeAmm1VQRS8nm73ENAlGhQAAAEc"]
[Thu Apr 16 08:00:28.220975 2026] [:error] [pid 49094:tid 49107] [client 4.219.0.8:10503] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "aeAmnDbDwvcXorHR_MzEeAAAAUs"]
[Thu Apr 16 08:00:28.828027 2026] [:error] [pid 49094:tid 49119] [client 4.219.0.8:21822] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aeAmnDbDwvcXorHR_MzEeQAAAVc"]
[Thu Apr 16 08:00:29.380567 2026] [:error] [pid 29603:tid 29609] [client 4.219.0.8:17339] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aeAmnVfGOR6fpTWUAzrt6QAAAQQ"]
[Thu Apr 16 08:00:29.912005 2026] [:error] [pid 57536:tid 57556] [client 4.219.0.8:19200] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aeAmnSQU4faGja6jpDuRBgAAAAg"]
[Thu Apr 16 08:00:30.438978 2026] [:error] [pid 49094:tid 49106] [client 4.219.0.8:17297] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aeAmnjbDwvcXorHR_MzEfAAAAUo"]
[Thu Apr 16 08:00:30.985243 2026] [:error] [pid 57536:tid 57551] [client 4.219.0.8:9229] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aeAmniQU4faGja6jpDuRBwAAAAM"]
[Thu Apr 16 08:00:31.505010 2026] [:error] [pid 57538:tid 57602] [client 4.219.0.8:48466] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aeAmn8uMaiEF5SVR2BdUFAAAAIA"]
[Thu Apr 16 08:00:32.195510 2026] [:error] [pid 57536:tid 57559] [client 4.219.0.8:17878] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aeAmoCQU4faGja6jpDuRCQAAAAs"]
[Thu Apr 16 08:00:32.802610 2026] [:error] [pid 57536:tid 57548] [client 4.219.0.8:19237] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aeAmoCQU4faGja6jpDuRCwAAAAA"]
[Thu Apr 16 08:00:33.370754 2026] [:error] [pid 29603:tid 29614] [client 4.219.0.8:19216] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "aeAmoVfGOR6fpTWUAzrt7wAAAQk"]
[Thu Apr 16 08:00:33.918022 2026] [:error] [pid 57538:tid 57605] [client 4.219.0.8:17910] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "aeAmocuMaiEF5SVR2BdUFQAAAIM"]
[Thu Apr 16 08:00:34.482113 2026] [:error] [pid 49094:tid 49118] [client 4.219.0.8:37317] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "aeAmojbDwvcXorHR_MzEhAAAAVY"]
[Thu Apr 16 08:00:35.020482 2026] [:error] [pid 57538:tid 57621] [client 4.219.0.8:19233] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms.php"] [unique_id "aeAmo8uMaiEF5SVR2BdUFwAAAJM"]
[Thu Apr 16 08:00:35.561260 2026] [:error] [pid 29603:tid 29622] [client 4.219.0.8:34949] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "aeAmo1fGOR6fpTWUAzrt-AAAARE"]
[Thu Apr 16 08:00:36.108211 2026] [:error] [pid 57639:tid 57670] [client 4.219.0.8:55197] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "aeAmpKMCQoTw7TsxWuntBgAAANg"]
[Thu Apr 16 08:00:36.652078 2026] [:error] [pid 29603:tid 29607] [client 4.219.0.8:55227] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "aeAmpFfGOR6fpTWUAzrt-QAAAQI"]
[Thu Apr 16 08:00:37.174202 2026] [:error] [pid 29603:tid 29606] [client 4.219.0.8:26412] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "aeAmpVfGOR6fpTWUAzrt-gAAAQE"]
[Thu Apr 16 08:00:37.775504 2026] [:error] [pid 57537:tid 57586] [client 4.219.0.8:50094] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bmi.php"] [unique_id "aeAmpVVQRS8nm73ENAlGsgAAAEs"]
[Thu Apr 16 08:00:38.316368 2026] [:error] [pid 57536:tid 57570] [client 4.219.0.8:50081] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bmi.php"] [unique_id "aeAmpiQU4faGja6jpDuRDwAAABY"]
[Thu Apr 16 08:00:38.888709 2026] [:error] [pid 57639:tid 57665] [client 4.219.0.8:57809] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bmi.php"] [unique_id "aeAmpqMCQoTw7TsxWuntCgAAANM"]
[Thu Apr 16 08:00:39.424735 2026] [:error] [pid 57639:tid 57650] [client 4.219.0.8:14190] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bmi.php"] [unique_id "aeAmp6MCQoTw7TsxWuntDAAAAMQ"]
[Thu Apr 16 08:00:39.980321 2026] [:error] [pid 57536:tid 57567] [client 4.219.0.8:21802] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aeAmpyQU4faGja6jpDuREgAAABM"]
[Thu Apr 16 08:00:40.508966 2026] [:error] [pid 57538:tid 57626] [client 4.219.0.8:26427] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aeAmqMuMaiEF5SVR2BdUHQAAAJg"]
[Thu Apr 16 08:00:41.035418 2026] [:error] [pid 57536:tid 57557] [client 4.219.0.8:14675] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aeAmqSQU4faGja6jpDuRFQAAAAk"]
[Thu Apr 16 08:00:41.566431 2026] [:error] [pid 57536:tid 57564] [client 4.219.0.8:14169] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aeAmqSQU4faGja6jpDuRFgAAABA"]
[Thu Apr 16 08:00:42.130649 2026] [:error] [pid 49094:tid 49112] [client 4.219.0.8:53274] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "aeAmqjbDwvcXorHR_MzEjAAAAVA"]
[Thu Apr 16 08:00:42.688301 2026] [:error] [pid 57639:tid 57661] [client 4.219.0.8:29471] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "aeAmqqMCQoTw7TsxWuntEgAAAM8"]
[Thu Apr 16 08:00:43.253482 2026] [:error] [pid 57639:tid 57660] [client 4.219.0.8:9223] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "aeAmq6MCQoTw7TsxWuntEwAAAM4"]
[Thu Apr 16 08:00:43.867601 2026] [:error] [pid 29603:tid 29620] [client 4.219.0.8:57847] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "aeAmq1fGOR6fpTWUAzruBgAAAQ8"]
[Thu Apr 16 08:00:44.393642 2026] [:error] [pid 49094:tid 49118] [client 4.219.0.8:29484] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "aeAmrDbDwvcXorHR_MzElQAAAVY"]
[Thu Apr 16 08:00:44.917171 2026] [:error] [pid 57639:tid 57647] [client 4.219.0.8:9233] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "aeAmrKMCQoTw7TsxWuntGAAAAME"]
[Thu Apr 16 08:00:45.486301 2026] [:error] [pid 57639:tid 57648] [client 4.219.0.8:58707] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "aeAmraMCQoTw7TsxWuntHAAAAMI"]
[Thu Apr 16 08:00:46.016120 2026] [:error] [pid 49094:tid 49105] [client 4.219.0.8:9222] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "aeAmrjbDwvcXorHR_MzEoQAAAUk"]
[Thu Apr 16 08:00:46.595124 2026] [:error] [pid 29603:tid 29626] [client 4.219.0.8:29474] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "aeAmrlfGOR6fpTWUAzruDAAAARU"]
[Thu Apr 16 08:00:47.139369 2026] [:error] [pid 57639:tid 57661] [client 4.219.0.8:26418] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "aeAmr6MCQoTw7TsxWuntIgAAAM8"]
[Thu Apr 16 08:00:47.670593 2026] [:error] [pid 57639:tid 57646] [client 4.219.0.8:17338] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "aeAmr6MCQoTw7TsxWuntJgAAAMA"]
[Thu Apr 16 08:00:48.192549 2026] [:error] [pid 49094:tid 49105] [client 4.219.0.8:29477] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "aeAmsDbDwvcXorHR_MzEtwAAAUk"]
[Thu Apr 16 08:00:48.750083 2026] [:error] [pid 57639:tid 57653] [client 4.219.0.8:48487] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "aeAmsKMCQoTw7TsxWuntLAAAAMc"]
[Thu Apr 16 08:00:49.290065 2026] [:error] [pid 57639:tid 57664] [client 4.219.0.8:53284] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "aeAmsaMCQoTw7TsxWuntMAAAANI"]
[Thu Apr 16 08:00:49.821886 2026] [:error] [pid 57639:tid 57661] [client 4.219.0.8:9338] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "aeAmsaMCQoTw7TsxWuntNQAAAM8"]
[Thu Apr 16 08:00:50.383462 2026] [:error] [pid 57639:tid 57652] [client 4.219.0.8:21818] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "aeAmsqMCQoTw7TsxWuntNwAAAMY"]
[Thu Apr 16 08:00:50.960125 2026] [:error] [pid 57536:tid 57558] [client 4.219.0.8:17871] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aeAmsiQU4faGja6jpDuRHAAAAAo"]
[Thu Apr 16 08:00:51.493853 2026] [:error] [pid 29603:tid 29625] [client 4.219.0.8:37312] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aeAms1fGOR6fpTWUAzruEAAAARQ"]
[Thu Apr 16 08:00:52.049568 2026] [:error] [pid 29603:tid 29605] [client 4.219.0.8:31708] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aeAmtFfGOR6fpTWUAzruEQAAAQA"]
[Thu Apr 16 08:00:52.577419 2026] [:error] [pid 57536:tid 57561] [client 4.219.0.8:55177] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aeAmtCQU4faGja6jpDuRHQAAAA0"]
[Thu Apr 16 08:00:53.177894 2026] [:error] [pid 57536:tid 57560] [client 4.219.0.8:53281] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s.php"] [unique_id "aeAmtSQU4faGja6jpDuRHgAAAAw"]
[Thu Apr 16 08:00:53.721560 2026] [:error] [pid 57538:tid 57617] [client 4.219.0.8:17912] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s.php"] [unique_id "aeAmtcuMaiEF5SVR2BdUIQAAAI8"]
[Thu Apr 16 08:00:54.256663 2026] [:error] [pid 49094:tid 49102] [client 4.219.0.8:2029] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s.php"] [unique_id "aeAmtjbDwvcXorHR_MzE5QAAAUY"]
[Thu Apr 16 08:00:54.798907 2026] [:error] [pid 49094:tid 49120] [client 4.219.0.8:55188] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s.php"] [unique_id "aeAmtjbDwvcXorHR_MzE6QAAAVg"]
[Thu Apr 16 08:00:55.347974 2026] [:error] [pid 49094:tid 49097] [client 4.219.0.8:26374] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/first.php"] [unique_id "aeAmtzbDwvcXorHR_MzE7QAAAUE"]
[Thu Apr 16 08:00:55.874309 2026] [:error] [pid 57639:tid 57654] [client 4.219.0.8:14688] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/first.php"] [unique_id "aeAmt6MCQoTw7TsxWuntSwAAAMg"]
[Thu Apr 16 08:00:56.419503 2026] [:error] [pid 49094:tid 49096] [client 4.219.0.8:1991] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/first.php"] [unique_id "aeAmuDbDwvcXorHR_MzE9gAAAUA"]
[Thu Apr 16 08:00:56.945887 2026] [:error] [pid 57537:tid 57588] [client 4.219.0.8:14156] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/first.php"] [unique_id "aeAmuFVQRS8nm73ENAlG6QAAAE0"]
[Thu Apr 16 08:00:57.547528 2026] [:error] [pid 49094:tid 49100] [client 4.219.0.8:29541] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aeAmuTbDwvcXorHR_MzE-gAAAUQ"]
[Thu Apr 16 08:00:58.069196 2026] [:error] [pid 49094:tid 49101] [client 4.219.0.8:58690] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aeAmujbDwvcXorHR_MzE_AAAAUU"]
[Thu Apr 16 08:00:58.588924 2026] [:error] [pid 29603:tid 29622] [client 4.219.0.8:50161] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aeAmulfGOR6fpTWUAzruGAAAARE"]
[Thu Apr 16 08:00:59.110485 2026] [:error] [pid 57537:tid 57586] [client 4.219.0.8:9226] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aeAmu1VQRS8nm73ENAlG7QAAAEs"]
[Thu Apr 16 08:00:59.639853 2026] [:error] [pid 57538:tid 57622] [client 4.219.0.8:2038] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeAmu8uMaiEF5SVR2BdUJAAAAJQ"]
[Thu Apr 16 08:01:00.183354 2026] [:error] [pid 57537:tid 57585] [client 4.219.0.8:25347] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeAmvFVQRS8nm73ENAlG7wAAAEo"]
[Thu Apr 16 08:01:00.731853 2026] [:error] [pid 57538:tid 57605] [client 4.219.0.8:14189] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeAmvMuMaiEF5SVR2BdUJQAAAIM"]
[Thu Apr 16 08:01:01.275530 2026] [:error] [pid 57536:tid 57570] [client 4.219.0.8:58739] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeAmvSQU4faGja6jpDuRIgAAABY"]
[Thu Apr 16 08:01:01.800027 2026] [:error] [pid 57639:tid 57662] [client 4.219.0.8:17906] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "aeAmvaMCQoTw7TsxWuntVgAAANA"]
[Thu Apr 16 08:01:02.371648 2026] [:error] [pid 57639:tid 57659] [client 4.219.0.8:15710] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Thu Apr 16 08:01:03.171847 2026] [:error] [pid 57639:tid 57665] [client 4.219.0.8:15710] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Thu Apr 16 08:01:03.707178 2026] [:error] [pid 57639:tid 57650] [client 4.219.0.8:15710] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Thu Apr 16 08:01:03.971798 2026] [:error] [pid 57639:tid 57653] [client 4.219.0.8:15710] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Thu Apr 16 08:01:04.235565 2026] [:error] [pid 57639:tid 57648] [client 4.219.0.8:15710] File does not exist: /usr/local/apache/htdocs/suspended-page/900.php
[Thu Apr 16 08:01:04.508695 2026] [:error] [pid 57639:tid 57667] [client 4.219.0.8:15710] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Thu Apr 16 08:01:04.772389 2026] [:error] [pid 57639:tid 57666] [client 4.219.0.8:15710] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Thu Apr 16 08:01:05.036059 2026] [:error] [pid 57639:tid 57657] [client 4.219.0.8:15710] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Thu Apr 16 08:01:05.296686 2026] [:error] [pid 57639:tid 57669] [client 4.219.0.8:15710] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aeAmwaMCQoTw7TsxWuntZwAAANc"]
[Thu Apr 16 08:01:05.814770 2026] [:error] [pid 57538:tid 57618] [client 4.219.0.8:9311] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aeAmwcuMaiEF5SVR2BdUKgAAAJA"]
[Thu Apr 16 08:01:06.371584 2026] [:error] [pid 57639:tid 57668] [client 4.219.0.8:25393] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aeAmwqMCQoTw7TsxWuntagAAANY"]
[Thu Apr 16 08:01:06.911103 2026] [:error] [pid 57639:tid 57659] [client 4.219.0.8:14206] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aeAmwqMCQoTw7TsxWuntbAAAAM0"]
[Thu Apr 16 08:01:07.445569 2026] [:error] [pid 29603:tid 29608] [client 4.219.0.8:9250] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "aeAmw1fGOR6fpTWUAzruHAAAAQM"]
[Thu Apr 16 08:01:07.971651 2026] [:error] [pid 57537:tid 57592] [client 4.219.0.8:9259] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "aeAmw1VQRS8nm73ENAlG9AAAAFE"]
[Thu Apr 16 08:01:08.497522 2026] [:error] [pid 57538:tid 57626] [client 4.219.0.8:50131] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "aeAmxMuMaiEF5SVR2BdUKwAAAJg"]
[Thu Apr 16 08:01:09.067456 2026] [:error] [pid 29603:tid 29627] [client 4.219.0.8:57804] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccs.php"] [unique_id "aeAmxVfGOR6fpTWUAzruIQAAARY"]
[Thu Apr 16 08:01:09.733342 2026] [:error] [pid 29603:tid 29615] [client 4.219.0.8:58748] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboutc.php"] [unique_id "aeAmxVfGOR6fpTWUAzruJgAAAQo"]
[Thu Apr 16 08:01:10.413172 2026] [:error] [pid 57538:tid 57617] [client 4.219.0.8:58704] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboutc.php"] [unique_id "aeAmxsuMaiEF5SVR2BdULgAAAI8"]
[Thu Apr 16 08:01:10.982105 2026] [:error] [pid 57536:tid 57549] [client 4.219.0.8:50071] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboutc.php"] [unique_id "aeAmxiQU4faGja6jpDuRJQAAAAE"]
[Thu Apr 16 08:01:11.627550 2026] [:error] [pid 49094:tid 49116] [client 4.219.0.8:29564] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboutc.php"] [unique_id "aeAmxzbDwvcXorHR_MzFFwAAAVQ"]
[Thu Apr 16 08:01:12.177964 2026] [:error] [pid 49094:tid 49109] [client 4.219.0.8:29507] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "aeAmyDbDwvcXorHR_MzFGwAAAU0"]
[Thu Apr 16 08:01:12.781406 2026] [:error] [pid 49094:tid 49119] [client 4.219.0.8:21788] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "aeAmyDbDwvcXorHR_MzFIwAAAVc"]
[Thu Apr 16 08:01:13.308119 2026] [:error] [pid 49094:tid 49118] [client 4.219.0.8:17289] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "aeAmyTbDwvcXorHR_MzFKgAAAVY"]
[Thu Apr 16 08:01:13.847887 2026] [:error] [pid 49094:tid 49110] [client 4.219.0.8:50048] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "aeAmyTbDwvcXorHR_MzFLgAAAU4"]
[Thu Apr 16 08:01:14.376695 2026] [:error] [pid 57538:tid 57606] [client 4.219.0.8:21816] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "aeAmysuMaiEF5SVR2BdUMAAAAIQ"]
[Thu Apr 16 08:01:14.983606 2026] [:error] [pid 29603:tid 29618] [client 4.219.0.8:14665] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "aeAmylfGOR6fpTWUAzruKgAAAQ0"]
[Thu Apr 16 08:01:15.539909 2026] [:error] [pid 57537:tid 57580] [client 4.219.0.8:25394] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "aeAmy1VQRS8nm73ENAlG_AAAAEU"]
[Thu Apr 16 08:01:16.078756 2026] [:error] [pid 57538:tid 57602] [client 4.219.0.8:55013] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "aeAmzMuMaiEF5SVR2BdUMgAAAIA"]
[Thu Apr 16 08:01:16.614099 2026] [:error] [pid 57639:tid 57662] [client 4.219.0.8:15709] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aeAmzKMCQoTw7TsxWunteQAAANA"]
[Thu Apr 16 08:01:17.145013 2026] [:error] [pid 57538:tid 57608] [client 4.219.0.8:48473] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aeAmzcuMaiEF5SVR2BdUMwAAAIY"]
[Thu Apr 16 08:01:17.673818 2026] [:error] [pid 49094:tid 49119] [client 4.219.0.8:15704] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aeAmzTbDwvcXorHR_MzFaAAAAVc"]
[Thu Apr 16 08:01:18.221527 2026] [:error] [pid 57537:tid 57586] [client 4.219.0.8:48459] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aeAmzlVQRS8nm73ENAlG_gAAAEs"]
[Thu Apr 16 08:01:18.749164 2026] [:error] [pid 57538:tid 57605] [client 4.219.0.8:48486] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws48.php"] [unique_id "aeAmzsuMaiEF5SVR2BdUNQAAAIM"]
[Thu Apr 16 08:01:19.268990 2026] [:error] [pid 49094:tid 49115] [client 4.219.0.8:48458] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws48.php"] [unique_id "aeAmzzbDwvcXorHR_MzFewAAAVM"]
[Thu Apr 16 08:01:19.810115 2026] [:error] [pid 49094:tid 49107] [client 4.219.0.8:21821] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws48.php"] [unique_id "aeAmzzbDwvcXorHR_MzFhAAAAUs"]
[Thu Apr 16 08:01:20.346113 2026] [:error] [pid 57536:tid 57560] [client 4.219.0.8:21791] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws48.php"] [unique_id "aeAm0CQU4faGja6jpDuRKwAAAAw"]
[Thu Apr 16 08:01:20.890823 2026] [:error] [pid 49094:tid 49108] [client 4.219.0.8:37356] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aeAm0DbDwvcXorHR_MzFlgAAAUw"]
[Thu Apr 16 08:01:21.433756 2026] [:error] [pid 49094:tid 49096] [client 4.219.0.8:14197] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aeAm0TbDwvcXorHR_MzFowAAAUA"]
[Thu Apr 16 08:01:21.971543 2026] [:error] [pid 57538:tid 57604] [client 4.219.0.8:57829] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aeAm0cuMaiEF5SVR2BdUNwAAAII"]
[Thu Apr 16 08:01:22.502464 2026] [:error] [pid 57639:tid 57663] [client 4.219.0.8:54988] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aeAm0qMCQoTw7TsxWuntggAAANE"]
[Thu Apr 16 08:01:23.026452 2026] [:error] [pid 57639:tid 57648] [client 4.219.0.8:9301] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeAm06MCQoTw7TsxWunthQAAAMI"]
[Thu Apr 16 08:01:23.567806 2026] [:error] [pid 57639:tid 57653] [client 4.219.0.8:9282] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeAm06MCQoTw7TsxWunthwAAAMc"]
[Thu Apr 16 08:01:24.121675 2026] [:error] [pid 57538:tid 57619] [client 4.219.0.8:53287] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeAm1MuMaiEF5SVR2BdUOQAAAJE"]
[Thu Apr 16 08:01:24.641022 2026] [:error] [pid 57537:tid 57591] [client 4.219.0.8:9261] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeAm1FVQRS8nm73ENAlHBAAAAFA"]
[Thu Apr 16 08:01:25.174841 2026] [:error] [pid 57639:tid 57655] [client 4.219.0.8:17888] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "aeAm1aMCQoTw7TsxWuntjAAAAMk"]
[Thu Apr 16 08:01:25.706904 2026] [:error] [pid 57536:tid 57553] [client 4.219.0.8:9236] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "aeAm1SQU4faGja6jpDuRLgAAAAU"]
[Thu Apr 16 08:01:26.254857 2026] [:error] [pid 57639:tid 57665] [client 4.219.0.8:14147] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "aeAm1qMCQoTw7TsxWuntkQAAANM"]
[Thu Apr 16 08:01:26.870492 2026] [:error] [pid 57639:tid 57648] [client 4.219.0.8:15743] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "aeAm1qMCQoTw7TsxWuntlQAAAMI"]
[Thu Apr 16 08:01:27.410729 2026] [:error] [pid 57639:tid 57651] [client 4.219.0.8:48475] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "aeAm16MCQoTw7TsxWuntmAAAAMU"]
[Thu Apr 16 08:01:27.992426 2026] [:error] [pid 57537:tid 57592] [client 4.219.0.8:14708] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "aeAm11VQRS8nm73ENAlHBQAAAFE"]
[Thu Apr 16 08:01:28.534389 2026] [:error] [pid 57537:tid 57599] [client 4.219.0.8:58733] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "aeAm2FVQRS8nm73ENAlHBwAAAFg"]
[Thu Apr 16 08:01:29.069689 2026] [:error] [pid 49094:tid 49105] [client 4.219.0.8:50084] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "aeAm2TbDwvcXorHR_MzF0gAAAUk"]
[Thu Apr 16 08:01:29.604482 2026] [:error] [pid 49094:tid 49103] [client 4.219.0.8:9321] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "aeAm2TbDwvcXorHR_MzF1AAAAUc"]
[Thu Apr 16 08:01:30.147241 2026] [:error] [pid 29603:tid 29624] [client 4.219.0.8:12621] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "aeAm2lfGOR6fpTWUAzruNQAAARM"]
[Thu Apr 16 08:01:30.706907 2026] [:error] [pid 57639:tid 57651] [client 4.219.0.8:50064] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "aeAm2qMCQoTw7TsxWunt4wAAAMU"]
[Thu Apr 16 08:01:31.246757 2026] [:error] [pid 57639:tid 57669] [client 4.219.0.8:29517] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "aeAm26MCQoTw7TsxWunt8AAAANc"]
[Thu Apr 16 08:01:31.789127 2026] [:error] [pid 57538:tid 57620] [client 4.219.0.8:15714] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeAm28uMaiEF5SVR2BdUUAAAAJI"]
[Thu Apr 16 08:01:32.377366 2026] [:error] [pid 49094:tid 49115] [client 4.219.0.8:29509] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeAm3DbDwvcXorHR_MzF3AAAAVM"]
[Thu Apr 16 08:01:32.932701 2026] [:error] [pid 29603:tid 29624] [client 4.219.0.8:44639] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeAm3FfGOR6fpTWUAzruewAAARM"]
[Thu Apr 16 08:01:33.493505 2026] [:error] [pid 57537:tid 57587] [client 4.219.0.8:14186] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeAm3VVQRS8nm73ENAlHDAAAAEw"]
[Thu Apr 16 08:01:34.240642 2026] [:error] [pid 29603:tid 29625] [client 4.219.0.8:54996] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeAm3lfGOR6fpTWUAzruigAAARQ"]
[Thu Apr 16 08:01:34.772983 2026] [:error] [pid 57538:tid 57624] [client 4.219.0.8:55024] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeAm3suMaiEF5SVR2BdUWQAAAJY"]
[Thu Apr 16 08:01:35.411299 2026] [:error] [pid 57538:tid 57610] [client 4.219.0.8:14193] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeAm38uMaiEF5SVR2BdUWwAAAIg"]
[Thu Apr 16 08:01:35.960062 2026] [:error] [pid 49094:tid 49108] [client 4.219.0.8:12640] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeAm3zbDwvcXorHR_MzF4QAAAUw"]
[Thu Apr 16 08:01:36.581739 2026] [:error] [pid 49094:tid 49120] [client 4.219.0.8:9241] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "aeAm4DbDwvcXorHR_MzF5AAAAVg"]
[Thu Apr 16 08:01:37.230901 2026] [:error] [pid 49094:tid 49109] [client 4.219.0.8:53297] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "aeAm4TbDwvcXorHR_MzF5wAAAU0"]
[Thu Apr 16 08:01:37.777906 2026] [:error] [pid 57639:tid 57646] [client 4.219.0.8:17884] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "aeAm4aMCQoTw7TsxWunuCgAAAMA"]
[Thu Apr 16 08:01:38.354755 2026] [:error] [pid 57538:tid 57623] [client 4.219.0.8:9305] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "aeAm4suMaiEF5SVR2BdUYQAAAJU"]
[Thu Apr 16 08:01:38.915996 2026] [:error] [pid 49094:tid 49113] [client 4.219.0.8:12612] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "aeAm4jbDwvcXorHR_MzF7QAAAVE"]
[Thu Apr 16 08:01:39.515813 2026] [:error] [pid 49094:tid 49097] [client 4.219.0.8:1858] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "aeAm4zbDwvcXorHR_MzF7wAAAUE"]
[Thu Apr 16 08:01:40.065810 2026] [:error] [pid 29603:tid 29623] [client 4.219.0.8:53277] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "aeAm5FfGOR6fpTWUAzrukwAAARI"]
[Thu Apr 16 08:01:40.636535 2026] [:error] [pid 57639:tid 57668] [client 4.219.0.8:9332] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "aeAm5KMCQoTw7TsxWunuDwAAANY"]
[Thu Apr 16 08:01:41.213563 2026] [:error] [pid 49094:tid 49118] [client 4.219.0.8:34997] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "aeAm5TbDwvcXorHR_MzF9AAAAVY"]
[Thu Apr 16 08:01:41.741088 2026] [:error] [pid 57639:tid 57648] [client 4.219.0.8:50132] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "aeAm5aMCQoTw7TsxWunuFgAAAMI"]
[Thu Apr 16 08:01:42.279886 2026] [:error] [pid 49094:tid 49119] [client 4.219.0.8:1846] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "aeAm5jbDwvcXorHR_MzF9gAAAVc"]
[Thu Apr 16 08:01:42.875128 2026] [:error] [pid 57538:tid 57626] [client 4.219.0.8:50157] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gifclass.php"] [unique_id "aeAm5suMaiEF5SVR2BdUZAAAAJg"]
[Thu Apr 16 08:01:43.512760 2026] [:error] [pid 49094:tid 49104] [client 4.219.0.8:1807] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aeAm5zbDwvcXorHR_MzF-AAAAUg"]
[Thu Apr 16 08:01:44.175390 2026] [:error] [pid 49094:tid 49105] [client 4.219.0.8:17895] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aeAm6DbDwvcXorHR_MzF-gAAAUk"]
[Thu Apr 16 08:01:44.769425 2026] [:error] [pid 49094:tid 49111] [client 4.219.0.8:1820] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aeAm6DbDwvcXorHR_MzF_QAAAU8"]
[Thu Apr 16 08:01:45.341109 2026] [:error] [pid 29603:tid 29625] [client 4.219.0.8:37372] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aeAm6VfGOR6fpTWUAzrumQAAARQ"]
[Thu Apr 16 08:01:45.878915 2026] [:error] [pid 57639:tid 57652] [client 4.219.0.8:57836] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "aeAm6aMCQoTw7TsxWunuIgAAAMY"]
[Thu Apr 16 08:01:46.415937 2026] [:error] [pid 29603:tid 29614] [client 4.219.0.8:48463] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "aeAm6lfGOR6fpTWUAzrumwAAAQk"]
[Thu Apr 16 08:01:47.205543 2026] [:error] [pid 57538:tid 57607] [client 4.219.0.8:17318] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "aeAm68uMaiEF5SVR2BdUZQAAAIU"]
[Thu Apr 16 08:01:47.771108 2026] [:error] [pid 57639:tid 57648] [client 4.219.0.8:29565] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/domains.php"] [unique_id "aeAm66MCQoTw7TsxWunuJwAAAMI"]
[Thu Apr 16 08:01:48.335446 2026] [:error] [pid 49094:tid 49103] [client 4.219.0.8:50092] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "aeAm7DbDwvcXorHR_MzGBwAAAUc"]
[Thu Apr 16 08:01:48.873370 2026] [:error] [pid 49094:tid 49107] [client 4.219.0.8:25360] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "aeAm7DbDwvcXorHR_MzGCgAAAUs"]
[Thu Apr 16 08:01:49.409165 2026] [:error] [pid 49094:tid 49114] [client 4.219.0.8:25349] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "aeAm7TbDwvcXorHR_MzGDwAAAVI"]
[Thu Apr 16 08:01:49.931984 2026] [:error] [pid 29603:tid 29611] [client 4.219.0.8:2010] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "aeAm7VfGOR6fpTWUAzruoQAAAQY"]
[Thu Apr 16 08:01:50.476430 2026] [:error] [pid 57537:tid 57596] [client 4.219.0.8:9264] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "aeAm7lVQRS8nm73ENAlHFQAAAFU"]
[Thu Apr 16 08:01:51.020966 2026] [:error] [pid 29603:tid 29618] [client 4.219.0.8:50054] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "aeAm71fGOR6fpTWUAzruowAAAQ0"]
[Thu Apr 16 08:01:51.544568 2026] [:error] [pid 29603:tid 29615] [client 4.219.0.8:15687] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "aeAm71fGOR6fpTWUAzrupAAAAQo"]
[Thu Apr 16 08:01:52.083081 2026] [:error] [pid 57536:tid 57560] [client 4.219.0.8:17907] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "aeAm8CQU4faGja6jpDuROwAAAAw"]
[Thu Apr 16 08:01:52.761972 2026] [:error] [pid 57536:tid 57553] [client 4.219.0.8:21793] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yw5bi63u.php"] [unique_id "aeAm8CQU4faGja6jpDuRPgAAAAU"]
[Thu Apr 16 08:01:53.440431 2026] [:error] [pid 57536:tid 57571] [client 4.219.0.8:50068] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yw5bi63u.php"] [unique_id "aeAm8SQU4faGja6jpDuRQAAAABc"]
[Thu Apr 16 08:01:53.977232 2026] [:error] [pid 49094:tid 49116] [client 4.219.0.8:48491] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yw5bi63u.php"] [unique_id "aeAm8TbDwvcXorHR_MzGGQAAAVQ"]
[Thu Apr 16 08:01:54.518295 2026] [:error] [pid 29603:tid 29609] [client 4.219.0.8:2003] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yw5bi63u.php"] [unique_id "aeAm8lfGOR6fpTWUAzrupwAAAQQ"]
[Thu Apr 16 08:01:55.075176 2026] [:error] [pid 57537:tid 57594] [client 4.219.0.8:9275] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aeAm81VQRS8nm73ENAlHHQAAAFM"]
[Thu Apr 16 08:01:55.648824 2026] [:error] [pid 49094:tid 49107] [client 4.219.0.8:9216] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aeAm8zbDwvcXorHR_MzGHAAAAUs"]
[Thu Apr 16 08:01:56.194333 2026] [:error] [pid 57639:tid 57652] [client 4.219.0.8:50086] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aeAm9KMCQoTw7TsxWunuMQAAAMY"]
[Thu Apr 16 08:01:56.756413 2026] [:error] [pid 57639:tid 57664] [client 4.219.0.8:48476] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aeAm9KMCQoTw7TsxWunuMgAAANI"]
[Thu Apr 16 08:01:57.311542 2026] [:error] [pid 49094:tid 49105] [client 4.219.0.8:29522] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aeAm9TbDwvcXorHR_MzGHQAAAUk"]
[Thu Apr 16 08:01:57.985802 2026] [:error] [pid 49094:tid 49099] [client 4.219.0.8:55002] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aeAm9TbDwvcXorHR_MzGHwAAAUM"]
[Thu Apr 16 08:01:58.581811 2026] [:error] [pid 49094:tid 49111] [client 4.219.0.8:14178] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aeAm9jbDwvcXorHR_MzGIgAAAU8"]
[Thu Apr 16 08:01:59.314109 2026] [:error] [pid 57639:tid 57665] [client 4.219.0.8:48497] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aeAm96MCQoTw7TsxWunuOQAAANM"]
[Thu Apr 16 08:01:59.840885 2026] [:error] [pid 57639:tid 57657] [client 4.219.0.8:57818] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeAm96MCQoTw7TsxWunuOwAAAMs"]
[Thu Apr 16 08:02:00.360663 2026] [:error] [pid 29603:tid 29629] [client 4.219.0.8:50160] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeAm-FfGOR6fpTWUAzrurAAAARg"]
[Thu Apr 16 08:02:00.915336 2026] [:error] [pid 57639:tid 57655] [client 4.219.0.8:50122] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeAm-KMCQoTw7TsxWunuPQAAAMk"]
[Thu Apr 16 08:02:01.632514 2026] [:error] [pid 49094:tid 49097] [client 4.219.0.8:50090] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeAm-TbDwvcXorHR_MzGJgAAAUE"]
[Thu Apr 16 08:02:02.196622 2026] [:error] [pid 49094:tid 49102] [client 4.219.0.8:44630] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aeAm-jbDwvcXorHR_MzGKAAAAUY"]
[Thu Apr 16 08:02:02.834481 2026] [:error] [pid 29603:tid 29611] [client 4.219.0.8:12639] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aeAm-lfGOR6fpTWUAzrusAAAAQY"]
[Thu Apr 16 08:02:03.437996 2026] [:error] [pid 57538:tid 57603] [client 4.219.0.8:23915] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aeAm-8uMaiEF5SVR2BdUvgAAAIE"]
[Thu Apr 16 08:02:03.978599 2026] [:error] [pid 57639:tid 57662] [client 4.219.0.8:23874] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aeAm-6MCQoTw7TsxWunuQwAAANA"]
[Thu Apr 16 08:02:04.529531 2026] [:error] [pid 49094:tid 49103] [client 4.219.0.8:48492] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "aeAm_DbDwvcXorHR_MzGLwAAAUc"]
[Thu Apr 16 08:02:05.072361 2026] [:error] [pid 57639:tid 57666] [client 4.219.0.8:17862] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Thu Apr 16 08:02:05.334735 2026] [:error] [pid 57639:tid 57663] [client 4.219.0.8:17862] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Thu Apr 16 08:02:05.597069 2026] [:error] [pid 57639:tid 57657] [client 4.219.0.8:17862] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Thu Apr 16 08:02:05.859996 2026] [:error] [pid 57639:tid 57658] [client 4.219.0.8:17862] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Thu Apr 16 08:02:06.122949 2026] [:error] [pid 57639:tid 57661] [client 4.219.0.8:17862] File does not exist: /usr/local/apache/htdocs/suspended-page/set.php
[Thu Apr 16 08:02:06.393591 2026] [:error] [pid 57639:tid 57646] [client 4.219.0.8:17862] File does not exist: /usr/local/apache/htdocs/suspended-page/hroxw.php
[Thu Apr 16 08:02:06.655792 2026] [:error] [pid 57639:tid 57654] [client 4.219.0.8:17862] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ok.php"] [unique_id "aeAm_qMCQoTw7TsxWunuVQAAAMg"]
[Thu Apr 16 08:02:07.193842 2026] [:error] [pid 29603:tid 29620] [client 4.219.0.8:9228] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ok.php"] [unique_id "aeAm_1fGOR6fpTWUAzruswAAAQ8"]
[Thu Apr 16 08:02:07.776514 2026] [:error] [pid 29603:tid 29625] [client 4.219.0.8:33789] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ok.php"] [unique_id "aeAm_1fGOR6fpTWUAzrutwAAARQ"]
[Thu Apr 16 08:02:08.298079 2026] [:error] [pid 57639:tid 57668] [client 4.219.0.8:29560] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ok.php"] [unique_id "aeAnAKMCQoTw7TsxWunuWAAAANY"]
[Thu Apr 16 08:02:08.854074 2026] [:error] [pid 57639:tid 57666] [client 4.219.0.8:2007] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoo.php"] [unique_id "aeAnAKMCQoTw7TsxWunuWgAAANQ"]
[Thu Apr 16 08:02:09.405644 2026] [:error] [pid 57639:tid 57669] [client 4.219.0.8:1902] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoo.php"] [unique_id "aeAnAaMCQoTw7TsxWunuXQAAANc"]
[Thu Apr 16 08:02:09.962056 2026] [:error] [pid 57639:tid 57657] [client 4.219.0.8:10532] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoo.php"] [unique_id "aeAnAaMCQoTw7TsxWunuYAAAAMs"]
[Thu Apr 16 08:02:10.556773 2026] [:error] [pid 57639:tid 57658] [client 4.219.0.8:2023] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoo.php"] [unique_id "aeAnAqMCQoTw7TsxWunuYgAAAMw"]
[Thu Apr 16 08:02:11.087935 2026] [:error] [pid 49094:tid 49100] [client 4.219.0.8:17288] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gaza.php"] [unique_id "aeAnAzbDwvcXorHR_MzGNgAAAUQ"]
[Thu Apr 16 08:02:11.629413 2026] [:error] [pid 49094:tid 49097] [client 4.219.0.8:35661] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gaza.php"] [unique_id "aeAnAzbDwvcXorHR_MzGOAAAAUE"]
[Thu Apr 16 08:02:12.164162 2026] [:error] [pid 57639:tid 57654] [client 4.219.0.8:2024] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gaza.php"] [unique_id "aeAnBKMCQoTw7TsxWunuZgAAAMg"]
[Thu Apr 16 08:02:12.730106 2026] [:error] [pid 57639:tid 57656] [client 4.219.0.8:33759] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gaza.php"] [unique_id "aeAnBKMCQoTw7TsxWunuaQAAAMo"]
[Thu Apr 16 08:02:13.253823 2026] [:error] [pid 57639:tid 57663] [client 4.219.0.8:33733] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "aeAnBaMCQoTw7TsxWunubgAAANE"]
[Thu Apr 16 08:02:13.794526 2026] [:error] [pid 57639:tid 57653] [client 4.219.0.8:60409] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "aeAnBaMCQoTw7TsxWunubwAAAMc"]
[Thu Apr 16 08:02:14.327121 2026] [:error] [pid 57639:tid 57647] [client 4.219.0.8:48493] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "aeAnBqMCQoTw7TsxWunucAAAAME"]
[Thu Apr 16 08:02:14.964983 2026] [:error] [pid 57639:tid 57667] [client 4.219.0.8:48500] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "aeAnBqMCQoTw7TsxWunucwAAANU"]
[Thu Apr 16 08:02:15.521781 2026] [:error] [pid 57536:tid 57568] [client 4.219.0.8:12620] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "aeAnByQU4faGja6jpDuRRQAAABQ"]
[Thu Apr 16 08:02:16.077067 2026] [:error] [pid 49094:tid 49098] [client 4.219.0.8:57827] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "aeAnCDbDwvcXorHR_MzGQAAAAUI"]
[Thu Apr 16 08:02:16.602307 2026] [:error] [pid 57536:tid 57555] [client 4.219.0.8:15700] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "aeAnCCQU4faGja6jpDuRRwAAAAc"]
[Thu Apr 16 08:02:17.202527 2026] [:error] [pid 57536:tid 57554] [client 4.219.0.8:23914] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "aeAnCSQU4faGja6jpDuRSgAAAAY"]
[Thu Apr 16 08:02:17.747510 2026] [:error] [pid 57538:tid 57617] [client 4.219.0.8:57846] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "aeAnCcuMaiEF5SVR2BdUyAAAAI8"]
[Thu Apr 16 08:02:18.297431 2026] [:error] [pid 57639:tid 57663] [client 4.219.0.8:2040] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "aeAnCqMCQoTw7TsxWunuewAAANE"]
[Thu Apr 16 08:02:18.871068 2026] [:error] [pid 57538:tid 57608] [client 4.219.0.8:44627] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "aeAnCsuMaiEF5SVR2BdUywAAAIY"]
[Thu Apr 16 08:02:19.444731 2026] [:error] [pid 57639:tid 57653] [client 4.219.0.8:23912] [client 4.219.0.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "aeAnC6MCQoTw7TsxWunufAAAAMc"]
[Thu Apr 16 08:02:19.992120 2026] [:error] [pid 49094:tid 49096] [client 4.219.0.8:17890] [client 4.219.0.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aeAnCzbDwvcXorHR_MzGTgAAAUA"]
[Thu Apr 16 08:41:02.069292 2026] [:error] [pid 57639:tid 57668] [client 98.93.160.221:43284] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aeAwHqMCQoTw7TsxWukFUAAAANY"]
[Thu Apr 16 08:44:53.842040 2026] [:error] [pid 49094:tid 49114] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 16 08:44:53.878592 2026] [:error] [pid 49094:tid 49096] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 16 08:44:53.896697 2026] [:error] [pid 49094:tid 49111] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 16 08:44:53.914099 2026] [:error] [pid 49094:tid 49105] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 16 08:44:53.932024 2026] [:error] [pid 49094:tid 49112] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Apr 16 08:44:53.950387 2026] [:error] [pid 49094:tid 49106] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu Apr 16 08:44:53.987499 2026] [:error] [pid 49094:tid 49120] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu Apr 16 08:44:54.005210 2026] [:error] [pid 49094:tid 49118] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Thu Apr 16 08:44:54.023769 2026] [:error] [pid 49094:tid 49100] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Apr 16 08:44:54.042191 2026] [:error] [pid 49094:tid 49108] [client 20.193.52.210:2149] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 16 08:44:54.083050 2026] [:error] [pid 49094:tid 49101] [client 20.193.52.210:2149] [client 20.193.52.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aeAxBjbDwvcXorHR_MzYbQAAAUU"]
[Thu Apr 16 08:44:54.146850 2026] [:error] [pid 29603:tid 29624] [client 20.193.52.210:2498] [client 20.193.52.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aeAxBlfGOR6fpTWUAzr9bwAAARM"]
[Thu Apr 16 08:44:54.215685 2026] [:error] [pid 49094:tid 49113] [client 20.193.52.210:2512] [client 20.193.52.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aeAxBjbDwvcXorHR_MzYcAAAAVE"]
[Thu Apr 16 08:44:54.318331 2026] [:error] [pid 49094:tid 49098] [client 20.193.52.210:2124] [client 20.193.52.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aeAxBjbDwvcXorHR_MzYcQAAAUI"]
[Thu Apr 16 12:09:30.693317 2026] [:error] [pid 29603:tid 29610] [client 98.93.160.221:40234] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aeBg-lfGOR6fpTWUAzothwAAAQU"]
[Thu Apr 16 12:35:53.538069 2026] [:error] [pid 49094:tid 49115] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 16 12:35:53.660092 2026] [:error] [pid 49094:tid 49112] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 16 12:35:53.782053 2026] [:error] [pid 49094:tid 49111] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 16 12:35:53.905400 2026] [:error] [pid 49094:tid 49114] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 16 12:35:54.027449 2026] [:error] [pid 49094:tid 49113] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Apr 16 12:35:54.150189 2026] [:error] [pid 49094:tid 49097] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu Apr 16 12:35:54.426224 2026] [:error] [pid 49094:tid 49117] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu Apr 16 12:35:54.548137 2026] [:error] [pid 49094:tid 49106] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Thu Apr 16 12:35:54.678268 2026] [:error] [pid 49094:tid 49102] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Apr 16 12:35:54.801470 2026] [:error] [pid 49094:tid 49100] [client 104.208.112.233:1111] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 16 12:35:54.919574 2026] [:error] [pid 49094:tid 49116] [client 104.208.112.233:1111] [client 104.208.112.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aeBnKjbDwvcXorHR_MwgdAAAAVQ"]
[Thu Apr 16 12:35:55.446294 2026] [:error] [pid 7880:tid 7890] [client 104.208.112.233:2892] [client 104.208.112.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aeBnK6aezm4fSGc0yUIZvwAAAYU"]
[Thu Apr 16 12:35:55.947291 2026] [:error] [pid 29603:tid 29626] [client 104.208.112.233:1123] [client 104.208.112.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aeBnK1fGOR6fpTWUAzoyHwAAARU"]
[Thu Apr 16 12:35:56.434898 2026] [:error] [pid 7880:tid 7908] [client 104.208.112.233:1090] [client 104.208.112.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aeBnLKaezm4fSGc0yUIZwQAAAZc"]
[Thu Apr 16 16:43:42.375911 2026] [:error] [pid 57537:tid 57594] [client 82.29.236.173:55567] [client 82.29.236.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.development.local"] [unique_id "aeChPlVQRS8nm73ENAmMkwAAAFM"]
[Thu Apr 16 16:43:44.092005 2026] [:error] [pid 57639:tid 57647] [client 172.71.172.190:13644] [client 172.71.172.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "aeChQKMCQoTw7TsxWunhWgAAAME"]
[Thu Apr 16 16:43:46.985295 2026] [:error] [pid 57537:tid 57582] [client 104.23.239.32:13983] [client 104.23.239.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.dev"] [unique_id "aeChQlVQRS8nm73ENAmMlQAAAEc"]
[Thu Apr 16 16:43:47.377685 2026] [:error] [pid 57639:tid 57665] [client 172.71.164.195:13046] [client 172.71.164.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "aeChQ6MCQoTw7TsxWunhYQAAANM"]
[Thu Apr 16 16:43:50.534995 2026] [:error] [pid 57536:tid 57550] [client 172.68.193.205:12564] [client 172.68.193.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "aeChRiQU4faGja6jpDsSpwAAAAI"]
[Thu Apr 16 16:43:50.740962 2026] [:error] [pid 49094:tid 49097] [client 162.158.111.169:10288] [client 162.158.111.169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.save"] [unique_id "aeChRjbDwvcXorHR_MxPjQAAAUE"]
[Thu Apr 16 16:43:50.962504 2026] [:error] [pid 49094:tid 49104] [client 172.71.148.180:12900] [client 172.71.148.180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.production.local"] [unique_id "aeChRjbDwvcXorHR_MxPjwAAAUg"]
[Thu Apr 16 18:16:54.889740 2026] [:error] [pid 57538:tid 57606] [client 162.158.62.54:11305] [client 162.158.62.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.dev"] [unique_id "aeC3FsuMaiEF5SVR2Be3GQAAAIQ"]
[Thu Apr 16 18:16:55.875102 2026] [:error] [pid 57536:tid 57561] [client 46.202.224.199:56827] [client 46.202.224.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.save"] [unique_id "aeC3FyQU4faGja6jpDsu4gAAAA0"]
[Thu Apr 16 18:16:59.825714 2026] [:error] [pid 57538:tid 57603] [client 104.23.187.77:12846] [client 104.23.187.77] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "aeC3G8uMaiEF5SVR2Be3HgAAAIE"]
[Thu Apr 16 18:17:01.522210 2026] [:error] [pid 57536:tid 57556] [client 162.158.155.10:10276] [client 162.158.155.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "aeC3HSQU4faGja6jpDsu-wAAAAg"]
[Thu Apr 16 18:17:01.878909 2026] [:error] [pid 57639:tid 57654] [client 104.23.187.77:12853] [client 104.23.187.77] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.old"] [unique_id "aeC3HaMCQoTw7TsxWukYQwAAAMg"]
[Thu Apr 16 22:20:40.618915 2026] [:error] [pid 57537:tid 57595] [client 172.70.92.192:13281] [client 172.70.92.192] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "aeDwOFVQRS8nm73ENAnDdgAAAFQ"]
[Thu Apr 16 23:30:45.285561 2026] [:error] [pid 57639:tid 57658] [client 45.130.203.149:28441] [client 45.130.203.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "aeEApaMCQoTw7TsxWukVbQAAAMw"]
[Thu Apr 16 23:30:45.973084 2026] [:error] [pid 29603:tid 29611] [client 45.130.203.149:55283] [client 45.130.203.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "aeEApVfGOR6fpTWUAzq8BQAAAQY"]
[Fri Apr 17 00:24:20.623478 2026] [:error] [pid 43387:tid 43475] [client 34.168.59.108:52932] [client 34.168.59.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aeENNCBNsONqHxWTakUmigAAAJY"]
[Fri Apr 17 01:57:34.621463 2026] [:error] [pid 43482:tid 43498] [client 34.82.192.37:63300] [client 34.82.192.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.82.192.37, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aeEjDj9SZnuKxlHrct2tHQAAAM4"]
[Fri Apr 17 01:57:34.624022 2026] [:error] [pid 43482:tid 43498] [client 34.82.192.37:63300] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 17 01:57:34.800901 2026] [:error] [pid 43482:tid 43507] [client 34.82.192.37:63300] [client 34.82.192.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aeEjDj9SZnuKxlHrct2tHgAAANc"]
[Fri Apr 17 03:09:49.153489 2026] [:error] [pid 43385:tid 43406] [client 136.107.233.88:65473] [client 136.107.233.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.233.88, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aeEz_cnIxkJaUI8KNs45bAAAABE"]
[Fri Apr 17 03:09:49.156614 2026] [:error] [pid 43385:tid 43406] [client 136.107.233.88:65473] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 17 03:09:50.818005 2026] [:error] [pid 43385:tid 43399] [client 136.107.233.88:65473] [client 136.107.233.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "aeEz_snIxkJaUI8KNs45cAAAAAo"]
[Fri Apr 17 03:09:52.174756 2026] [:error] [pid 43386:tid 43434] [client 136.107.233.88:63983] [client 136.107.233.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "aeE0AO91GAVgUfhPVDH1AgAAAE4"]
[Fri Apr 17 03:09:53.363704 2026] [:error] [pid 43385:tid 43413] [client 136.107.233.88:55336] [client 136.107.233.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "aeE0AcnIxkJaUI8KNs45cgAAABc"]
[Fri Apr 17 06:04:13.398625 2026] [:error] [pid 9153:tid 9221] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Fri Apr 17 06:04:13.635522 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Fri Apr 17 06:04:14.159764 2026] [:error] [pid 9153:tid 9242] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/flox.php
[Fri Apr 17 06:04:14.404428 2026] [:error] [pid 9153:tid 9230] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/mff.php
[Fri Apr 17 06:04:15.313485 2026] [:error] [pid 9153:tid 9241] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Fri Apr 17 06:04:15.567057 2026] [:error] [pid 9153:tid 9223] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/filemanger2.php
[Fri Apr 17 06:04:15.810466 2026] [:error] [pid 9153:tid 9218] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 17 06:04:16.351838 2026] [:error] [pid 9153:tid 9227] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-vn1.php
[Fri Apr 17 06:04:16.588510 2026] [:error] [pid 9153:tid 9219] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Fri Apr 17 06:04:16.825371 2026] [:error] [pid 9153:tid 9228] [client 172.213.152.251:42334] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Fri Apr 17 06:04:17.068749 2026] [:error] [pid 9153:tid 9239] [client 172.213.152.251:42334] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "aeFc4eMHGxkTZX3c45cIAQAAAJU"]
[Fri Apr 17 06:04:18.542323 2026] [:error] [pid 9263:tid 9278] [client 172.213.152.251:58686] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "aeFc4hP68VyHNvj1e54FdQAAAM0"]
[Fri Apr 17 06:04:20.494859 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:38040] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "aeFc5EnQhUtMbw9EsgZ7QAAAAQY"]
[Fri Apr 17 06:04:21.889262 2026] [:error] [pid 9151:tid 9179] [client 172.213.152.251:38066] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "aeFc5chTVuRPkua22vShmQAAABI"]
[Fri Apr 17 06:04:23.714220 2026] [:error] [pid 9152:tid 9195] [client 172.213.152.251:26919] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeFc55JYca8I3TNCwIcWagAAAEU"]
[Fri Apr 17 06:04:24.749484 2026] [:error] [pid 9151:tid 9169] [client 172.213.152.251:25357] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeFc6MhTVuRPkua22vShmgAAAAg"]
[Fri Apr 17 06:04:27.835284 2026] [:error] [pid 9263:tid 9284] [client 172.213.152.251:26573] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeFc6xP68VyHNvj1e54FewAAANM"]
[Fri Apr 17 06:04:29.649673 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:21723] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeFc7UnQhUtMbw9EsgZ7UQAAARY"]
[Fri Apr 17 06:04:31.322168 2026] [:error] [pid 9153:tid 9242] [client 172.213.152.251:29452] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeFc7-MHGxkTZX3c45cIKgAAAJg"]
[Fri Apr 17 06:04:32.676795 2026] [:error] [pid 9152:tid 9206] [client 172.213.152.251:48640] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeFc8JJYca8I3TNCwIcWfAAAAFA"]
[Fri Apr 17 06:04:33.995886 2026] [:error] [pid 9152:tid 9194] [client 172.213.152.251:3144] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeFc8ZJYca8I3TNCwIcWfgAAAEQ"]
[Fri Apr 17 06:04:36.218815 2026] [:error] [pid 9263:tid 9283] [client 172.213.152.251:31092] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeFc9BP68VyHNvj1e54FjAAAANI"]
[Fri Apr 17 06:04:40.291681 2026] [:error] [pid 9151:tid 9162] [client 172.213.152.251:48688] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aeFc-MhTVuRPkua22vShzQAAAAE"]
[Fri Apr 17 06:04:44.113618 2026] [:error] [pid 51878:tid 51891] [client 172.213.152.251:60241] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aeFc_EnQhUtMbw9EsgZ7bwAAAQs"]
[Fri Apr 17 06:04:46.533099 2026] [:error] [pid 9152:tid 9193] [client 172.213.152.251:26613] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aeFc_pJYca8I3TNCwIcWzQAAAEM"]
[Fri Apr 17 06:04:48.815972 2026] [:error] [pid 9263:tid 9266] [client 172.213.152.251:48679] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aeFdABP68VyHNvj1e54FmwAAAME"]
[Fri Apr 17 06:04:51.256638 2026] [:error] [pid 9263:tid 9269] [client 172.213.152.251:3881] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aeFdAxP68VyHNvj1e54FogAAAMQ"]
[Fri Apr 17 06:04:53.169732 2026] [:error] [pid 9152:tid 9192] [client 172.213.152.251:36068] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aeFdBZJYca8I3TNCwIcW0AAAAEI"]
[Fri Apr 17 06:04:55.154372 2026] [:error] [pid 9263:tid 9280] [client 172.213.152.251:38509] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aeFdBxP68VyHNvj1e54FqwAAAM8"]
[Fri Apr 17 06:04:58.630801 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:33154] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aeFdChP68VyHNvj1e54FsAAAAMg"]
[Fri Apr 17 06:05:03.969426 2026] [:error] [pid 9152:tid 9196] [client 172.213.152.251:34591] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeFdD5JYca8I3TNCwIcW2wAAAEY"]
[Fri Apr 17 06:05:08.110578 2026] [:error] [pid 9153:tid 9220] [client 172.213.152.251:49568] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeFdFOMHGxkTZX3c45cI6QAAAII"]
[Fri Apr 17 06:05:09.643980 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:38497] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeFdFRP68VyHNvj1e54FuwAAAMs"]
[Fri Apr 17 06:05:10.552000 2026] [:error] [pid 9152:tid 9206] [client 172.213.152.251:29545] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeFdFpJYca8I3TNCwIcW8AAAAFA"]
[Fri Apr 17 06:05:11.709592 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:29536] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aeFdF0nQhUtMbw9EsgZ7ngAAAQw"]
[Fri Apr 17 06:05:12.594082 2026] [:error] [pid 9263:tid 9268] [client 172.213.152.251:39713] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aeFdGBP68VyHNvj1e54FwgAAAMM"]
[Fri Apr 17 06:05:13.875077 2026] [:error] [pid 9151:tid 9168] [client 172.213.152.251:38504] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aeFdGchTVuRPkua22vSiJwAAAAc"]
[Fri Apr 17 06:05:14.996326 2026] [:error] [pid 9151:tid 9161] [client 172.213.152.251:34565] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aeFdGshTVuRPkua22vSiKgAAAAA"]
[Fri Apr 17 06:05:16.264128 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/water.php
[Fri Apr 17 06:05:16.501147 2026] [:error] [pid 51878:tid 51881] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/ggb.php
[Fri Apr 17 06:05:16.737012 2026] [:error] [pid 51878:tid 51904] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Fri Apr 17 06:05:16.972957 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/wert.php
[Fri Apr 17 06:05:17.220577 2026] [:error] [pid 51878:tid 51895] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Fri Apr 17 06:05:17.483648 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Fri Apr 17 06:05:17.741525 2026] [:error] [pid 51878:tid 51889] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/oij98gy.php
[Fri Apr 17 06:05:17.986084 2026] [:error] [pid 51878:tid 51901] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Fri Apr 17 06:05:18.226162 2026] [:error] [pid 51878:tid 51897] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/turkshell.php
[Fri Apr 17 06:05:18.514942 2026] [:error] [pid 51878:tid 51899] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Fri Apr 17 06:05:18.750777 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:29534] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Fri Apr 17 06:05:18.985717 2026] [:error] [pid 51878:tid 51884] [client 172.213.152.251:29534] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "aeFdHknQhUtMbw9EsgZ7wwAAAQQ"]
[Fri Apr 17 06:05:21.134416 2026] [:error] [pid 9152:tid 9197] [client 172.213.152.251:58079] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "aeFdIZJYca8I3TNCwIcW-gAAAEc"]
[Fri Apr 17 06:05:22.358020 2026] [:error] [pid 9263:tid 9289] [client 172.213.152.251:42374] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "aeFdIhP68VyHNvj1e54F1AAAANg"]
[Fri Apr 17 06:05:23.805155 2026] [:error] [pid 9263:tid 9284] [client 172.213.152.251:39689] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "aeFdIxP68VyHNvj1e54F1wAAANM"]
[Fri Apr 17 06:05:25.651980 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:44214] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aeFdJUnQhUtMbw9EsgZ72gAAAQo"]
[Fri Apr 17 06:05:26.929339 2026] [:error] [pid 9153:tid 9237] [client 172.213.152.251:40509] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aeFdJuMHGxkTZX3c45cJCwAAAJM"]
[Fri Apr 17 06:05:28.731342 2026] [:error] [pid 9263:tid 9283] [client 172.213.152.251:21317] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aeFdKBP68VyHNvj1e54F3wAAANI"]
[Fri Apr 17 06:05:29.988906 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:28213] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aeFdKUnQhUtMbw9EsgZ77AAAAQY"]
[Fri Apr 17 06:05:31.758071 2026] [:error] [pid 9153:tid 9240] [client 172.213.152.251:4039] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "aeFdK-MHGxkTZX3c45cJEQAAAJY"]
[Fri Apr 17 06:05:36.113321 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:28220] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "aeFdMEnQhUtMbw9EsgZ7-gAAAQg"]
[Fri Apr 17 06:05:53.841027 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:3922] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "aeFdQUnQhUtMbw9EsgZ8LgAAAQo"]
[Fri Apr 17 06:05:55.438186 2026] [:error] [pid 9263:tid 9287] [client 172.213.152.251:35374] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "aeFdQxP68VyHNvj1e54GRgAAANY"]
[Fri Apr 17 06:05:57.828513 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:31762] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "aeFdReMHGxkTZX3c45cJQQAAAIs"]
[Fri Apr 17 06:06:00.916810 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:43262] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "aeFdSEnQhUtMbw9EsgZ8OwAAAQg"]
[Fri Apr 17 06:06:02.958335 2026] [:error] [pid 9263:tid 9277] [client 172.213.152.251:60153] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "aeFdShP68VyHNvj1e54GUgAAAMw"]
[Fri Apr 17 06:06:03.941399 2026] [:error] [pid 9152:tid 9190] [client 172.213.152.251:38303] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "aeFdS5JYca8I3TNCwIcXTAAAAEA"]
[Fri Apr 17 06:06:06.633503 2026] [:error] [pid 9153:tid 9224] [client 172.213.152.251:27578] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "aeFdTuMHGxkTZX3c45cJVQAAAIY"]
[Fri Apr 17 06:06:07.546575 2026] [:error] [pid 9153:tid 9233] [client 172.213.152.251:22436] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "aeFdT-MHGxkTZX3c45cJWgAAAI8"]
[Fri Apr 17 06:06:08.717263 2026] [:error] [pid 9151:tid 9169] [client 172.213.152.251:38293] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "aeFdUMhTVuRPkua22vSiZwAAAAg"]
[Fri Apr 17 06:06:11.738209 2026] [:error] [pid 9263:tid 9277] [client 172.213.152.251:3401] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "aeFdUxP68VyHNvj1e54GZAAAAMw"]
[Fri Apr 17 06:06:12.955401 2026] [:error] [pid 9263:tid 9289] [client 172.213.152.251:38811] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "aeFdVBP68VyHNvj1e54GaQAAANg"]
[Fri Apr 17 06:06:14.338671 2026] [:error] [pid 51878:tid 51899] [client 172.213.152.251:3265] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "aeFdVknQhUtMbw9EsgZ8UgAAARM"]
[Fri Apr 17 06:06:15.724055 2026] [:error] [pid 9263:tid 9286] [client 172.213.152.251:3431] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "aeFdVxP68VyHNvj1e54GcAAAANU"]
[Fri Apr 17 06:06:17.980294 2026] [:error] [pid 9263:tid 9279] [client 172.213.152.251:3320] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "aeFdWRP68VyHNvj1e54GewAAAM4"]
[Fri Apr 17 06:06:19.781988 2026] [:error] [pid 9152:tid 9196] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Fri Apr 17 06:06:20.018493 2026] [:error] [pid 9152:tid 9191] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Fri Apr 17 06:06:20.278883 2026] [:error] [pid 9152:tid 9204] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Fri Apr 17 06:06:20.526726 2026] [:error] [pid 9152:tid 9208] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Fri Apr 17 06:06:20.783080 2026] [:error] [pid 9152:tid 9209] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/.mopj.php
[Fri Apr 17 06:06:21.032873 2026] [:error] [pid 9152:tid 9194] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Apr 17 06:06:21.269722 2026] [:error] [pid 9152:tid 9206] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/nano.php
[Fri Apr 17 06:06:21.505600 2026] [:error] [pid 9152:tid 9205] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_S.php
[Fri Apr 17 06:06:21.741795 2026] [:error] [pid 9152:tid 9204] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Fri Apr 17 06:06:21.978935 2026] [:error] [pid 9152:tid 9197] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Fri Apr 17 06:06:22.218116 2026] [:error] [pid 9152:tid 9209] [client 172.213.152.251:27989] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Fri Apr 17 06:06:22.455811 2026] [:error] [pid 9152:tid 9195] [client 172.213.152.251:27989] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeFdXpJYca8I3TNCwIcXewAAAEU"]
[Fri Apr 17 06:06:24.216348 2026] [:error] [pid 9153:tid 9231] [client 172.213.152.251:33574] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeFdYOMHGxkTZX3c45cJcgAAAI0"]
[Fri Apr 17 06:06:25.397866 2026] [:error] [pid 9263:tid 9280] [client 172.213.152.251:24661] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeFdYRP68VyHNvj1e54GlAAAAM8"]
[Fri Apr 17 06:06:27.259556 2026] [:error] [pid 9151:tid 9185] [client 172.213.152.251:28004] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeFdY8hTVuRPkua22vSieAAAABg"]
[Fri Apr 17 06:06:29.934491 2026] [:error] [pid 9153:tid 9218] [client 172.213.152.251:23181] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aeFdZeMHGxkTZX3c45cJdwAAAIA"]
[Fri Apr 17 06:06:33.493813 2026] [:error] [pid 9263:tid 9267] [client 172.213.152.251:27994] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aeFdaRP68VyHNvj1e54GwwAAAMI"]
[Fri Apr 17 06:06:35.495006 2026] [:error] [pid 51878:tid 51884] [client 172.213.152.251:46028] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aeFda0nQhUtMbw9EsgZ88QAAAQQ"]
[Fri Apr 17 06:06:39.035599 2026] [:error] [pid 9153:tid 9220] [client 172.213.152.251:49061] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aeFdb-MHGxkTZX3c45cJhwAAAII"]
[Fri Apr 17 06:06:40.741048 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:41572] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aeFdcEnQhUtMbw9EsgZ9SgAAAQw"]
[Fri Apr 17 06:06:41.963629 2026] [:error] [pid 51878:tid 51900] [client 172.213.152.251:49604] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aeFdcUnQhUtMbw9EsgZ9WQAAARQ"]
[Fri Apr 17 06:06:43.455122 2026] [:error] [pid 9152:tid 9209] [client 172.213.152.251:43695] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aeFdc5JYca8I3TNCwIcXhgAAAFM"]
[Fri Apr 17 06:06:44.494136 2026] [:error] [pid 9151:tid 9170] [client 172.213.152.251:27603] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aeFddMhTVuRPkua22vSiiQAAAAk"]
[Fri Apr 17 06:06:45.246706 2026] [:error] [pid 9152:tid 9195] [client 172.213.152.251:39292] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aeFddZJYca8I3TNCwIcXigAAAEU"]
[Fri Apr 17 06:06:46.501074 2026] [:error] [pid 9152:tid 9192] [client 172.213.152.251:41556] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aeFddpJYca8I3TNCwIcXkQAAAEI"]
[Fri Apr 17 06:06:47.894878 2026] [:error] [pid 9153:tid 9232] [client 172.213.152.251:51569] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aeFdd-MHGxkTZX3c45cJogAAAI4"]
[Fri Apr 17 06:06:48.873050 2026] [:error] [pid 9152:tid 9199] [client 172.213.152.251:46839] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aeFdeJJYca8I3TNCwIcXmAAAAEk"]
[Fri Apr 17 06:06:51.397442 2026] [:error] [pid 9152:tid 9194] [client 172.213.152.251:39247] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeFde5JYca8I3TNCwIcXoAAAAEQ"]
[Fri Apr 17 06:06:53.132098 2026] [:error] [pid 9263:tid 9283] [client 172.213.152.251:64916] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeFdfRP68VyHNvj1e54HBgAAANI"]
[Fri Apr 17 06:06:55.383287 2026] [:error] [pid 9263:tid 9289] [client 172.213.152.251:26084] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeFdfxP68VyHNvj1e54HCgAAANg"]
[Fri Apr 17 06:06:57.805894 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:44245] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeFdgUnQhUtMbw9EsgZ9jQAAAQg"]
[Fri Apr 17 06:07:00.398199 2026] [:error] [pid 51878:tid 51901] [client 172.213.152.251:58335] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeFdhEnQhUtMbw9EsgZ9mAAAARU"]
[Fri Apr 17 06:07:02.844455 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:43704] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeFdhknQhUtMbw9EsgZ9qQAAAQA"]
[Fri Apr 17 06:07:05.661522 2026] [:error] [pid 9263:tid 9269] [client 172.213.152.251:31531] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeFdiRP68VyHNvj1e54HHwAAAMQ"]
[Fri Apr 17 06:07:08.052537 2026] [:error] [pid 9263:tid 9272] [client 172.213.152.251:54602] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeFdjBP68VyHNvj1e54HJQAAAMc"]
[Fri Apr 17 06:07:11.512477 2026] [:error] [pid 9151:tid 9177] [client 172.213.152.251:51558] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aeFdj8hTVuRPkua22vSiugAAABA"]
[Fri Apr 17 06:07:14.956451 2026] [:error] [pid 51878:tid 51889] [client 172.213.152.251:29816] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aeFdkknQhUtMbw9EsgZ9xgAAAQk"]
[Fri Apr 17 06:07:18.723371 2026] [:error] [pid 9152:tid 9193] [client 172.213.152.251:37720] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aeFdlpJYca8I3TNCwIcXvQAAAEM"]
[Fri Apr 17 06:07:23.185714 2026] [:error] [pid 9152:tid 9191] [client 172.213.152.251:54625] File does not exist: /usr/local/apache/htdocs/suspended-page/fine.php
[Fri Apr 17 06:07:25.358460 2026] [:error] [pid 9153:tid 9240] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/zample.php
[Fri Apr 17 06:07:25.740377 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Fri Apr 17 06:07:25.992165 2026] [:error] [pid 9153:tid 9232] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Fri Apr 17 06:07:26.231357 2026] [:error] [pid 9153:tid 9227] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Apr 17 06:07:26.485044 2026] [:error] [pid 9153:tid 9221] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Fri Apr 17 06:07:26.747229 2026] [:error] [pid 9153:tid 9223] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Fri Apr 17 06:07:27.001292 2026] [:error] [pid 9153:tid 9236] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Fri Apr 17 06:07:27.253475 2026] [:error] [pid 9153:tid 9241] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Fri Apr 17 06:07:27.490306 2026] [:error] [pid 9153:tid 9230] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Fri Apr 17 06:07:27.762998 2026] [:error] [pid 9153:tid 9235] [client 172.213.152.251:29781] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Fri Apr 17 06:07:27.995903 2026] [:error] [pid 9153:tid 9225] [client 172.213.152.251:29781] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "aeFdn-MHGxkTZX3c45cJ-QAAAIc"]
[Fri Apr 17 06:07:29.869729 2026] [:error] [pid 9153:tid 9232] [client 172.213.152.251:41232] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "aeFdoeMHGxkTZX3c45cJ_gAAAI4"]
[Fri Apr 17 06:07:32.469038 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:41276] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "aeFdpOMHGxkTZX3c45cKDwAAAIs"]
[Fri Apr 17 06:07:34.778091 2026] [:error] [pid 9152:tid 9193] [client 172.213.152.251:58692] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "aeFdppJYca8I3TNCwIcX0wAAAEM"]
[Fri Apr 17 06:07:36.920522 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:39911] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "aeFdqEnQhUtMbw9EsgZ-JQAAARY"]
[Fri Apr 17 06:07:40.539750 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:58712] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "aeFdrEnQhUtMbw9EsgZ-MAAAAQU"]
[Fri Apr 17 06:07:41.890540 2026] [:error] [pid 9151:tid 9178] [client 172.213.152.251:25001] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "aeFdrchTVuRPkua22vSi9QAAABE"]
[Fri Apr 17 06:07:43.552293 2026] [:error] [pid 9153:tid 9222] [client 172.213.152.251:30258] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "aeFdr-MHGxkTZX3c45cKLgAAAIQ"]
[Fri Apr 17 06:07:44.597035 2026] [:error] [pid 9153:tid 9225] [client 172.213.152.251:61486] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeFdsOMHGxkTZX3c45cKMQAAAIc"]
[Fri Apr 17 06:07:45.812705 2026] [:error] [pid 9151:tid 9161] [client 172.213.152.251:46430] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeFdschTVuRPkua22vSjAQAAAAA"]
[Fri Apr 17 06:07:47.354106 2026] [:error] [pid 9153:tid 9227] [client 172.213.152.251:29975] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeFds-MHGxkTZX3c45cKOQAAAIk"]
[Fri Apr 17 06:07:48.997768 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:34961] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeFdtEnQhUtMbw9EsgZ-TAAAAQo"]
[Fri Apr 17 06:07:52.699887 2026] [:error] [pid 9263:tid 9285] [client 172.213.152.251:25010] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aeFduBP68VyHNvj1e54HoAAAANQ"]
[Fri Apr 17 06:09:34.145671 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Fri Apr 17 06:09:34.426643 2026] [:error] [pid 51878:tid 51894] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Apr 17 06:09:38.447736 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Fri Apr 17 06:09:38.683057 2026] [:error] [pid 51878:tid 51883] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Apr 17 06:09:38.955089 2026] [:error] [pid 51878:tid 51904] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Apr 17 06:09:39.226685 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Apr 17 06:09:39.481642 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Apr 17 06:09:39.755579 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Apr 17 06:09:40.255717 2026] [:error] [pid 51878:tid 51901] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/bless4.php
[Fri Apr 17 06:09:40.494008 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:37329] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Fri Apr 17 06:09:40.741654 2026] [:error] [pid 51878:tid 51896] [client 172.213.152.251:37329] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "aeFeJEnQhUtMbw9EsgaARAAAARA"]
[Fri Apr 17 06:09:45.388446 2026] [:error] [pid 51878:tid 51897] [client 172.213.152.251:42394] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "aeFeKUnQhUtMbw9EsgaAUgAAARE"]
[Fri Apr 17 06:09:47.087233 2026] [:error] [pid 9153:tid 9239] [client 172.213.152.251:51610] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "aeFeK-MHGxkTZX3c45cLTgAAAJU"]
[Fri Apr 17 06:09:47.978985 2026] [:error] [pid 51878:tid 51891] [client 172.213.152.251:51606] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "aeFeK0nQhUtMbw9EsgaAVQAAAQs"]
[Fri Apr 17 06:09:49.380313 2026] [:error] [pid 9152:tid 9211] [client 172.213.152.251:21360] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plss3.php"] [unique_id "aeFeLZJYca8I3TNCwIcYeQAAAFU"]
[Fri Apr 17 06:09:51.280877 2026] [:error] [pid 9152:tid 9191] [client 172.213.152.251:42388] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plss3.php"] [unique_id "aeFeL5JYca8I3TNCwIcYfgAAAEE"]
[Fri Apr 17 06:09:53.896175 2026] [:error] [pid 9152:tid 9207] [client 172.213.152.251:40472] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plss3.php"] [unique_id "aeFeMZJYca8I3TNCwIcYiAAAAFE"]
[Fri Apr 17 06:09:56.060910 2026] [:error] [pid 9152:tid 9213] [client 172.213.152.251:58057] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plss3.php"] [unique_id "aeFeNJJYca8I3TNCwIcYkAAAAFc"]
[Fri Apr 17 06:09:58.579844 2026] [:error] [pid 9152:tid 9213] [client 172.213.152.251:37681] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "aeFeNpJYca8I3TNCwIcYogAAAFc"]
[Fri Apr 17 06:10:03.090329 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:26011] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "aeFeO0nQhUtMbw9EsgaAcQAAAQo"]
[Fri Apr 17 06:10:06.773101 2026] [:error] [pid 9153:tid 9225] [client 172.213.152.251:37669] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "aeFePuMHGxkTZX3c45cLlgAAAIc"]
[Fri Apr 17 06:10:10.788083 2026] [:error] [pid 9263:tid 9269] [client 172.213.152.251:4078] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "aeFeQhP68VyHNvj1e54IkwAAAMQ"]
[Fri Apr 17 06:10:16.466900 2026] [:error] [pid 9153:tid 9233] [client 172.213.152.251:32072] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeFeSOMHGxkTZX3c45cLygAAAI8"]
[Fri Apr 17 06:10:18.247107 2026] [:error] [pid 51878:tid 51903] [client 172.213.152.251:38501] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeFeSknQhUtMbw9EsgaAiwAAARc"]
[Fri Apr 17 06:10:20.317167 2026] [:error] [pid 51878:tid 51897] [client 172.213.152.251:32074] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeFeTEnQhUtMbw9EsgaAkQAAARE"]
[Fri Apr 17 06:10:23.887465 2026] [:error] [pid 51878:tid 51882] [client 172.213.152.251:23247] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeFeT0nQhUtMbw9EsgaAmgAAAQI"]
[Fri Apr 17 06:10:31.026829 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:32099] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFeV0nQhUtMbw9EsgaAsgAAAQA"]
[Fri Apr 17 06:10:34.872592 2026] [:error] [pid 9263:tid 9285] [client 172.213.152.251:3180] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFeWhP68VyHNvj1e54I8wAAANQ"]
[Fri Apr 17 06:10:37.370723 2026] [:error] [pid 9152:tid 9208] [client 172.213.152.251:21729] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFeXZJYca8I3TNCwIcYyQAAAFI"]
[Fri Apr 17 06:10:40.416807 2026] [:error] [pid 9151:tid 9174] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Fri Apr 17 06:10:40.652680 2026] [:error] [pid 9151:tid 9164] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Fri Apr 17 06:10:40.887596 2026] [:error] [pid 9151:tid 9183] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Fri Apr 17 06:10:41.509796 2026] [:error] [pid 9151:tid 9165] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Apr 17 06:10:42.275674 2026] [:error] [pid 9151:tid 9162] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Apr 17 06:10:42.511980 2026] [:error] [pid 9151:tid 9175] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Apr 17 06:10:42.750468 2026] [:error] [pid 9151:tid 9177] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Apr 17 06:10:42.987033 2026] [:error] [pid 9151:tid 9180] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Apr 17 06:10:43.326517 2026] [:error] [pid 9151:tid 9170] [client 172.213.152.251:20893] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Apr 17 06:10:43.568000 2026] [:error] [pid 9151:tid 9172] [client 172.213.152.251:20893] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aeFeY8hTVuRPkua22vSkGAAAAAs"]
[Fri Apr 17 06:10:44.868986 2026] [:error] [pid 9151:tid 9179] [client 172.213.152.251:27346] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aeFeZMhTVuRPkua22vSkGwAAABI"]
[Fri Apr 17 06:10:46.212829 2026] [:error] [pid 9263:tid 9287] [client 172.213.152.251:3600] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aeFeZhP68VyHNvj1e54JLAAAANY"]
[Fri Apr 17 06:10:48.022500 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:26979] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aeFeaEnQhUtMbw9EsgaA8QAAAQo"]
[Fri Apr 17 06:10:49.821637 2026] [:error] [pid 51878:tid 51898] [client 172.213.152.251:31785] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "aeFeaUnQhUtMbw9EsgaA9gAAARI"]
[Fri Apr 17 06:10:51.404533 2026] [:error] [pid 9152:tid 9210] [client 172.213.152.251:27006] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "aeFea5JYca8I3TNCwIcY4QAAAFQ"]
[Fri Apr 17 06:10:55.470970 2026] [:error] [pid 9263:tid 9281] [client 172.213.152.251:36587] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "aeFebxP68VyHNvj1e54JMwAAANA"]
[Fri Apr 17 06:10:57.205294 2026] [:error] [pid 51878:tid 51900] [client 172.213.152.251:26947] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "aeFecUnQhUtMbw9EsgaA_wAAARQ"]
[Fri Apr 17 06:10:58.746568 2026] [:error] [pid 9153:tid 9234] [client 172.213.152.251:25346] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeFecuMHGxkTZX3c45cMEwAAAJA"]
[Fri Apr 17 06:11:01.104685 2026] [:error] [pid 9152:tid 9195] [client 172.213.152.251:38024] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeFedZJYca8I3TNCwIcY8wAAAEU"]
[Fri Apr 17 06:11:03.695792 2026] [:error] [pid 51878:tid 51898] [client 172.213.152.251:39033] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeFed0nQhUtMbw9EsgaBEgAAARI"]
[Fri Apr 17 06:11:06.394296 2026] [:error] [pid 51878:tid 51898] [client 172.213.152.251:44733] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeFeeknQhUtMbw9EsgaBIwAAARI"]
[Fri Apr 17 06:11:08.448033 2026] [:error] [pid 9152:tid 9214] [client 172.213.152.251:22873] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "aeFefJJYca8I3TNCwIcY-gAAAFg"]
[Fri Apr 17 06:11:11.009724 2026] [:error] [pid 9152:tid 9191] [client 172.213.152.251:41660] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "aeFef5JYca8I3TNCwIcZAAAAAEE"]
[Fri Apr 17 06:11:12.817484 2026] [:error] [pid 9153:tid 9230] [client 172.213.152.251:23929] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "aeFegOMHGxkTZX3c45cMJgAAAIw"]
[Fri Apr 17 06:11:14.699931 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:49118] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "aeFegknQhUtMbw9EsgaBPAAAARY"]
[Fri Apr 17 06:11:16.367973 2026] [:error] [pid 9263:tid 9268] [client 172.213.152.251:38985] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "aeFehBP68VyHNvj1e54JPgAAAMM"]
[Fri Apr 17 06:11:19.036839 2026] [:error] [pid 9151:tid 9161] [client 172.213.152.251:39953] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "aeFeh8hTVuRPkua22vSkOAAAAAA"]
[Fri Apr 17 06:11:22.742930 2026] [:error] [pid 9152:tid 9190] [client 172.213.152.251:23876] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "aeFeipJYca8I3TNCwIcZCQAAAEA"]
[Fri Apr 17 06:11:24.568546 2026] [:error] [pid 9151:tid 9165] [client 172.213.152.251:29258] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "aeFejMhTVuRPkua22vSkPgAAAAQ"]
[Fri Apr 17 06:11:26.243671 2026] [:error] [pid 9263:tid 9289] [client 172.213.152.251:51967] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "aeFejhP68VyHNvj1e54JUwAAANg"]
[Fri Apr 17 06:11:27.266657 2026] [:error] [pid 9153:tid 9240] [client 172.213.152.251:51914] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "aeFej-MHGxkTZX3c45cMawAAAJY"]
[Fri Apr 17 06:11:28.613935 2026] [:error] [pid 9152:tid 9212] [client 172.213.152.251:30601] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "aeFekJJYca8I3TNCwIcZEQAAAFY"]
[Fri Apr 17 06:11:29.984930 2026] [:error] [pid 51878:tid 51898] [client 172.213.152.251:45692] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "aeFekUnQhUtMbw9EsgaBXAAAARI"]
[Fri Apr 17 06:11:30.807974 2026] [:error] [pid 9152:tid 9214] [client 172.213.152.251:45637] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-michan.php"] [unique_id "aeFekpJYca8I3TNCwIcZGwAAAFg"]
[Fri Apr 17 06:11:31.798461 2026] [:error] [pid 9152:tid 9206] [client 172.213.152.251:30011] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-michan.php"] [unique_id "aeFek5JYca8I3TNCwIcZIQAAAFA"]
[Fri Apr 17 06:11:32.851747 2026] [:error] [pid 9152:tid 9202] [client 172.213.152.251:36143] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-michan.php"] [unique_id "aeFelJJYca8I3TNCwIcZKAAAAEw"]
[Fri Apr 17 06:11:33.632491 2026] [:error] [pid 51878:tid 51882] [client 172.213.152.251:46459] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-michan.php"] [unique_id "aeFelUnQhUtMbw9EsgaBawAAAQI"]
[Fri Apr 17 06:11:34.770489 2026] [:error] [pid 9153:tid 9223] [client 172.213.152.251:58284] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aeFeluMHGxkTZX3c45cMhgAAAIU"]
[Fri Apr 17 06:11:35.888577 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:21288] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aeFel-MHGxkTZX3c45cMiAAAAIs"]
[Fri Apr 17 06:11:37.027463 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:38080] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aeFemUnQhUtMbw9EsgaBdQAAAQc"]
[Fri Apr 17 06:11:39.854153 2026] [:error] [pid 9151:tid 9173] [client 172.213.152.251:30216] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aeFem8hTVuRPkua22vSkcwAAAAw"]
[Fri Apr 17 06:11:41.916917 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:29992] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFenUnQhUtMbw9EsgaBgwAAARY"]
[Fri Apr 17 06:11:45.384127 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:30247] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Fri Apr 17 06:11:45.927692 2026] [:error] [pid 51878:tid 51903] [client 172.213.152.251:30247] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Fri Apr 17 06:11:46.182266 2026] [:error] [pid 51878:tid 51893] [client 172.213.152.251:30247] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Apr 17 06:11:46.663130 2026] [:error] [pid 51878:tid 51894] [client 172.213.152.251:30247] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Fri Apr 17 06:11:51.867087 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:30247] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Apr 17 06:11:52.106290 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:30247] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri Apr 17 06:11:52.375943 2026] [:error] [pid 51878:tid 51901] [client 172.213.152.251:30247] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Fri Apr 17 06:11:52.631413 2026] [:error] [pid 51878:tid 51894] [client 172.213.152.251:30247] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aeFeqEnQhUtMbw9EsgaBpgAAAQ4"]
[Fri Apr 17 06:12:12.332383 2026] [:error] [pid 9263:tid 9265] [client 172.213.152.251:3326] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aeFevBP68VyHNvj1e54J8AAAAMA"]
[Fri Apr 17 06:12:13.751510 2026] [:error] [pid 51878:tid 51899] [client 172.213.152.251:41599] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aeFevUnQhUtMbw9EsgaB6gAAARM"]
[Fri Apr 17 06:12:14.786440 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:47908] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aeFevknQhUtMbw9EsgaB8AAAAQc"]
[Fri Apr 17 06:12:16.135060 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:46024] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aeFewEnQhUtMbw9EsgaB9gAAAQw"]
[Fri Apr 17 06:12:17.036398 2026] [:error] [pid 51878:tid 51896] [client 172.213.152.251:44774] [client 172.213.152.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeFewUnQhUtMbw9EsgaB_AAAARA"]
[Fri Apr 17 06:12:18.742767 2026] [:error] [pid 51878:tid 51881] [client 172.213.152.251:28568] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aeFewknQhUtMbw9EsgaCAgAAAQE"]
[Fri Apr 17 06:12:21.784848 2026] [:error] [pid 9152:tid 9194] [client 172.213.152.251:41572] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aeFexZJYca8I3TNCwIcZXAAAAEQ"]
[Fri Apr 17 06:12:29.567690 2026] [:error] [pid 9153:tid 9242] [client 172.213.152.251:23188] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aeFezeMHGxkTZX3c45cMwwAAAJg"]
[Fri Apr 17 06:12:33.384863 2026] [:error] [pid 9151:tid 9181] [client 172.213.152.251:3305] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeFe0chTVuRPkua22vSk-gAAABQ"]
[Fri Apr 17 06:12:35.328182 2026] [:error] [pid 9151:tid 9161] [client 172.213.152.251:24668] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeFe08hTVuRPkua22vSk-wAAAAA"]
[Fri Apr 17 06:12:37.578665 2026] [:error] [pid 9153:tid 9238] [client 172.213.152.251:44750] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeFe1eMHGxkTZX3c45cM0QAAAJQ"]
[Fri Apr 17 06:12:38.707980 2026] [:error] [pid 51878:tid 51896] [client 172.213.152.251:3939] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeFe1knQhUtMbw9EsgaCQAAAARA"]
[Fri Apr 17 06:12:41.256125 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:23823] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeFe2UnQhUtMbw9EsgaCUAAAAQA"]
[Fri Apr 17 06:12:43.635551 2026] [:error] [pid 9151:tid 9173] [client 172.213.152.251:27986] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeFe28hTVuRPkua22vSk_QAAAAw"]
[Fri Apr 17 06:12:46.271113 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:29805] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeFe3hP68VyHNvj1e54KJwAAAMs"]
[Fri Apr 17 06:12:48.357355 2026] [:error] [pid 51878:tid 51904] [client 172.213.152.251:28028] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeFe4EnQhUtMbw9EsgaClgAAARg"]
[Fri Apr 17 06:12:50.395223 2026] [:error] [pid 51878:tid 51893] [client 172.213.152.251:44774] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prv8.php"] [unique_id "aeFe4knQhUtMbw9EsgaCoQAAAQ0"]
[Fri Apr 17 06:12:52.566010 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Fri Apr 17 06:12:52.804606 2026] [:error] [pid 51878:tid 51896] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Apr 17 06:12:53.043946 2026] [:error] [pid 51878:tid 51899] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Fri Apr 17 06:12:53.279477 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Fri Apr 17 06:12:53.816308 2026] [:error] [pid 51878:tid 51893] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Fri Apr 17 06:12:54.051163 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Fri Apr 17 06:12:54.413655 2026] [:error] [pid 51878:tid 51897] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Apr 17 06:12:54.651094 2026] [:error] [pid 51878:tid 51889] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Apr 17 06:12:54.888674 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Fri Apr 17 06:12:55.681984 2026] [:error] [pid 51878:tid 51883] [client 172.213.152.251:3318] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Fri Apr 17 06:12:55.919756 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:3318] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "aeFe50nQhUtMbw9EsgaCzAAAAQA"]
[Fri Apr 17 06:12:56.892800 2026] [:error] [pid 9151:tid 9181] [client 172.213.152.251:35062] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "aeFe6MhTVuRPkua22vSlDAAAABQ"]
[Fri Apr 17 06:12:58.065010 2026] [:error] [pid 51878:tid 51899] [client 172.213.152.251:31823] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "aeFe6knQhUtMbw9EsgaC0QAAARM"]
[Fri Apr 17 06:12:59.184245 2026] [:error] [pid 51878:tid 51903] [client 172.213.152.251:23826] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "aeFe60nQhUtMbw9EsgaC0gAAARc"]
[Fri Apr 17 06:12:59.941440 2026] [:error] [pid 9153:tid 9236] [client 172.213.152.251:31834] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeFe6-MHGxkTZX3c45cNCQAAAJI"]
[Fri Apr 17 06:13:01.065620 2026] [:error] [pid 9153:tid 9228] [client 172.213.152.251:23231] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeFe7eMHGxkTZX3c45cNCwAAAIo"]
[Fri Apr 17 06:13:01.733127 2026] [:error] [pid 9151:tid 9171] [client 172.213.152.251:29803] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeFe7chTVuRPkua22vSlGAAAAAo"]
[Fri Apr 17 06:13:02.802919 2026] [:error] [pid 9153:tid 9234] [client 172.213.152.251:3549] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeFe7uMHGxkTZX3c45cNEQAAAJA"]
[Fri Apr 17 06:13:04.397723 2026] [:error] [pid 9153:tid 9220] [client 172.213.152.251:3231] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aeFe8OMHGxkTZX3c45cNFAAAAII"]
[Fri Apr 17 06:13:05.917779 2026] [:error] [pid 9151:tid 9181] [client 172.213.152.251:28607] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aeFe8chTVuRPkua22vSlHgAAABQ"]
[Fri Apr 17 06:13:07.346523 2026] [:error] [pid 51878:tid 51882] [client 172.213.152.251:38841] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aeFe80nQhUtMbw9EsgaC9gAAAQI"]
[Fri Apr 17 06:13:08.937775 2026] [:error] [pid 9152:tid 9198] [client 172.213.152.251:31837] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aeFe9JJYca8I3TNCwIcZmQAAAEg"]
[Fri Apr 17 06:13:09.752035 2026] [:error] [pid 9263:tid 9265] [client 172.213.152.251:43202] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "aeFe9RP68VyHNvj1e54KTQAAAMA"]
[Fri Apr 17 06:13:10.831890 2026] [:error] [pid 9152:tid 9199] [client 172.213.152.251:28003] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "aeFe9pJYca8I3TNCwIcZngAAAEk"]
[Fri Apr 17 06:13:13.977005 2026] [:error] [pid 9151:tid 9175] [client 172.213.152.251:23576] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "aeFe-chTVuRPkua22vSlKwAAAA4"]
[Fri Apr 17 06:13:16.190303 2026] [:error] [pid 9263:tid 9286] [client 172.213.152.251:46078] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "aeFe_BP68VyHNvj1e54KYwAAANU"]
[Fri Apr 17 06:13:17.723672 2026] [:error] [pid 9153:tid 9228] [client 172.213.152.251:28567] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "aeFe_eMHGxkTZX3c45cNHgAAAIo"]
[Fri Apr 17 06:13:19.614106 2026] [:error] [pid 9152:tid 9210] [client 172.213.152.251:23829] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "aeFe_5JYca8I3TNCwIcZsgAAAFQ"]
[Fri Apr 17 06:13:21.188984 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:50624] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "aeFfAeMHGxkTZX3c45cNIQAAAIs"]
[Fri Apr 17 06:13:22.174078 2026] [:error] [pid 9152:tid 9211] [client 172.213.152.251:23605] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "aeFfApJYca8I3TNCwIcZtwAAAFU"]
[Fri Apr 17 06:13:23.309428 2026] [:error] [pid 9151:tid 9166] [client 172.213.152.251:38832] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeFfA8hTVuRPkua22vSlLgAAAAU"]
[Fri Apr 17 06:13:24.436613 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:23212] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeFfBBP68VyHNvj1e54KewAAAMs"]
[Fri Apr 17 06:13:25.469370 2026] [:error] [pid 9263:tid 9275] [client 172.213.152.251:27551] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeFfBRP68VyHNvj1e54KggAAAMo"]
[Fri Apr 17 06:13:26.416914 2026] [:error] [pid 9153:tid 9239] [client 172.213.152.251:27995] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeFfBuMHGxkTZX3c45cNLQAAAJU"]
[Fri Apr 17 06:13:27.164295 2026] [:error] [pid 9153:tid 9232] [client 172.213.152.251:30672] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "aeFfB-MHGxkTZX3c45cNMwAAAI4"]
[Fri Apr 17 06:13:29.283670 2026] [:error] [pid 51878:tid 51894] [client 172.213.152.251:35036] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "aeFfCUnQhUtMbw9EsgaDbgAAAQ4"]
[Fri Apr 17 06:13:30.319069 2026] [:error] [pid 9153:tid 9233] [client 172.213.152.251:35011] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "aeFfCuMHGxkTZX3c45cNRAAAAI8"]
[Fri Apr 17 06:13:31.194246 2026] [:error] [pid 9153:tid 9237] [client 172.213.152.251:3327] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "aeFfC-MHGxkTZX3c45cNSgAAAJM"]
[Fri Apr 17 06:13:32.370841 2026] [:error] [pid 9151:tid 9179] [client 172.213.152.251:3572] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "aeFfDMhTVuRPkua22vSlPwAAABI"]
[Fri Apr 17 06:13:34.532593 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:3207] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "aeFfDknQhUtMbw9EsgaDkwAAAQw"]
[Fri Apr 17 06:13:35.851921 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:38826] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "aeFfD-MHGxkTZX3c45cNXAAAAIs"]
[Fri Apr 17 06:13:36.775564 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:3553] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "aeFfEEnQhUtMbw9EsgaDpAAAAQA"]
[Fri Apr 17 06:13:37.495259 2026] [:error] [pid 9152:tid 9194] [client 172.213.152.251:34085] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "aeFfEZJYca8I3TNCwIcZygAAAEQ"]
[Fri Apr 17 06:13:38.548083 2026] [:error] [pid 9151:tid 9169] [client 172.213.152.251:38797] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "aeFfEshTVuRPkua22vSlRAAAAAg"]
[Fri Apr 17 06:13:40.007224 2026] [:error] [pid 9152:tid 9198] [client 172.213.152.251:37329] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "aeFfFJJYca8I3TNCwIcZzAAAAEg"]
[Fri Apr 17 06:13:41.542377 2026] [:error] [pid 9151:tid 9183] [client 172.213.152.251:44760] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "aeFfFchTVuRPkua22vSlSQAAABY"]
[Fri Apr 17 06:13:43.679904 2026] [:error] [pid 9263:tid 9271] [client 172.213.152.251:44770] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "aeFfFxP68VyHNvj1e54KkAAAAMY"]
[Fri Apr 17 06:13:45.206444 2026] [:error] [pid 9151:tid 9185] [client 172.213.152.251:3255] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "aeFfGchTVuRPkua22vSlUgAAABg"]
[Fri Apr 17 06:13:47.881443 2026] [:error] [pid 9151:tid 9179] [client 172.213.152.251:3273] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "aeFfG8hTVuRPkua22vSlVgAAABI"]
[Fri Apr 17 06:13:51.542222 2026] [:error] [pid 9151:tid 9171] [client 172.213.152.251:3323] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "aeFfH8hTVuRPkua22vSlYwAAAAo"]
[Fri Apr 17 06:13:53.458434 2026] [:error] [pid 9153:tid 9218] [client 172.213.152.251:46054] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class20.php"] [unique_id "aeFfIeMHGxkTZX3c45cNoAAAAIA"]
[Fri Apr 17 06:13:55.108281 2026] [:error] [pid 9263:tid 9282] [client 172.213.152.251:41929] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Fri Apr 17 06:13:55.346328 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:41929] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Fri Apr 17 06:13:56.663536 2026] [:error] [pid 9263:tid 9270] [client 172.213.152.251:41929] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Fri Apr 17 06:13:56.899892 2026] [:error] [pid 9263:tid 9275] [client 172.213.152.251:41929] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Fri Apr 17 06:13:57.143217 2026] [:error] [pid 9263:tid 9284] [client 172.213.152.251:41929] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Fri Apr 17 06:13:57.379867 2026] [:error] [pid 9263:tid 9289] [client 172.213.152.251:41929] File does not exist: /usr/local/apache/htdocs/suspended-page/x1da.php
[Fri Apr 17 06:13:57.664904 2026] [:error] [pid 9263:tid 9270] [client 172.213.152.251:41929] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Apr 17 06:13:57.900004 2026] [:error] [pid 9263:tid 9275] [client 172.213.152.251:41929] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Apr 17 06:57:50.828357 2026] [:error] [pid 9153:tid 9230] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Fri Apr 17 06:57:51.263928 2026] [:error] [pid 9153:tid 9242] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/4GrJSiwkF3A.php
[Fri Apr 17 06:57:51.528145 2026] [:error] [pid 9153:tid 9228] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/SS72_kKKjT.php
[Fri Apr 17 06:57:51.963517 2026] [:error] [pid 9153:tid 9229] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/wkogn.php
[Fri Apr 17 06:57:52.272511 2026] [:error] [pid 9153:tid 9225] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/hwjtry0zd1fzeakcuzn8Cdefault.php
[Fri Apr 17 06:57:52.539897 2026] [:error] [pid 9153:tid 9242] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Fri Apr 17 06:57:52.913870 2026] [:error] [pid 9153:tid 9237] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/oLEzRVqmJJPFSucdefault.php
[Fri Apr 17 06:57:53.228372 2026] [:error] [pid 9153:tid 9233] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/wwdgl.php
[Fri Apr 17 06:57:53.528908 2026] [:error] [pid 9153:tid 9220] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/3akp.php
[Fri Apr 17 06:57:53.911831 2026] [:error] [pid 9153:tid 9231] [client 20.166.7.149:29766] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Fri Apr 17 06:57:54.173149 2026] [:error] [pid 9153:tid 9234] [client 20.166.7.149:29766] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "aeFpcuMHGxkTZX3c45dH8wAAAJA"]
[Fri Apr 17 06:57:54.708394 2026] [:error] [pid 9153:tid 9229] [client 20.166.7.149:29789] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "aeFpcuMHGxkTZX3c45dH9AAAAIs"]
[Fri Apr 17 06:57:55.493557 2026] [:error] [pid 9153:tid 9241] [client 20.166.7.149:29879] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "aeFpc-MHGxkTZX3c45dH-QAAAJc"]
[Fri Apr 17 06:57:56.708535 2026] [:error] [pid 25010:tid 25015] [client 20.166.7.149:29845] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/BhqKs28Cw94.php"] [unique_id "aeFpdI-7kkf42RarqQ3WLAAAAUI"]
[Fri Apr 17 06:57:57.645584 2026] [:error] [pid 9151:tid 9170] [client 20.166.7.149:29859] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cdn3.php"] [unique_id "aeFpdchTVuRPkua22vTCBAAAAAk"]
[Fri Apr 17 06:57:58.529990 2026] [:error] [pid 25010:tid 25013] [client 20.166.7.149:29871] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cdn3.php"] [unique_id "aeFpdo-7kkf42RarqQ3WOQAAAUA"]
[Fri Apr 17 06:57:59.313996 2026] [:error] [pid 25010:tid 25020] [client 20.166.7.149:29824] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cdn3.php"] [unique_id "aeFpd4-7kkf42RarqQ3WPwAAAUc"]
[Fri Apr 17 06:58:00.122839 2026] [:error] [pid 25010:tid 25026] [client 20.166.7.149:29882] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cdn3.php"] [unique_id "aeFpeI-7kkf42RarqQ3WRgAAAU0"]
[Fri Apr 17 06:58:00.769335 2026] [:error] [pid 25010:tid 25016] [client 20.166.7.149:29776] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeFpeI-7kkf42RarqQ3WTgAAAUM"]
[Fri Apr 17 06:58:01.498618 2026] [:error] [pid 25010:tid 25025] [client 20.166.7.149:29862] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeFpeY-7kkf42RarqQ3WWwAAAUw"]
[Fri Apr 17 06:58:02.229181 2026] [:error] [pid 9263:tid 9288] [client 20.166.7.149:29807] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeFpehP68VyHNvj1e545RAAAANc"]
[Fri Apr 17 06:58:02.906992 2026] [:error] [pid 9153:tid 9235] [client 20.166.7.149:29869] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeFpeuMHGxkTZX3c45dIFwAAAJE"]
[Fri Apr 17 06:58:03.973309 2026] [:error] [pid 9151:tid 9171] [client 20.166.7.149:29779] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/beerd.php"] [unique_id "aeFpe8hTVuRPkua22vTCDQAAAAo"]
[Fri Apr 17 06:58:06.166284 2026] [:error] [pid 51878:tid 51897] [client 20.166.7.149:29777] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/beerd.php"] [unique_id "aeFpfknQhUtMbw9EsgbBNwAAARE"]
[Fri Apr 17 06:58:06.810640 2026] [:error] [pid 51878:tid 51901] [client 20.166.7.149:29836] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/beerd.php"] [unique_id "aeFpfknQhUtMbw9EsgbBPAAAARU"]
[Fri Apr 17 06:58:07.500262 2026] [:error] [pid 51878:tid 51902] [client 20.166.7.149:29791] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/beerd.php"] [unique_id "aeFpf0nQhUtMbw9EsgbBQQAAARY"]
[Fri Apr 17 06:58:08.179213 2026] [:error] [pid 9263:tid 9267] [client 20.166.7.149:29808] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hhxc.php"] [unique_id "aeFpgBP68VyHNvj1e545YQAAAMI"]
[Fri Apr 17 06:58:08.924155 2026] [:error] [pid 51878:tid 51891] [client 20.166.7.149:29827] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hhxc.php"] [unique_id "aeFpgEnQhUtMbw9EsgbBUQAAAQs"]
[Fri Apr 17 06:58:09.967361 2026] [:error] [pid 9153:tid 9226] [client 20.166.7.149:29876] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hhxc.php"] [unique_id "aeFpgeMHGxkTZX3c45dIKwAAAIg"]
[Fri Apr 17 06:58:10.794121 2026] [:error] [pid 9153:tid 9227] [client 20.166.7.149:29775] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hhxc.php"] [unique_id "aeFpguMHGxkTZX3c45dINAAAAIk"]
[Fri Apr 17 06:58:12.335675 2026] [:error] [pid 25010:tid 25016] [client 20.166.7.149:29826] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/161dfd072f.php"] [unique_id "aeFphI-7kkf42RarqQ3WrgAAAUM"]
[Fri Apr 17 06:58:14.903357 2026] [:error] [pid 25010:tid 25029] [client 20.166.7.149:29880] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/161dfd072f.php"] [unique_id "aeFpho-7kkf42RarqQ3W5QAAAVA"]
[Fri Apr 17 06:58:17.061190 2026] [:error] [pid 51878:tid 51893] [client 20.166.7.149:29765] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/161dfd072f.php"] [unique_id "aeFpiUnQhUtMbw9EsgbBggAAAQ0"]
[Fri Apr 17 06:58:18.169411 2026] [:error] [pid 9152:tid 9209] [client 20.166.7.149:29833] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/161dfd072f.php"] [unique_id "aeFpipJYca8I3TNCwIc7-wAAAFM"]
[Fri Apr 17 06:58:18.701785 2026] [:error] [pid 51878:tid 51897] [client 20.166.7.149:29837] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aeFpiknQhUtMbw9EsgbBiAAAARE"]
[Fri Apr 17 06:58:19.505343 2026] [:error] [pid 9153:tid 9225] [client 20.166.7.149:29768] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aeFpi-MHGxkTZX3c45dIawAAAIc"]
[Fri Apr 17 06:58:20.121073 2026] [:error] [pid 25010:tid 25028] [client 20.166.7.149:29885] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aeFpjI-7kkf42RarqQ3XJQAAAU8"]
[Fri Apr 17 06:58:20.680560 2026] [:error] [pid 9152:tid 9203] [client 20.166.7.149:29786] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aeFpjJJYca8I3TNCwIc8DAAAAE0"]
[Fri Apr 17 06:58:21.421766 2026] [:error] [pid 25010:tid 25020] [client 20.166.7.149:29805] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "aeFpjY-7kkf42RarqQ3XKwAAAUc"]
[Fri Apr 17 06:58:22.021306 2026] [:error] [pid 25010:tid 25014] [client 20.166.7.149:29814] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "aeFpjo-7kkf42RarqQ3XMQAAAUE"]
[Fri Apr 17 06:58:22.604547 2026] [:error] [pid 9263:tid 9284] [client 20.166.7.149:29868] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "aeFpjhP68VyHNvj1e545jAAAANM"]
[Fri Apr 17 06:58:23.256323 2026] [:error] [pid 9153:tid 9226] [client 20.166.7.149:29886] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "aeFpj-MHGxkTZX3c45dIiwAAAIg"]
[Fri Apr 17 06:58:23.864323 2026] [:error] [pid 9151:tid 9174] [client 20.166.7.149:29785] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/RIP.php"] [unique_id "aeFpj8hTVuRPkua22vTCMwAAAA0"]
[Fri Apr 17 06:58:24.479589 2026] [:error] [pid 9152:tid 9201] [client 20.166.7.149:29860] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/RIP.php"] [unique_id "aeFpkJJYca8I3TNCwIc8GAAAAEs"]
[Fri Apr 17 06:58:25.024762 2026] [:error] [pid 9153:tid 9241] [client 20.166.7.149:29782] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/RIP.php"] [unique_id "aeFpkeMHGxkTZX3c45dIqAAAAJc"]
[Fri Apr 17 06:58:25.588975 2026] [:error] [pid 9263:tid 9266] [client 20.166.7.149:29877] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/RIP.php"] [unique_id "aeFpkRP68VyHNvj1e545lgAAAME"]
[Fri Apr 17 06:58:26.304559 2026] [:error] [pid 9153:tid 9221] [client 20.166.7.149:9205] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeFpkuMHGxkTZX3c45dIwAAAAIM"]
[Fri Apr 17 06:58:27.895567 2026] [:error] [pid 9153:tid 9224] [client 20.166.7.149:29870] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeFpk-MHGxkTZX3c45dI0AAAAIY"]
[Fri Apr 17 06:58:28.499394 2026] [:error] [pid 9153:tid 9227] [client 20.166.7.149:29761] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeFplOMHGxkTZX3c45dI2QAAAIk"]
[Fri Apr 17 06:58:29.116647 2026] [:error] [pid 9151:tid 9169] [client 20.166.7.149:29834] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeFplchTVuRPkua22vTCOAAAAAg"]
[Fri Apr 17 06:58:30.236374 2026] [:error] [pid 9153:tid 9221] [client 20.166.7.149:29780] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blqjs.php"] [unique_id "aeFpluMHGxkTZX3c45dI5QAAAIM"]
[Fri Apr 17 06:58:30.846923 2026] [:error] [pid 9151:tid 9170] [client 20.166.7.149:29817] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blqjs.php"] [unique_id "aeFplshTVuRPkua22vTCOwAAAAk"]
[Fri Apr 17 06:58:31.570764 2026] [:error] [pid 25010:tid 25013] [client 20.166.7.149:29813] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blqjs.php"] [unique_id "aeFpl4-7kkf42RarqQ3XYAAAAUA"]
[Fri Apr 17 06:58:32.209124 2026] [:error] [pid 9153:tid 9221] [client 20.166.7.149:9183] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blqjs.php"] [unique_id "aeFpmOMHGxkTZX3c45dI9AAAAIM"]
[Fri Apr 17 06:58:32.866976 2026] [:error] [pid 9263:tid 9277] [client 20.166.7.149:29873] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sk25_1.php"] [unique_id "aeFpmBP68VyHNvj1e545sgAAAMw"]
[Fri Apr 17 06:58:33.437023 2026] [:error] [pid 9153:tid 9227] [client 20.166.7.149:29875] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sk25_1.php"] [unique_id "aeFpmeMHGxkTZX3c45dJAgAAAIk"]
[Fri Apr 17 06:58:34.031436 2026] [:error] [pid 51878:tid 51882] [client 20.166.7.149:29839] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sk25_1.php"] [unique_id "aeFpmknQhUtMbw9EsgbBrgAAAQI"]
[Fri Apr 17 06:58:34.687051 2026] [:error] [pid 9153:tid 9233] [client 20.166.7.149:29812] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sk25_1.php"] [unique_id "aeFpmuMHGxkTZX3c45dJDgAAAI8"]
[Fri Apr 17 06:58:35.392574 2026] [:error] [pid 9151:tid 9164] [client 20.166.7.149:29852] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fetch.php"] [unique_id "aeFpm8hTVuRPkua22vTCSwAAAAM"]
[Fri Apr 17 06:58:35.937865 2026] [:error] [pid 9152:tid 9205] [client 20.166.7.149:29855] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fetch.php"] [unique_id "aeFpm5JYca8I3TNCwIc8QgAAAE8"]
[Fri Apr 17 06:58:36.541351 2026] [:error] [pid 9151:tid 9165] [client 20.166.7.149:29773] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fetch.php"] [unique_id "aeFpnMhTVuRPkua22vTCUwAAAAQ"]
[Fri Apr 17 06:58:37.205749 2026] [:error] [pid 9153:tid 9232] [client 20.166.7.149:29853] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fetch.php"] [unique_id "aeFpneMHGxkTZX3c45dJHgAAAI4"]
[Fri Apr 17 06:58:37.891695 2026] [:error] [pid 25010:tid 25034] [client 20.166.7.149:29796] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "aeFpnY-7kkf42RarqQ3XhgAAAVU"]
[Fri Apr 17 06:58:38.482703 2026] [:error] [pid 9153:tid 9231] [client 20.166.7.149:29801] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "aeFpnuMHGxkTZX3c45dJKQAAAI0"]
[Fri Apr 17 06:58:39.307908 2026] [:error] [pid 9263:tid 9286] [client 20.166.7.149:9206] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "aeFpnxP68VyHNvj1e545vgAAANU"]
[Fri Apr 17 06:58:39.963874 2026] [:error] [pid 9153:tid 9222] [client 20.166.7.149:9161] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "aeFpn-MHGxkTZX3c45dJRgAAAIQ"]
[Fri Apr 17 06:58:40.632652 2026] [:error] [pid 9263:tid 9265] [client 20.166.7.149:29781] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "aeFpoBP68VyHNvj1e545wQAAAMA"]
[Fri Apr 17 06:58:41.286423 2026] [:error] [pid 9153:tid 9240] [client 20.166.7.149:29874] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "aeFpoeMHGxkTZX3c45dJVwAAAJY"]
[Fri Apr 17 06:58:42.053436 2026] [:error] [pid 9152:tid 9211] [client 20.166.7.149:9173] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "aeFpopJYca8I3TNCwIc8SwAAAFU"]
[Fri Apr 17 06:58:42.978459 2026] [:error] [pid 51878:tid 51903] [client 20.166.7.149:29762] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "aeFpoknQhUtMbw9EsgbB4AAAARc"]
[Fri Apr 17 06:58:45.005092 2026] [:error] [pid 9153:tid 9226] [client 20.166.7.149:29774] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oircv.php"] [unique_id "aeFppeMHGxkTZX3c45dJdgAAAIg"]
[Fri Apr 17 06:58:45.875970 2026] [:error] [pid 9263:tid 9279] [client 20.166.7.149:29772] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oircv.php"] [unique_id "aeFppRP68VyHNvj1e5450QAAAM4"]
[Fri Apr 17 06:58:46.451832 2026] [:error] [pid 9153:tid 9225] [client 20.166.7.149:29767] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oircv.php"] [unique_id "aeFppuMHGxkTZX3c45dJfQAAAIc"]
[Fri Apr 17 06:58:47.217511 2026] [:error] [pid 9152:tid 9196] [client 20.166.7.149:29884] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oircv.php"] [unique_id "aeFpp5JYca8I3TNCwIc8VgAAAEY"]
[Fri Apr 17 06:58:48.054078 2026] [:error] [pid 9152:tid 9192] [client 20.166.7.149:29764] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blnux.php"] [unique_id "aeFpqJJYca8I3TNCwIc8YgAAAEI"]
[Fri Apr 17 06:58:48.769600 2026] [:error] [pid 9263:tid 9268] [client 20.166.7.149:29806] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blnux.php"] [unique_id "aeFpqBP68VyHNvj1e5456QAAAMM"]
[Fri Apr 17 06:58:49.532508 2026] [:error] [pid 9153:tid 9237] [client 20.166.7.149:29857] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blnux.php"] [unique_id "aeFpqeMHGxkTZX3c45dJlAAAAJM"]
[Fri Apr 17 06:58:50.510032 2026] [:error] [pid 51878:tid 51893] [client 20.166.7.149:29818] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blnux.php"] [unique_id "aeFpqknQhUtMbw9EsgbB-QAAAQ0"]
[Fri Apr 17 06:58:51.388438 2026] [:error] [pid 25010:tid 25037] [client 20.166.7.149:29846] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeFpq4-7kkf42RarqQ3XtQAAAVg"]
[Fri Apr 17 06:58:51.967220 2026] [:error] [pid 9151:tid 9164] [client 20.166.7.149:29865] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeFpq8hTVuRPkua22vTCkAAAAAM"]
[Fri Apr 17 06:58:52.559307 2026] [:error] [pid 9153:tid 9240] [client 20.166.7.149:9089] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeFprOMHGxkTZX3c45dJvwAAAJY"]
[Fri Apr 17 06:58:53.155644 2026] [:error] [pid 9153:tid 9229] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/n3yUmQ6Q9xwQ8ocdefault.php
[Fri Apr 17 06:58:53.408478 2026] [:error] [pid 9153:tid 9219] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/Spow_SRw.php
[Fri Apr 17 06:58:53.663041 2026] [:error] [pid 9153:tid 9232] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/albrt.php
[Fri Apr 17 06:58:53.945353 2026] [:error] [pid 9153:tid 9239] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/xxivicLhot.php
[Fri Apr 17 06:58:54.296718 2026] [:error] [pid 9153:tid 9223] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Fri Apr 17 06:58:54.552036 2026] [:error] [pid 9153:tid 9240] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Fri Apr 17 06:58:54.891990 2026] [:error] [pid 9153:tid 9227] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/wxeyc.php
[Fri Apr 17 06:58:55.148902 2026] [:error] [pid 9153:tid 9222] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Fri Apr 17 06:58:55.402549 2026] [:error] [pid 9153:tid 9224] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Fri Apr 17 06:58:55.657149 2026] [:error] [pid 9153:tid 9237] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/fyflv.php
[Fri Apr 17 06:58:56.020172 2026] [:error] [pid 9153:tid 9220] [client 20.166.7.149:29863] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-942.php
[Fri Apr 17 06:58:56.270737 2026] [:error] [pid 9153:tid 9219] [client 20.166.7.149:29863] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sde.php"] [unique_id "aeFpsOMHGxkTZX3c45dJ4wAAAIE"]
[Fri Apr 17 06:58:56.823163 2026] [:error] [pid 9153:tid 9221] [client 20.166.7.149:9163] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sde.php"] [unique_id "aeFpsOMHGxkTZX3c45dJ5AAAAIM"]
[Fri Apr 17 06:58:57.541158 2026] [:error] [pid 9151:tid 9162] [client 20.166.7.149:29831] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sde.php"] [unique_id "aeFpschTVuRPkua22vTCngAAAAE"]
[Fri Apr 17 06:58:58.103001 2026] [:error] [pid 9151:tid 9168] [client 20.166.7.149:9105] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sde.php"] [unique_id "aeFpsshTVuRPkua22vTCoQAAAAc"]
[Fri Apr 17 06:58:59.807559 2026] [:error] [pid 9153:tid 9220] [client 20.166.7.149:29783] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wpb.php"] [unique_id "aeFps-MHGxkTZX3c45dJ6wAAAII"]
[Fri Apr 17 06:59:00.420674 2026] [:error] [pid 9153:tid 9235] [client 20.166.7.149:29847] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wpb.php"] [unique_id "aeFptOMHGxkTZX3c45dJ7QAAAJE"]
[Fri Apr 17 06:59:01.229989 2026] [:error] [pid 25010:tid 25023] [client 20.166.7.149:29801] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wpb.php"] [unique_id "aeFptY-7kkf42RarqQ3XywAAAUo"]
[Fri Apr 17 06:59:01.873331 2026] [:error] [pid 9263:tid 9269] [client 20.166.7.149:29858] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wpb.php"] [unique_id "aeFptRP68VyHNvj1e546NQAAAMQ"]
[Fri Apr 17 06:59:02.674696 2026] [:error] [pid 25010:tid 25016] [client 20.166.7.149:29838] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Geforce.php"] [unique_id "aeFpto-7kkf42RarqQ3X1AAAAUM"]
[Fri Apr 17 06:59:03.433623 2026] [:error] [pid 9152:tid 9207] [client 20.166.7.149:29822] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Geforce.php"] [unique_id "aeFpt5JYca8I3TNCwIc8pQAAAFE"]
[Fri Apr 17 06:59:04.183776 2026] [:error] [pid 25010:tid 25031] [client 20.166.7.149:29792] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Geforce.php"] [unique_id "aeFpuI-7kkf42RarqQ3X2wAAAVI"]
[Fri Apr 17 06:59:05.965772 2026] [:error] [pid 51878:tid 51892] [client 20.166.7.149:29803] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Geforce.php"] [unique_id "aeFpuUnQhUtMbw9EsgbCOQAAAQw"]
[Fri Apr 17 06:59:08.867454 2026] [:error] [pid 9151:tid 9165] [client 20.166.7.149:9156] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9EaklzMysJ.php"] [unique_id "aeFpvMhTVuRPkua22vTCrQAAAAQ"]
[Fri Apr 17 06:59:09.928290 2026] [:error] [pid 9151:tid 9183] [client 20.166.7.149:29828] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9EaklzMysJ.php"] [unique_id "aeFpvchTVuRPkua22vTCrwAAABY"]
[Fri Apr 17 06:59:11.329528 2026] [:error] [pid 51878:tid 51890] [client 20.166.7.149:29816] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9EaklzMysJ.php"] [unique_id "aeFpv0nQhUtMbw9EsgbCZQAAAQo"]
[Fri Apr 17 06:59:12.423590 2026] [:error] [pid 9152:tid 9199] [client 20.166.7.149:29815] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9EaklzMysJ.php"] [unique_id "aeFpwJJYca8I3TNCwIc8tQAAAEk"]
[Fri Apr 17 06:59:13.570347 2026] [:error] [pid 9152:tid 9207] [client 20.166.7.149:29883] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wpxl.php"] [unique_id "aeFpwZJYca8I3TNCwIc8uQAAAFE"]
[Fri Apr 17 06:59:14.480475 2026] [:error] [pid 9151:tid 9181] [client 20.166.7.149:29878] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wpxl.php"] [unique_id "aeFpwshTVuRPkua22vTCvgAAABQ"]
[Fri Apr 17 06:59:15.479861 2026] [:error] [pid 9152:tid 9213] [client 20.166.7.149:29793] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wpxl.php"] [unique_id "aeFpw5JYca8I3TNCwIc8wAAAAFc"]
[Fri Apr 17 06:59:16.428410 2026] [:error] [pid 25010:tid 25014] [client 20.166.7.149:9090] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wpxl.php"] [unique_id "aeFpxI-7kkf42RarqQ3YHQAAAUE"]
[Fri Apr 17 06:59:18.318327 2026] [:error] [pid 9263:tid 9273] [client 20.166.7.149:29866] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "aeFpxhP68VyHNvj1e546WQAAAMg"]
[Fri Apr 17 06:59:20.454686 2026] [:error] [pid 25010:tid 25023] [client 20.166.7.149:29864] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "aeFpyI-7kkf42RarqQ3YKgAAAUo"]
[Fri Apr 17 06:59:21.315284 2026] [:error] [pid 9152:tid 9208] [client 20.166.7.149:9177] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "aeFpyZJYca8I3TNCwIc8zAAAAFI"]
[Fri Apr 17 06:59:22.114010 2026] [:error] [pid 9153:tid 9222] [client 20.166.7.149:29849] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "aeFpyuMHGxkTZX3c45dKYgAAAIQ"]
[Fri Apr 17 06:59:22.673773 2026] [:error] [pid 9153:tid 9238] [client 20.166.7.149:9176] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aeFpyuMHGxkTZX3c45dKagAAAJQ"]
[Fri Apr 17 06:59:23.211902 2026] [:error] [pid 25010:tid 25018] [client 20.166.7.149:29887] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aeFpy4-7kkf42RarqQ3YOQAAAUU"]
[Fri Apr 17 06:59:23.974231 2026] [:error] [pid 51878:tid 51896] [client 20.166.7.149:9102] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aeFpy0nQhUtMbw9EsgbCnwAAARA"]
[Fri Apr 17 06:59:24.886509 2026] [:error] [pid 9263:tid 9286] [client 20.166.7.149:29835] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aeFpzBP68VyHNvj1e546aAAAANU"]
[Fri Apr 17 06:59:25.906859 2026] [:error] [pid 25010:tid 25032] [client 20.166.7.149:29800] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lb.php"] [unique_id "aeFpzY-7kkf42RarqQ3YSwAAAVM"]
[Fri Apr 17 06:59:27.671869 2026] [:error] [pid 25010:tid 25037] [client 20.166.7.149:29787] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lb.php"] [unique_id "aeFpz4-7kkf42RarqQ3YYAAAAVg"]
[Fri Apr 17 06:59:29.110603 2026] [:error] [pid 9263:tid 9284] [client 20.166.7.149:9197] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lb.php"] [unique_id "aeFp0RP68VyHNvj1e546dwAAANM"]
[Fri Apr 17 06:59:30.217758 2026] [:error] [pid 51878:tid 51901] [client 20.166.7.149:29763] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lb.php"] [unique_id "aeFp0knQhUtMbw9EsgbCuwAAARU"]
[Fri Apr 17 06:59:30.982694 2026] [:error] [pid 9151:tid 9180] [client 20.166.7.149:29788] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeFp0shTVuRPkua22vTC7QAAABM"]
[Fri Apr 17 06:59:32.014939 2026] [:error] [pid 9153:tid 9218] [client 20.166.7.149:29867] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeFp1OMHGxkTZX3c45dKvwAAAIA"]
[Fri Apr 17 06:59:32.887869 2026] [:error] [pid 9263:tid 9270] [client 20.166.7.149:29872] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeFp1BP68VyHNvj1e546gwAAAMU"]
[Fri Apr 17 06:59:33.497341 2026] [:error] [pid 9151:tid 9162] [client 20.166.7.149:29819] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeFp1chTVuRPkua22vTC9gAAAAE"]
[Fri Apr 17 06:59:34.106058 2026] [:error] [pid 9153:tid 9225] [client 20.166.7.149:9159] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "aeFp1uMHGxkTZX3c45dKzwAAAIc"]
[Fri Apr 17 06:59:34.898728 2026] [:error] [pid 9152:tid 9201] [client 20.166.7.149:29854] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "aeFp1pJYca8I3TNCwIc86wAAAEs"]
[Fri Apr 17 06:59:35.473692 2026] [:error] [pid 9151:tid 9161] [client 20.166.7.149:9170] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "aeFp18hTVuRPkua22vTC_wAAAAA"]
[Fri Apr 17 06:59:36.433698 2026] [:error] [pid 9263:tid 9271] [client 20.166.7.149:29770] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "aeFp2BP68VyHNvj1e546kAAAAMY"]
[Fri Apr 17 06:59:37.563121 2026] [:error] [pid 25010:tid 25037] [client 20.166.7.149:9175] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "aeFp2Y-7kkf42RarqQ3YmQAAAVg"]
[Fri Apr 17 06:59:38.526407 2026] [:error] [pid 25010:tid 25027] [client 20.166.7.149:29809] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "aeFp2o-7kkf42RarqQ3YnwAAAU4"]
[Fri Apr 17 06:59:39.246784 2026] [:error] [pid 9263:tid 9287] [client 20.166.7.149:29760] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "aeFp2xP68VyHNvj1e546nAAAANY"]
[Fri Apr 17 06:59:40.189157 2026] [:error] [pid 9263:tid 9276] [client 20.166.7.149:9113] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "aeFp3BP68VyHNvj1e546pQAAAMs"]
[Fri Apr 17 06:59:41.459117 2026] [:error] [pid 9153:tid 9229] [client 20.166.7.149:9184] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/iindv.php"] [unique_id "aeFp3eMHGxkTZX3c45dK8QAAAIs"]
[Fri Apr 17 06:59:43.421964 2026] [:error] [pid 9152:tid 9210] [client 20.166.7.149:9107] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/iindv.php"] [unique_id "aeFp35JYca8I3TNCwIc9GwAAAFQ"]
[Fri Apr 17 06:59:44.081047 2026] [:error] [pid 25010:tid 25029] [client 20.166.7.149:29798] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/iindv.php"] [unique_id "aeFp4I-7kkf42RarqQ3YtAAAAVA"]
[Fri Apr 17 06:59:44.999455 2026] [:error] [pid 51878:tid 51885] [client 20.166.7.149:9208] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/iindv.php"] [unique_id "aeFp4EnQhUtMbw9EsgbDBQAAAQU"]
[Fri Apr 17 06:59:45.866326 2026] [:error] [pid 51878:tid 51893] [client 20.166.7.149:9201] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/maintura.php"] [unique_id "aeFp4UnQhUtMbw9EsgbDCgAAAQ0"]
[Fri Apr 17 06:59:47.245187 2026] [:error] [pid 9153:tid 9239] [client 20.166.7.149:9194] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/maintura.php"] [unique_id "aeFp4-MHGxkTZX3c45dLCwAAAJU"]
[Fri Apr 17 06:59:49.102300 2026] [:error] [pid 25010:tid 25020] [client 20.166.7.149:9182] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/maintura.php"] [unique_id "aeFp5Y-7kkf42RarqQ3YxAAAAUc"]
[Fri Apr 17 06:59:50.318830 2026] [:error] [pid 9152:tid 9192] [client 20.166.7.149:29848] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/maintura.php"] [unique_id "aeFp5pJYca8I3TNCwIc9MwAAAEI"]
[Fri Apr 17 06:59:51.900001 2026] [:error] [pid 9153:tid 9241] [client 20.166.7.149:9172] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "aeFp5-MHGxkTZX3c45dLIQAAAJc"]
[Fri Apr 17 06:59:53.428322 2026] [:error] [pid 25010:tid 25017] [client 20.166.7.149:29806] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "aeFp6Y-7kkf42RarqQ3Y0QAAAUQ"]
[Fri Apr 17 06:59:54.263308 2026] [:error] [pid 25010:tid 25031] [client 20.166.7.149:9191] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "aeFp6o-7kkf42RarqQ3Y2AAAAVI"]
[Fri Apr 17 06:59:55.078923 2026] [:error] [pid 9151:tid 9185] [client 20.166.7.149:9121] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "aeFp68hTVuRPkua22vTDMQAAABg"]
[Fri Apr 17 06:59:55.638325 2026] [:error] [pid 51878:tid 51901] [client 20.166.7.149:9195] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "aeFp60nQhUtMbw9EsgbDLgAAARU"]
[Fri Apr 17 06:59:56.322670 2026] [:error] [pid 51878:tid 51900] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/nvwf4svpvqohxdjtbjCdefault.php
[Fri Apr 17 06:59:56.629698 2026] [:error] [pid 51878:tid 51894] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-220.php
[Fri Apr 17 06:59:56.882805 2026] [:error] [pid 51878:tid 51889] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/r9pbhistk1lifhnjadpCdefault.php
[Fri Apr 17 06:59:57.167102 2026] [:error] [pid 51878:tid 51903] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Fri Apr 17 06:59:57.429822 2026] [:error] [pid 51878:tid 51904] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/xxiviLDIot.php
[Fri Apr 17 06:59:57.739360 2026] [:error] [pid 51878:tid 51895] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/hanyatersenyum.php
[Fri Apr 17 06:59:58.006495 2026] [:error] [pid 51878:tid 51886] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php
[Fri Apr 17 06:59:58.260119 2026] [:error] [pid 51878:tid 51896] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/upll22.php
[Fri Apr 17 06:59:58.513852 2026] [:error] [pid 51878:tid 51900] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Apr 17 06:59:58.768557 2026] [:error] [pid 51878:tid 51888] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Fri Apr 17 06:59:59.022096 2026] [:error] [pid 51878:tid 51899] [client 20.166.7.149:29797] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Fri Apr 17 06:59:59.273214 2026] [:error] [pid 51878:tid 51881] [client 20.166.7.149:29797] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "aeFp70nQhUtMbw9EsgbDTgAAAQE"]
[Fri Apr 17 06:59:59.847774 2026] [:error] [pid 9263:tid 9288] [client 20.166.7.149:9198] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "aeFp7xP68VyHNvj1e5462AAAANc"]
[Fri Apr 17 07:00:00.427612 2026] [:error] [pid 25010:tid 25023] [client 20.166.7.149:9142] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "aeFp8I-7kkf42RarqQ3Y8QAAAUo"]
[Fri Apr 17 07:00:01.281478 2026] [:error] [pid 9153:tid 9236] [client 20.166.7.149:9164] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "aeFp8eMHGxkTZX3c45dLPAAAAJI"]
[Fri Apr 17 07:00:01.981175 2026] [:error] [pid 25010:tid 25034] [client 20.166.7.149:9214] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX1.php"] [unique_id "aeFp8Y-7kkf42RarqQ3Y8wAAAVU"]
[Fri Apr 17 07:00:02.750341 2026] [:error] [pid 9263:tid 9268] [client 20.166.7.149:9211] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX1.php"] [unique_id "aeFp8hP68VyHNvj1e5462wAAAMM"]
[Fri Apr 17 07:00:03.594440 2026] [:error] [pid 9153:tid 9230] [client 20.166.7.149:9181] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX1.php"] [unique_id "aeFp8-MHGxkTZX3c45dLQwAAAIw"]
[Fri Apr 17 07:00:04.544481 2026] [:error] [pid 25010:tid 25031] [client 20.166.7.149:9179] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX1.php"] [unique_id "aeFp9I-7kkf42RarqQ3ZBQAAAVI"]
[Fri Apr 17 07:00:05.303079 2026] [:error] [pid 9153:tid 9224] [client 20.166.7.149:29784] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aeFp9eMHGxkTZX3c45dLUQAAAIY"]
[Fri Apr 17 07:00:05.940627 2026] [:error] [pid 25010:tid 25014] [client 20.166.7.149:29830] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aeFp9Y-7kkf42RarqQ3ZEgAAAUE"]
[Fri Apr 17 07:00:08.343312 2026] [:error] [pid 9153:tid 9224] [client 20.166.7.149:9152] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aeFp-OMHGxkTZX3c45dLWQAAAIY"]
[Fri Apr 17 07:00:09.597290 2026] [:error] [pid 9152:tid 9206] [client 20.166.7.149:29825] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aeFp-ZJYca8I3TNCwIc9WwAAAFA"]
[Fri Apr 17 07:00:11.236840 2026] [:error] [pid 9153:tid 9230] [client 20.166.7.149:9160] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "aeFp--MHGxkTZX3c45dLegAAAIw"]
[Fri Apr 17 07:00:12.600757 2026] [:error] [pid 9152:tid 9201] [client 20.166.7.149:29771] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "aeFp_JJYca8I3TNCwIc9ZAAAAEs"]
[Fri Apr 17 07:00:13.964565 2026] [:error] [pid 9263:tid 9266] [client 20.166.7.149:9108] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "aeFp_RP68VyHNvj1e546-wAAAME"]
[Fri Apr 17 07:00:15.120426 2026] [:error] [pid 9153:tid 9235] [client 20.166.7.149:29861] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "aeFp_-MHGxkTZX3c45dL4AAAAJE"]
[Fri Apr 17 07:00:15.715179 2026] [:error] [pid 51878:tid 51892] [client 20.166.7.149:9169] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeFp_0nQhUtMbw9EsgbDmwAAAQw"]
[Fri Apr 17 07:00:16.278922 2026] [:error] [pid 9152:tid 9195] [client 20.166.7.149:9174] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeFqAJJYca8I3TNCwIc9agAAAEU"]
[Fri Apr 17 07:00:17.026027 2026] [:error] [pid 9152:tid 9211] [client 20.166.7.149:9193] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeFqAZJYca8I3TNCwIc9bgAAAFU"]
[Fri Apr 17 07:00:17.675632 2026] [:error] [pid 9153:tid 9219] [client 20.166.7.149:9147] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeFqAeMHGxkTZX3c45dL7QAAAIE"]
[Fri Apr 17 07:00:18.828339 2026] [:error] [pid 9153:tid 9226] [client 20.166.7.149:9127] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeFqAuMHGxkTZX3c45dL9gAAAIg"]
[Fri Apr 17 07:00:20.163313 2026] [:error] [pid 9153:tid 9231] [client 20.166.7.149:9143] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeFqBOMHGxkTZX3c45dL_QAAAI0"]
[Fri Apr 17 07:00:21.930687 2026] [:error] [pid 25010:tid 25020] [client 20.166.7.149:29778] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeFqBY-7kkf42RarqQ3ZrgAAAUc"]
[Fri Apr 17 07:00:23.797603 2026] [:error] [pid 9263:tid 9279] [client 20.166.7.149:29820] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeFqBxP68VyHNvj1e547JAAAAM4"]
[Fri Apr 17 07:00:25.705583 2026] [:error] [pid 51878:tid 51900] [client 20.166.7.149:29790] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeFqCUnQhUtMbw9EsgbDxAAAARQ"]
[Fri Apr 17 07:00:27.398564 2026] [:error] [pid 9151:tid 9164] [client 20.166.7.149:29794] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeFqC8hTVuRPkua22vTDbQAAAAM"]
[Fri Apr 17 07:00:29.386861 2026] [:error] [pid 9153:tid 9231] [client 20.166.7.149:9040] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeFqDeMHGxkTZX3c45dMOwAAAI0"]
[Fri Apr 17 07:00:31.319777 2026] [:error] [pid 25010:tid 25035] [client 20.166.7.149:29821] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeFqD4-7kkf42RarqQ3Z7AAAAVY"]
[Fri Apr 17 07:00:33.330028 2026] [:error] [pid 9152:tid 9203] [client 20.166.7.149:9030] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aeFqEZJYca8I3TNCwIc9pAAAAE0"]
[Fri Apr 17 07:00:34.268037 2026] [:error] [pid 51878:tid 51887] [client 20.166.7.149:9061] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aeFqEknQhUtMbw9EsgbD3AAAAQc"]
[Fri Apr 17 07:00:35.670073 2026] [:error] [pid 9263:tid 9286] [client 20.166.7.149:29802] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aeFqExP68VyHNvj1e547RQAAANU"]
[Fri Apr 17 07:00:36.380959 2026] [:error] [pid 9263:tid 9269] [client 20.166.7.149:29804] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aeFqFBP68VyHNvj1e547SQAAAMQ"]
[Fri Apr 17 07:00:37.553677 2026] [:error] [pid 9263:tid 9277] [client 20.166.7.149:9094] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "aeFqFRP68VyHNvj1e547UwAAAMw"]
[Fri Apr 17 07:00:38.825848 2026] [:error] [pid 51878:tid 51893] [client 20.166.7.149:9157] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "aeFqFknQhUtMbw9EsgbD5AAAAQ0"]
[Fri Apr 17 07:00:39.802027 2026] [:error] [pid 51878:tid 51902] [client 20.166.7.149:29881] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "aeFqF0nQhUtMbw9EsgbD8wAAARY"]
[Fri Apr 17 07:00:40.838535 2026] [:error] [pid 9263:tid 9278] [client 20.166.7.149:9042] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "aeFqGBP68VyHNvj1e547YwAAAM0"]
[Fri Apr 17 07:00:41.615611 2026] [:error] [pid 9153:tid 9233] [client 20.166.7.149:29810] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeFqGeMHGxkTZX3c45dMcgAAAI8"]
[Fri Apr 17 07:00:42.214933 2026] [:error] [pid 9151:tid 9184] [client 20.166.7.149:29769] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeFqGshTVuRPkua22vTDogAAABc"]
[Fri Apr 17 07:00:42.873007 2026] [:error] [pid 9153:tid 9242] [client 20.166.7.149:9209] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeFqGuMHGxkTZX3c45dMfwAAAJg"]
[Fri Apr 17 07:00:43.694168 2026] [:error] [pid 9153:tid 9229] [client 20.166.7.149:9207] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeFqG-MHGxkTZX3c45dMiQAAAIs"]
[Fri Apr 17 07:00:44.370563 2026] [:error] [pid 9152:tid 9201] [client 20.166.7.149:9138] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "aeFqHJJYca8I3TNCwIc9wAAAAEs"]
[Fri Apr 17 07:00:45.231253 2026] [:error] [pid 9263:tid 9273] [client 20.166.7.149:9155] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "aeFqHRP68VyHNvj1e547bgAAAMg"]
[Fri Apr 17 07:00:48.404868 2026] [:error] [pid 25010:tid 25036] [client 20.166.7.149:9192] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "aeFqII-7kkf42RarqQ3aPgAAAVc"]
[Fri Apr 17 07:00:50.269060 2026] [:error] [pid 9153:tid 9230] [client 20.166.7.149:9101] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wtiiy.php"] [unique_id "aeFqIuMHGxkTZX3c45dMpgAAAIw"]
[Fri Apr 17 07:00:51.547805 2026] [:error] [pid 9153:tid 9235] [client 20.166.7.149:9097] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "aeFqI-MHGxkTZX3c45dMrgAAAJE"]
[Fri Apr 17 07:00:52.426452 2026] [:error] [pid 9153:tid 9222] [client 20.166.7.149:9185] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "aeFqJOMHGxkTZX3c45dMtAAAAIQ"]
[Fri Apr 17 07:00:53.296919 2026] [:error] [pid 25010:tid 25021] [client 20.166.7.149:9178] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "aeFqJY-7kkf42RarqQ3aXQAAAUg"]
[Fri Apr 17 07:00:54.199712 2026] [:error] [pid 9153:tid 9221] [client 20.166.7.149:9196] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "aeFqJuMHGxkTZX3c45dMugAAAIM"]
[Fri Apr 17 07:00:55.160317 2026] [:error] [pid 25010:tid 25029] [client 20.166.7.149:29795] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "aeFqJ4-7kkf42RarqQ3aawAAAVA"]
[Fri Apr 17 07:00:56.138286 2026] [:error] [pid 9153:tid 9229] [client 20.166.7.149:9148] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "aeFqKOMHGxkTZX3c45dMyQAAAIs"]
[Fri Apr 17 07:00:57.383824 2026] [:error] [pid 25010:tid 25029] [client 20.166.7.149:9099] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "aeFqKY-7kkf42RarqQ3afQAAAVA"]
[Fri Apr 17 07:00:59.719625 2026] [:error] [pid 9153:tid 9239] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Apr 17 07:00:59.978001 2026] [:error] [pid 9153:tid 9219] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Fri Apr 17 07:01:00.501445 2026] [:error] [pid 9153:tid 9226] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Apr 17 07:01:01.026524 2026] [:error] [pid 9153:tid 9218] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri Apr 17 07:01:01.280827 2026] [:error] [pid 9153:tid 9224] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Fri Apr 17 07:01:01.540904 2026] [:error] [pid 9153:tid 9232] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Fri Apr 17 07:01:01.795702 2026] [:error] [pid 9153:tid 9235] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Apr 17 07:01:02.050618 2026] [:error] [pid 9153:tid 9231] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Fri Apr 17 07:01:02.310956 2026] [:error] [pid 9153:tid 9220] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Fri Apr 17 07:01:02.565965 2026] [:error] [pid 9153:tid 9241] [client 20.166.7.149:9182] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 17 07:01:02.817419 2026] [:error] [pid 9153:tid 9227] [client 20.166.7.149:9182] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ta0ol.php"] [unique_id "aeFqLuMHGxkTZX3c45dM9QAAAIk"]
[Fri Apr 17 07:01:04.007806 2026] [:error] [pid 25010:tid 25016] [client 20.166.7.149:29823] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ta0ol.php"] [unique_id "aeFqMI-7kkf42RarqQ3alAAAAUM"]
[Fri Apr 17 07:01:05.335318 2026] [:error] [pid 51878:tid 51895] [client 20.166.7.149:9034] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ta0ol.php"] [unique_id "aeFqMUnQhUtMbw9EsgbEOwAAAQ8"]
[Fri Apr 17 07:01:07.415102 2026] [:error] [pid 9152:tid 9191] [client 20.166.7.149:9212] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ta0ol.php"] [unique_id "aeFqM5JYca8I3TNCwIc-KgAAAEE"]
[Fri Apr 17 07:01:09.768271 2026] [:error] [pid 9263:tid 9276] [client 20.166.7.149:9057] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aeFqNRP68VyHNvj1e547pQAAAMs"]
[Fri Apr 17 07:01:10.763306 2026] [:error] [pid 9152:tid 9192] [client 20.166.7.149:9187] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aeFqNpJYca8I3TNCwIc-RQAAAEI"]
[Fri Apr 17 07:01:11.528012 2026] [:error] [pid 25010:tid 25031] [client 20.166.7.149:9024] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aeFqN4-7kkf42RarqQ3aswAAAVI"]
[Fri Apr 17 07:01:12.189503 2026] [:error] [pid 9153:tid 9225] [client 20.166.7.149:9186] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aeFqOOMHGxkTZX3c45dNAwAAAIc"]
[Fri Apr 17 07:01:12.920458 2026] [:error] [pid 25010:tid 25027] [client 20.166.7.149:9130] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aeFqOI-7kkf42RarqQ3ayQAAAU4"]
[Fri Apr 17 07:01:13.764783 2026] [:error] [pid 9153:tid 9241] [client 20.166.7.149:9126] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aeFqOeMHGxkTZX3c45dNGgAAAJc"]
[Fri Apr 17 07:01:14.357077 2026] [:error] [pid 25010:tid 25024] [client 20.166.7.149:29856] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aeFqOo-7kkf42RarqQ3a1wAAAUs"]
[Fri Apr 17 07:01:14.859975 2026] [:error] [pid 51878:tid 51898] [client 20.166.7.149:9066] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aeFqOknQhUtMbw9EsgbETAAAARI"]
[Fri Apr 17 07:01:15.372515 2026] [:error] [pid 25010:tid 25019] [client 20.166.7.149:9100] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aeFqO4-7kkf42RarqQ3a4QAAAUY"]
[Fri Apr 17 07:01:15.888200 2026] [:error] [pid 51878:tid 51891] [client 20.166.7.149:9041] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aeFqO0nQhUtMbw9EsgbETwAAAQs"]
[Fri Apr 17 07:01:16.519497 2026] [:error] [pid 25010:tid 25025] [client 20.166.7.149:9044] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aeFqPI-7kkf42RarqQ3a8QAAAUw"]
[Fri Apr 17 07:01:17.274407 2026] [:error] [pid 25010:tid 25014] [client 20.166.7.149:9062] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aeFqPY-7kkf42RarqQ3bBQAAAUE"]
[Fri Apr 17 07:01:17.798150 2026] [:error] [pid 51878:tid 51880] [client 20.166.7.149:9215] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "aeFqPUnQhUtMbw9EsgbEWAAAAQA"]
[Fri Apr 17 07:01:18.386363 2026] [:error] [pid 9153:tid 9220] [client 20.166.7.149:9096] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "aeFqPuMHGxkTZX3c45dNNAAAAII"]
[Fri Apr 17 07:01:18.954250 2026] [:error] [pid 25010:tid 25029] [client 20.166.7.149:9203] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "aeFqPo-7kkf42RarqQ3bIAAAAVA"]
[Fri Apr 17 07:01:19.497531 2026] [:error] [pid 9152:tid 9197] [client 20.166.7.149:9115] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "aeFqP5JYca8I3TNCwIc-UAAAAEc"]
[Fri Apr 17 07:01:20.167612 2026] [:error] [pid 9152:tid 9207] [client 20.166.7.149:9132] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "aeFqQJJYca8I3TNCwIc-UgAAAFE"]
[Fri Apr 17 07:01:21.047200 2026] [:error] [pid 9152:tid 9214] [client 20.166.7.149:9171] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "aeFqQZJYca8I3TNCwIc-UwAAAFg"]
[Fri Apr 17 07:01:21.724414 2026] [:error] [pid 9151:tid 9170] [client 20.166.7.149:9204] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "aeFqQchTVuRPkua22vTD-gAAAAk"]
[Fri Apr 17 07:01:22.525656 2026] [:error] [pid 25010:tid 25035] [client 20.166.7.149:9109] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "aeFqQo-7kkf42RarqQ3bRgAAAVY"]
[Fri Apr 17 07:01:23.182324 2026] [:error] [pid 9153:tid 9225] [client 20.166.7.149:29799] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aeFqQ-MHGxkTZX3c45dNTwAAAIc"]
[Fri Apr 17 07:01:24.431955 2026] [:error] [pid 51878:tid 51901] [client 20.166.7.149:9038] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aeFqREnQhUtMbw9EsgbEaAAAARU"]
[Fri Apr 17 07:01:25.530172 2026] [:error] [pid 9263:tid 9287] [client 20.166.7.149:9188] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aeFqRRP68VyHNvj1e5470AAAANY"]
[Fri Apr 17 07:01:27.083404 2026] [:error] [pid 9152:tid 9195] [client 20.166.7.149:29841] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aeFqR5JYca8I3TNCwIc-eQAAAEU"]
[Fri Apr 17 07:01:28.242928 2026] [:error] [pid 9152:tid 9193] [client 20.166.7.149:29840] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "aeFqSJJYca8I3TNCwIc-iQAAAEM"]
[Fri Apr 17 07:01:30.212755 2026] [:error] [pid 25010:tid 25028] [client 20.166.7.149:9114] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "aeFqSo-7kkf42RarqQ3boAAAAU8"]
[Fri Apr 17 07:01:31.089744 2026] [:error] [pid 9152:tid 9209] [client 20.166.7.149:9029] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "aeFqS5JYca8I3TNCwIc-lQAAAFM"]
[Fri Apr 17 07:01:32.751549 2026] [:error] [pid 25010:tid 25030] [client 20.166.7.149:29850] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "aeFqTI-7kkf42RarqQ3bswAAAVE"]
[Fri Apr 17 07:01:33.861845 2026] [:error] [pid 25010:tid 25033] [client 20.166.7.149:9165] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aeFqTY-7kkf42RarqQ3bzAAAAVQ"]
[Fri Apr 17 07:01:34.519185 2026] [:error] [pid 51878:tid 51884] [client 20.166.7.149:9120] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aeFqTknQhUtMbw9EsgbEkgAAAQQ"]
[Fri Apr 17 07:01:35.234855 2026] [:error] [pid 25010:tid 25030] [client 20.166.7.149:9106] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aeFqT4-7kkf42RarqQ3b5QAAAVE"]
[Fri Apr 17 07:01:36.100037 2026] [:error] [pid 9153:tid 9225] [client 20.166.7.149:9111] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aeFqUOMHGxkTZX3c45dNnQAAAIc"]
[Fri Apr 17 07:01:37.220855 2026] [:error] [pid 9263:tid 9277] [client 20.166.7.149:9039] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeFqURP68VyHNvj1e5477wAAAMw"]
[Fri Apr 17 07:01:38.000965 2026] [:error] [pid 9153:tid 9221] [client 20.166.7.149:29843] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeFqUeMHGxkTZX3c45dNsQAAAIM"]
[Fri Apr 17 07:01:38.877692 2026] [:error] [pid 9153:tid 9241] [client 20.166.7.149:9202] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeFqUuMHGxkTZX3c45dNtgAAAJc"]
[Fri Apr 17 07:01:40.549629 2026] [:error] [pid 9153:tid 9224] [client 20.166.7.149:9052] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeFqVOMHGxkTZX3c45dNywAAAIY"]
[Fri Apr 17 07:01:41.642834 2026] [:error] [pid 51878:tid 51902] [client 20.166.7.149:9091] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "aeFqVUnQhUtMbw9EsgbEtAAAARY"]
[Fri Apr 17 07:01:43.918666 2026] [:error] [pid 9153:tid 9232] [client 20.166.7.149:8978] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "aeFqV-MHGxkTZX3c45dN3gAAAI4"]
[Fri Apr 17 07:01:45.175711 2026] [:error] [pid 51878:tid 51890] [client 20.166.7.149:9158] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "aeFqWUnQhUtMbw9EsgbExAAAAQo"]
[Fri Apr 17 07:01:46.975550 2026] [:error] [pid 9153:tid 9232] [client 20.166.7.149:9103] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "aeFqWuMHGxkTZX3c45dN6AAAAI4"]
[Fri Apr 17 07:01:48.245760 2026] [:error] [pid 9151:tid 9168] [client 20.166.7.149:9199] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aeFqXMhTVuRPkua22vTENQAAAAc"]
[Fri Apr 17 07:01:49.075188 2026] [:error] [pid 51878:tid 51880] [client 20.166.7.149:9054] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aeFqXUnQhUtMbw9EsgbEzQAAAQA"]
[Fri Apr 17 07:01:50.153283 2026] [:error] [pid 25010:tid 25018] [client 20.166.7.149:9117] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aeFqXo-7kkf42RarqQ3cEwAAAUU"]
[Fri Apr 17 07:01:51.265210 2026] [:error] [pid 9153:tid 9234] [client 20.166.7.149:9125] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aeFqX-MHGxkTZX3c45dOEwAAAJA"]
[Fri Apr 17 07:01:52.994586 2026] [:error] [pid 9152:tid 9205] [client 20.166.7.149:9095] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeFqYJJYca8I3TNCwIc-7gAAAE8"]
[Fri Apr 17 07:01:54.688660 2026] [:error] [pid 9153:tid 9237] [client 20.166.7.149:9025] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeFqYuMHGxkTZX3c45dOOQAAAJM"]
[Fri Apr 17 07:01:56.625361 2026] [:error] [pid 51878:tid 51884] [client 20.166.7.149:29832] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeFqZEnQhUtMbw9EsgbE-QAAAQQ"]
[Fri Apr 17 07:01:58.018479 2026] [:error] [pid 25010:tid 25034] [client 20.166.7.149:9166] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeFqZo-7kkf42RarqQ3cKAAAAVU"]
[Fri Apr 17 07:01:58.888251 2026] [:error] [pid 9153:tid 9238] [client 20.166.7.149:9189] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aeFqZuMHGxkTZX3c45dOYQAAAJQ"]
[Fri Apr 17 07:01:59.774206 2026] [:error] [pid 9263:tid 9270] [client 20.166.7.149:8967] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aeFqZxP68VyHNvj1e548HwAAAMU"]
[Fri Apr 17 07:02:00.996554 2026] [:error] [pid 9263:tid 9265] [client 20.166.7.149:9134] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aeFqaBP68VyHNvj1e548LAAAAMA"]
[Fri Apr 17 07:02:02.520947 2026] [:error] [pid 51878:tid 51887] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Fri Apr 17 07:02:02.798173 2026] [:error] [pid 51878:tid 51889] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/ogifomnzqnlvwh5womfjirvaCdefault.php
[Fri Apr 17 07:02:03.070359 2026] [:error] [pid 51878:tid 51904] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Fri Apr 17 07:02:03.371792 2026] [:error] [pid 51878:tid 51886] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/lmutxdvyp7u5yksqke8ozbjgCdefault.php
[Fri Apr 17 07:02:03.719787 2026] [:error] [pid 51878:tid 51898] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Fri Apr 17 07:02:03.990359 2026] [:error] [pid 51878:tid 51893] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Fri Apr 17 07:02:04.274072 2026] [:error] [pid 51878:tid 51888] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Fri Apr 17 07:02:04.585274 2026] [:error] [pid 51878:tid 51884] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Fri Apr 17 07:02:04.864918 2026] [:error] [pid 51878:tid 51900] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Apr 17 07:02:05.133900 2026] [:error] [pid 51878:tid 51892] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Fri Apr 17 07:02:05.398300 2026] [:error] [pid 51878:tid 51889] [client 20.166.7.149:9168] File does not exist: /usr/local/apache/htdocs/suspended-page/new3.php
[Fri Apr 17 07:02:05.659874 2026] [:error] [pid 51878:tid 51882] [client 20.166.7.149:9168] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "aeFqbUnQhUtMbw9EsgbFNgAAAQI"]
[Fri Apr 17 07:02:06.586786 2026] [:error] [pid 9153:tid 9234] [client 20.166.7.149:9153] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "aeFqbuMHGxkTZX3c45dOjgAAAJA"]
[Fri Apr 17 07:02:07.274799 2026] [:error] [pid 51878:tid 51886] [client 20.166.7.149:29813] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "aeFqb0nQhUtMbw9EsgbFOwAAAQY"]
[Fri Apr 17 07:02:08.041703 2026] [:error] [pid 9153:tid 9230] [client 20.166.7.149:9213] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nw.php"] [unique_id "aeFqcOMHGxkTZX3c45dOmgAAAIw"]
[Fri Apr 17 07:02:09.148316 2026] [:error] [pid 9153:tid 9237] [client 20.166.7.149:9137] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeFqceMHGxkTZX3c45dOogAAAJM"]
[Fri Apr 17 07:02:09.730446 2026] [:error] [pid 9153:tid 9225] [client 20.166.7.149:9144] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeFqceMHGxkTZX3c45dOpgAAAIc"]
[Fri Apr 17 07:02:10.363151 2026] [:error] [pid 9153:tid 9234] [client 20.166.7.149:9150] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeFqcuMHGxkTZX3c45dOrQAAAJA"]
[Fri Apr 17 07:02:11.129682 2026] [:error] [pid 9263:tid 9278] [client 20.166.7.149:9081] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeFqcxP68VyHNvj1e548QgAAAM0"]
[Fri Apr 17 07:02:11.909430 2026] [:error] [pid 25010:tid 25014] [client 20.166.7.149:9051] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "aeFqc4-7kkf42RarqQ3cXwAAAUE"]
[Fri Apr 17 07:02:13.324580 2026] [:error] [pid 9152:tid 9212] [client 20.166.7.149:9031] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "aeFqdZJYca8I3TNCwIc_OQAAAFY"]
[Fri Apr 17 07:02:14.654914 2026] [:error] [pid 9263:tid 9273] [client 20.166.7.149:9135] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "aeFqdhP68VyHNvj1e548VgAAAMg"]
[Fri Apr 17 07:02:15.891898 2026] [:error] [pid 9263:tid 9266] [client 20.166.7.149:9085] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rithin.php"] [unique_id "aeFqdxP68VyHNvj1e548ZQAAAME"]
[Fri Apr 17 07:02:16.678801 2026] [:error] [pid 9263:tid 9269] [client 20.166.7.149:9059] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aeFqeBP68VyHNvj1e548bAAAAMQ"]
[Fri Apr 17 07:02:18.403513 2026] [:error] [pid 25010:tid 25016] [client 20.166.7.149:9210] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aeFqeo-7kkf42RarqQ3cfwAAAUM"]
[Fri Apr 17 07:02:19.668829 2026] [:error] [pid 51878:tid 51885] [client 20.166.7.149:29829] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aeFqe0nQhUtMbw9EsgbFXAAAAQU"]
[Fri Apr 17 07:02:20.329664 2026] [:error] [pid 51878:tid 51896] [client 20.166.7.149:9035] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aeFqfEnQhUtMbw9EsgbFYAAAARA"]
[Fri Apr 17 07:02:21.285768 2026] [:error] [pid 9151:tid 9185] [client 20.166.7.149:9053] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "aeFqfchTVuRPkua22vTEnAAAABg"]
[Fri Apr 17 07:02:22.583281 2026] [:error] [pid 51878:tid 51885] [client 20.166.7.149:9112] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "aeFqfknQhUtMbw9EsgbFcgAAAQU"]
[Fri Apr 17 07:02:23.729732 2026] [:error] [pid 9151:tid 9163] [client 20.166.7.149:9123] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "aeFqf8hTVuRPkua22vTEpgAAAAI"]
[Fri Apr 17 07:02:24.618427 2026] [:error] [pid 9263:tid 9270] [client 20.166.7.149:9070] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "aeFqgBP68VyHNvj1e548kwAAAMU"]
[Fri Apr 17 07:02:25.522568 2026] [:error] [pid 51878:tid 51896] [client 20.166.7.149:9067] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "aeFqgUnQhUtMbw9EsgbFlwAAARA"]
[Fri Apr 17 07:02:27.332885 2026] [:error] [pid 51878:tid 51901] [client 20.166.7.149:9072] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "aeFqg0nQhUtMbw9EsgbFowAAARU"]
[Fri Apr 17 07:02:27.898856 2026] [:error] [pid 51878:tid 51896] [client 20.166.7.149:9032] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "aeFqg0nQhUtMbw9EsgbFqQAAARA"]
[Fri Apr 17 07:02:28.534404 2026] [:error] [pid 25010:tid 25018] [client 20.166.7.149:9069] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xsas.php"] [unique_id "aeFqhI-7kkf42RarqQ3cnQAAAUU"]
[Fri Apr 17 07:02:29.253820 2026] [:error] [pid 25010:tid 25031] [client 20.166.7.149:9045] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp/jp.php"] [unique_id "aeFqhY-7kkf42RarqQ3cpAAAAVI"]
[Fri Apr 17 07:02:29.842904 2026] [:error] [pid 9263:tid 9265] [client 20.166.7.149:9077] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp/jp.php"] [unique_id "aeFqhRP68VyHNvj1e548swAAAMA"]
[Fri Apr 17 07:02:30.425740 2026] [:error] [pid 9153:tid 9229] [client 20.166.7.149:9129] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp/jp.php"] [unique_id "aeFqhuMHGxkTZX3c45dO3QAAAIs"]
[Fri Apr 17 07:02:31.065620 2026] [:error] [pid 9153:tid 9227] [client 20.166.7.149:8996] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp/jp.php"] [unique_id "aeFqh-MHGxkTZX3c45dO6QAAAIk"]
[Fri Apr 17 07:02:31.727130 2026] [:error] [pid 25010:tid 25033] [client 20.166.7.149:29851] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeFqh4-7kkf42RarqQ3cuwAAAVQ"]
[Fri Apr 17 07:02:32.274316 2026] [:error] [pid 51878:tid 51897] [client 20.166.7.149:9065] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeFqiEnQhUtMbw9EsgbFvwAAARE"]
[Fri Apr 17 07:02:33.165535 2026] [:error] [pid 9153:tid 9221] [client 20.166.7.149:9124] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeFqieMHGxkTZX3c45dO_AAAAIM"]
[Fri Apr 17 07:02:34.086056 2026] [:error] [pid 9153:tid 9221] [client 20.166.7.149:9017] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeFqiuMHGxkTZX3c45dPDQAAAIM"]
[Fri Apr 17 07:02:34.654536 2026] [:error] [pid 51878:tid 51904] [client 20.166.7.149:8964] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeFqiknQhUtMbw9EsgbFxgAAARg"]
[Fri Apr 17 07:02:35.204001 2026] [:error] [pid 9152:tid 9192] [client 20.166.7.149:9092] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeFqi5JYca8I3TNCwIc_jAAAAEI"]
[Fri Apr 17 07:02:35.868711 2026] [:error] [pid 9263:tid 9286] [client 20.166.7.149:9088] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeFqixP68VyHNvj1e548xAAAANU"]
[Fri Apr 17 07:02:36.407199 2026] [:error] [pid 9263:tid 9272] [client 20.166.7.149:8960] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeFqjBP68VyHNvj1e548xwAAAMc"]
[Fri Apr 17 07:02:36.992829 2026] [:error] [pid 9263:tid 9270] [client 20.166.7.149:9098] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "aeFqjBP68VyHNvj1e548zQAAAMU"]
[Fri Apr 17 07:02:37.594603 2026] [:error] [pid 51878:tid 51885] [client 20.166.7.149:8972] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "aeFqjUnQhUtMbw9EsgbF1gAAAQU"]
[Fri Apr 17 07:02:38.160915 2026] [:error] [pid 9152:tid 9209] [client 20.166.7.149:9073] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "aeFqjpJYca8I3TNCwIc_mwAAAFM"]
[Fri Apr 17 07:02:38.831558 2026] [:error] [pid 9153:tid 9231] [client 20.166.7.149:9119] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp9.php"] [unique_id "aeFqjuMHGxkTZX3c45dPLQAAAI0"]
[Fri Apr 17 07:02:41.735000 2026] [:error] [pid 9153:tid 9220] [client 20.166.7.149:9122] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "aeFqkeMHGxkTZX3c45dPQwAAAII"]
[Fri Apr 17 07:02:45.335803 2026] [:error] [pid 9152:tid 9199] [client 20.166.7.149:8970] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "aeFqlZJYca8I3TNCwIc_sQAAAEk"]
[Fri Apr 17 07:02:49.474127 2026] [:error] [pid 9263:tid 9265] [client 20.166.7.149:9118] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "aeFqmRP68VyHNvj1e549DQAAAMA"]
[Fri Apr 17 07:02:50.930871 2026] [:error] [pid 25010:tid 25021] [client 20.166.7.149:9154] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "aeFqmo-7kkf42RarqQ3dPAAAAUg"]
[Fri Apr 17 07:02:52.469835 2026] [:error] [pid 9152:tid 9208] [client 20.166.7.149:8968] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "aeFqnJJYca8I3TNCwIc_vAAAAFI"]
[Fri Apr 17 07:02:54.728335 2026] [:error] [pid 9153:tid 9240] [client 20.166.7.149:8646] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "aeFqnuMHGxkTZX3c45dPeAAAAJY"]
[Fri Apr 17 07:02:56.291703 2026] [:error] [pid 9263:tid 9287] [client 20.166.7.149:9056] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "aeFqoBP68VyHNvj1e549KAAAANY"]
[Fri Apr 17 07:02:57.670671 2026] [:error] [pid 25010:tid 25027] [client 20.166.7.149:29882] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/motu.php"] [unique_id "aeFqoY-7kkf42RarqQ3dcQAAAU4"]
[Fri Apr 17 07:02:58.498606 2026] [:error] [pid 25010:tid 25023] [client 20.166.7.149:9055] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "aeFqoo-7kkf42RarqQ3dgQAAAUo"]
[Fri Apr 17 07:02:59.399675 2026] [:error] [pid 51878:tid 51887] [client 20.166.7.149:9084] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "aeFqo0nQhUtMbw9EsgbGHAAAAQc"]
[Fri Apr 17 07:03:00.284565 2026] [:error] [pid 25010:tid 25013] [client 20.166.7.149:9133] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "aeFqpI-7kkf42RarqQ3dkQAAAUA"]
[Fri Apr 17 07:03:00.918887 2026] [:error] [pid 9153:tid 9234] [client 20.166.7.149:9200] [client 20.166.7.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "aeFqpOMHGxkTZX3c45dPpgAAAJA"]
[Fri Apr 17 13:41:34.450466 2026] [:error] [pid 61523:tid 61561] [client 206.189.150.30:56285] [client 206.189.150.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 206.189.150.30, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aeHIDsOaH-Pgc7WEf4M2swAAAdM"]
[Fri Apr 17 13:41:34.454177 2026] [:error] [pid 61523:tid 61561] [client 206.189.150.30:56285] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 17 13:41:34.646062 2026] [:error] [pid 61523:tid 61557] [client 206.189.150.30:56285] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "aeHIDsOaH-Pgc7WEf4M2ugAAAc8"]
[Fri Apr 17 13:41:34.824589 2026] [:error] [pid 61523:tid 61555] [client 206.189.150.30:57268] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "aeHIDsOaH-Pgc7WEf4M2uwAAAc0"]
[Fri Apr 17 13:41:34.999553 2026] [:error] [pid 25010:tid 25022] [client 206.189.150.30:57540] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "aeHIDo-7kkf42RarqQ1AWQAAAUk"]
[Fri Apr 17 13:41:35.174491 2026] [:error] [pid 34273:tid 34283] [client 206.189.150.30:57768] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "aeHID2uQDW686mK3dgG7qgAAAYg"]
[Fri Apr 17 13:41:35.351887 2026] [:error] [pid 61523:tid 61563] [client 206.189.150.30:58068] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "aeHID8OaH-Pgc7WEf4M2wAAAAdU"]
[Fri Apr 17 13:41:35.525623 2026] [:error] [pid 61523:tid 61564] [client 206.189.150.30:58342] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "aeHID8OaH-Pgc7WEf4M2xAAAAdY"]
[Fri Apr 17 13:41:35.717559 2026] [:error] [pid 61523:tid 61561] [client 206.189.150.30:58687] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "aeHID8OaH-Pgc7WEf4M2xwAAAdM"]
[Fri Apr 17 13:41:35.900014 2026] [:error] [pid 61523:tid 61557] [client 206.189.150.30:58965] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "aeHID8OaH-Pgc7WEf4M2ywAAAc8"]
[Fri Apr 17 13:41:36.125306 2026] [:error] [pid 9263:tid 9288] [client 206.189.150.30:59261] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "aeHIEBP68VyHNvj1e56M8QAAANc"]
[Fri Apr 17 13:41:36.313983 2026] [:error] [pid 34273:tid 34280] [client 206.189.150.30:59574] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aeHIEGuQDW686mK3dgG7rwAAAYU"]
[Fri Apr 17 13:41:36.696176 2026] [:error] [pid 34273:tid 34291] [client 206.189.150.30:59831] [client 206.189.150.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aeHIEGuQDW686mK3dgG7sAAAAZA"]
[Sat Apr 18 10:08:23.216584 2026] [:error] [pid 9865:tid 9943] [client 20.203.143.130:37012] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sat Apr 18 10:08:23.476067 2026] [:error] [pid 9865:tid 9941] [client 20.203.143.130:37012] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Sat Apr 18 10:08:23.837091 2026] [:error] [pid 9865:tid 9944] [client 20.203.143.130:37012] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sat Apr 18 10:08:24.095109 2026] [:error] [pid 9865:tid 9950] [client 20.203.143.130:37012] File does not exist: /usr/local/apache/htdocs/suspended-page/mifta.php
[Sat Apr 18 10:08:24.349777 2026] [:error] [pid 9865:tid 9955] [client 20.203.143.130:37012] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Sat Apr 18 10:08:24.590015 2026] [:error] [pid 9865:tid 9945] [client 20.203.143.130:37012] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Sat Apr 18 10:08:24.838752 2026] [:error] [pid 9865:tid 9947] [client 20.203.143.130:37012] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Sat Apr 18 10:08:25.100137 2026] [:error] [pid 9865:tid 9937] [client 20.203.143.130:37012] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Sat Apr 18 10:08:25.492895 2026] [:error] [pid 9865:tid 9949] [client 20.203.143.130:37012] [client 20.203.143.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeLnmazb5knECIY-C-j3TwAAAIw"]
[Sat Apr 18 10:08:26.465882 2026] [:error] [pid 9863:tid 9885] [client 20.203.143.130:37021] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Sat Apr 18 10:08:26.704495 2026] [:error] [pid 9863:tid 9889] [client 20.203.143.130:37021] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Sat Apr 18 10:08:26.940306 2026] [:error] [pid 9863:tid 9896] [client 20.203.143.130:37021] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "aeLnmjjjiypiFrTucbJNDQAAABc"]
[Sat Apr 18 10:08:30.461347 2026] [:error] [pid 9970:tid 9984] [client 20.203.143.130:65326] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "aeLnniYdRLRhVmaIMx0hrQAAAMo"]
[Sat Apr 18 10:08:32.110165 2026] [:error] [pid 9864:tid 9924] [client 20.203.143.130:65336] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "aeLnoICFeowknfXHM7lrIQAAAFI"]
[Sat Apr 18 10:08:33.183884 2026] [:error] [pid 34288:tid 34314] [client 20.203.143.130:37029] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "aeLnoeTIiy__PtiLmplw6wAAAZY"]
[Sat Apr 18 10:08:34.752451 2026] [:error] [pid 34288:tid 34301] [client 20.203.143.130:4385] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny2.php"] [unique_id "aeLnouTIiy__PtiLmplw7QAAAYk"]
[Sat Apr 18 10:08:38.693580 2026] [:error] [pid 34288:tid 34303] [client 20.203.143.130:64864] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny2.php"] [unique_id "aeLnpuTIiy__PtiLmplw8gAAAYs"]
[Sat Apr 18 10:08:39.883304 2026] [:error] [pid 9863:tid 9873] [client 20.203.143.130:37004] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny2.php"] [unique_id "aeLnpzjjiypiFrTucbJNHAAAAAA"]
[Sat Apr 18 10:08:50.412960 2026] [:error] [pid 9970:tid 9979] [client 20.203.143.130:37007] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/state.php"] [unique_id "aeLnsiYdRLRhVmaIMx0hvwAAAMU"]
[Sat Apr 18 10:08:51.817737 2026] [:error] [pid 34288:tid 34307] [client 20.203.143.130:65307] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/state.php"] [unique_id "aeLns-TIiy__PtiLmplw8wAAAY8"]
[Sat Apr 18 10:08:53.012812 2026] [:error] [pid 9863:tid 9896] [client 20.203.143.130:4397] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/state.php"] [unique_id "aeLntTjjiypiFrTucbJNMAAAABc"]
[Sat Apr 18 10:08:54.412085 2026] [:error] [pid 34237:tid 34259] [client 20.203.143.130:64855] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/state.php"] [unique_id "aeLnthBmX4Wq5a6rxfYTOAAAAVQ"]
[Sat Apr 18 10:08:55.255710 2026] [:error] [pid 9865:tid 9956] [client 20.203.143.130:65335] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "aeLnt6zb5knECIY-C-j3VgAAAJM"]
[Sat Apr 18 10:08:56.453007 2026] [:error] [pid 9863:tid 9891] [client 20.203.143.130:65294] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "aeLnuDjjiypiFrTucbJNNgAAABI"]
[Sat Apr 18 10:08:57.698832 2026] [:error] [pid 13023:tid 13036] [client 20.203.143.130:65360] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "aeLnuf1e7hG8DAeABB9uywAAAQs"]
[Sat Apr 18 10:08:59.907107 2026] [:error] [pid 34288:tid 34310] [client 20.203.143.130:4383] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "aeLnu-TIiy__PtiLmplw-gAAAZI"]
[Sat Apr 18 10:09:01.422904 2026] [:error] [pid 34290:tid 34327] [client 20.203.143.130:36994] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aeLnvRqX6WpmmAXOBi-KcgAAAcg"]
[Sat Apr 18 10:09:03.581458 2026] [:error] [pid 9970:tid 9985] [client 20.203.143.130:37040] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aeLnvyYdRLRhVmaIMx0hxgAAAMs"]
[Sat Apr 18 10:09:06.829408 2026] [:error] [pid 9863:tid 9878] [client 20.203.143.130:65387] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aeLnwjjjiypiFrTucbJNPAAAAAU"]
[Sat Apr 18 10:09:13.980115 2026] [:error] [pid 34290:tid 34340] [client 20.203.143.130:4365] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aeLnyRqX6WpmmAXOBi-KfAAAAdU"]
[Sat Apr 18 10:09:15.489952 2026] [:error] [pid 9970:tid 9987] [client 20.203.143.130:4395] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aeLnyyYdRLRhVmaIMx0h2QAAAM0"]
[Sat Apr 18 10:09:17.526578 2026] [:error] [pid 13023:tid 13044] [client 20.203.143.130:65349] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aeLnzf1e7hG8DAeABB9u2gAAARM"]
[Sat Apr 18 10:09:19.287091 2026] [:error] [pid 9863:tid 9892] [client 20.203.143.130:37006] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aeLnzzjjiypiFrTucbJNZgAAABM"]
[Sat Apr 18 10:09:20.174820 2026] [:error] [pid 9865:tid 9955] [client 20.203.143.130:65362] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aeLn0Kzb5knECIY-C-j3awAAAJI"]
[Sat Apr 18 10:09:24.608005 2026] [:error] [pid 13023:tid 13039] [client 20.203.143.130:4394] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "aeLn1P1e7hG8DAeABB9u5QAAAQ4"]
[Sat Apr 18 10:09:25.672483 2026] [:error] [pid 9865:tid 9937] [client 20.203.143.130:65304] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "aeLn1azb5knECIY-C-j3bwAAAIA"]
[Sat Apr 18 10:09:26.902692 2026] [:error] [pid 9863:tid 9887] [client 20.203.143.130:4353] File does not exist: /usr/local/apache/htdocs/suspended-page/wgift1.php
[Sat Apr 18 10:09:27.141318 2026] [:error] [pid 9863:tid 9891] [client 20.203.143.130:4353] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Sat Apr 18 10:09:27.401461 2026] [:error] [pid 9863:tid 9893] [client 20.203.143.130:4353] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Sat Apr 18 10:09:27.640188 2026] [:error] [pid 9863:tid 9880] [client 20.203.143.130:4353] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sat Apr 18 10:09:28.137771 2026] [:error] [pid 9863:tid 9890] [client 20.203.143.130:4353] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sat Apr 18 10:09:28.437398 2026] [:error] [pid 9863:tid 9876] [client 20.203.143.130:4353] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Sat Apr 18 10:09:28.912322 2026] [:error] [pid 9863:tid 9879] [client 20.203.143.130:4353] [client 20.203.143.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aeLn2DjjiypiFrTucbJNfAAAAAY"]
[Sat Apr 18 10:09:29.727549 2026] [:error] [pid 34288:tid 34313] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Sat Apr 18 10:09:29.985796 2026] [:error] [pid 34288:tid 34304] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Sat Apr 18 10:09:30.244572 2026] [:error] [pid 34288:tid 34311] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sat Apr 18 10:09:30.494966 2026] [:error] [pid 34288:tid 34302] [client 20.203.143.130:64836] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeLn2uTIiy__PtiLmplxKQAAAYo"]
[Sat Apr 18 10:09:33.122597 2026] [:error] [pid 13023:tid 13049] [client 20.203.143.130:64865] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeLn3f1e7hG8DAeABB9u6AAAARg"]
[Sat Apr 18 10:09:34.397556 2026] [:error] [pid 13023:tid 13035] [client 20.203.143.130:64837] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeLn3v1e7hG8DAeABB9u7QAAAQo"]
[Sat Apr 18 10:09:42.548869 2026] [:error] [pid 9864:tid 9924] [client 20.203.143.130:37053] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeLn5oCFeowknfXHM7lrUAAAAFI"]
[Sat Apr 18 10:09:44.997711 2026] [:error] [pid 34237:tid 34239] [client 20.203.143.130:65319] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/footer.php"] [unique_id "aeLn6BBmX4Wq5a6rxfYTQgAAAUA"]
[Sat Apr 18 10:09:47.830366 2026] [:error] [pid 9864:tid 9908] [client 20.203.143.130:65376] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/footer.php"] [unique_id "aeLn64CFeowknfXHM7lrVAAAAEM"]
[Sat Apr 18 10:09:49.923587 2026] [:error] [pid 9865:tid 9940] [client 20.203.143.130:4357] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/footer.php"] [unique_id "aeLn7azb5knECIY-C-j3hQAAAIM"]
[Sat Apr 18 10:09:51.441585 2026] [:error] [pid 9864:tid 9917] [client 20.203.143.130:4369] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/footer.php"] [unique_id "aeLn74CFeowknfXHM7lrWgAAAEs"]
[Sat Apr 18 10:09:54.563615 2026] [:error] [pid 9863:tid 9886] [client 20.203.143.130:65380] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/img.php"] [unique_id "aeLn8jjjiypiFrTucbJNoQAAAA0"]
[Sat Apr 18 10:09:55.924792 2026] [:error] [pid 13023:tid 13035] [client 20.203.143.130:4409] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/img.php"] [unique_id "aeLn8_1e7hG8DAeABB9vEgAAAQo"]
[Sat Apr 18 10:09:57.975100 2026] [:error] [pid 9970:tid 9975] [client 20.203.143.130:4358] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/img.php"] [unique_id "aeLn9SYdRLRhVmaIMx0iDwAAAME"]
[Sat Apr 18 10:10:00.160399 2026] [:error] [pid 13023:tid 13034] [client 20.203.143.130:4379] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/img.php"] [unique_id "aeLn-P1e7hG8DAeABB9vGgAAAQk"]
[Sat Apr 18 10:10:02.700106 2026] [:error] [pid 9863:tid 9874] [client 20.203.143.130:65296] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "aeLn-jjjiypiFrTucbJNqAAAAAE"]
[Sat Apr 18 10:10:06.729260 2026] [:error] [pid 34288:tid 34294] [client 20.203.143.130:65348] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "aeLn_uTIiy__PtiLmplxQgAAAYI"]
[Sat Apr 18 10:10:07.641621 2026] [:error] [pid 9864:tid 9920] [client 20.203.143.130:4362] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "aeLn_4CFeowknfXHM7lrbQAAAE4"]
[Sat Apr 18 10:10:08.446786 2026] [:error] [pid 34288:tid 34298] [client 20.203.143.130:65390] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "aeLoAOTIiy__PtiLmplxRgAAAYY"]
[Sat Apr 18 10:10:09.962792 2026] [:error] [pid 9865:tid 9943] [client 20.203.143.130:4407] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeLoAazb5knECIY-C-j3nQAAAIY"]
[Sat Apr 18 10:10:10.811423 2026] [:error] [pid 9863:tid 9892] [client 20.203.143.130:4361] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeLoAjjjiypiFrTucbJNrQAAABM"]
[Sat Apr 18 10:10:17.299204 2026] [:error] [pid 34288:tid 34309] [client 20.203.143.130:64866] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeLoCeTIiy__PtiLmplxVAAAAZE"]
[Sat Apr 18 10:10:27.846301 2026] [:error] [pid 34288:tid 34299] [client 20.203.143.130:65339] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeLoE-TIiy__PtiLmplxWwAAAYc"]
[Sat Apr 18 10:10:30.000981 2026] [:error] [pid 34237:tid 34246] [client 20.203.143.130:64833] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeLoFRBmX4Wq5a6rxfYTYAAAAUc"]
[Sat Apr 18 10:10:30.829864 2026] [:error] [pid 9865:tid 9946] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Sat Apr 18 10:10:31.957753 2026] [:error] [pid 9865:tid 9946] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sat Apr 18 10:10:32.252915 2026] [:error] [pid 9865:tid 9938] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Sat Apr 18 10:10:32.500412 2026] [:error] [pid 9865:tid 9940] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Sat Apr 18 10:10:32.842940 2026] [:error] [pid 9865:tid 9957] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Apr 18 10:10:33.096855 2026] [:error] [pid 9865:tid 9961] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Apr 18 10:10:33.418348 2026] [:error] [pid 9865:tid 9950] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sat Apr 18 10:10:33.664140 2026] [:error] [pid 9865:tid 9953] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Apr 18 10:10:33.903454 2026] [:error] [pid 9865:tid 9947] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Sat Apr 18 10:10:34.387306 2026] [:error] [pid 9865:tid 9945] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Sat Apr 18 10:10:34.625079 2026] [:error] [pid 9865:tid 9954] [client 20.203.143.130:37002] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Sat Apr 18 10:10:34.999522 2026] [:error] [pid 9865:tid 9943] [client 20.203.143.130:37002] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeLoGqzb5knECIY-C-j3wQAAAIY"]
[Sat Apr 18 10:10:37.372570 2026] [:error] [pid 34288:tid 34293] [client 20.203.143.130:64310] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeLoHeTIiy__PtiLmplxbQAAAYE"]
[Sat Apr 18 10:10:38.338575 2026] [:error] [pid 34288:tid 34312] [client 20.203.143.130:65288] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeLoHuTIiy__PtiLmplxbgAAAZQ"]
[Sat Apr 18 10:10:40.236915 2026] [:error] [pid 13023:tid 13042] [client 20.203.143.130:37008] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeLoIP1e7hG8DAeABB9vawAAARE"]
[Sat Apr 18 10:10:41.678421 2026] [:error] [pid 13023:tid 13041] [client 20.203.143.130:64877] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1s7y8wt9dz.php"] [unique_id "aeLoIf1e7hG8DAeABB9vbwAAARA"]
[Sat Apr 18 10:10:52.697792 2026] [:error] [pid 9863:tid 9881] [client 20.203.143.130:64854] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1s7y8wt9dz.php"] [unique_id "aeLoLDjjiypiFrTucbJODwAAAAg"]
[Sat Apr 18 10:10:54.574322 2026] [:error] [pid 9863:tid 9895] [client 20.203.143.130:37013] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1s7y8wt9dz.php"] [unique_id "aeLoLjjjiypiFrTucbJOGQAAABY"]
[Sat Apr 18 10:11:10.585106 2026] [:error] [pid 9970:tid 9993] [client 20.203.143.130:65316] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bdktk.php"] [unique_id "aeLoPiYdRLRhVmaIMx0irgAAANM"]
[Sat Apr 18 10:11:12.010016 2026] [:error] [pid 9864:tid 9916] [client 20.203.143.130:65392] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v5.php"] [unique_id "aeLoQICFeowknfXHM7lrwgAAAEo"]
[Sat Apr 18 10:11:16.215799 2026] [:error] [pid 9970:tid 9974] [client 20.203.143.130:4393] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v5.php"] [unique_id "aeLoRCYdRLRhVmaIMx0ivAAAAMA"]
[Sat Apr 18 10:11:21.816830 2026] [:error] [pid 9865:tid 9952] [client 20.203.143.130:37011] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v5.php"] [unique_id "aeLoSazb5knECIY-C-j39AAAAI8"]
[Sat Apr 18 10:11:22.517771 2026] [:error] [pid 9970:tid 9990] [client 20.203.143.130:64873] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v5.php"] [unique_id "aeLoSiYdRLRhVmaIMx0izgAAANA"]
[Sat Apr 18 10:11:26.057454 2026] [:error] [pid 34288:tid 34305] [client 20.203.143.130:65403] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "aeLoTuTIiy__PtiLmplx3gAAAY0"]
[Sat Apr 18 10:11:28.837718 2026] [:error] [pid 9970:tid 9977] [client 20.203.143.130:65359] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "aeLoUCYdRLRhVmaIMx0i3AAAAMM"]
[Sat Apr 18 10:11:33.248720 2026] [:error] [pid 34237:tid 34259] [client 20.203.143.130:37046] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "aeLoVRBmX4Wq5a6rxfYTmgAAAVQ"]
[Sat Apr 18 10:11:34.439295 2026] [:error] [pid 34290:tid 34323] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Sat Apr 18 10:11:34.710291 2026] [:error] [pid 34290:tid 34334] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/ws87.php
[Sat Apr 18 10:11:35.007407 2026] [:error] [pid 34290:tid 34336] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Sat Apr 18 10:11:35.277002 2026] [:error] [pid 34290:tid 34335] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Sat Apr 18 10:11:35.552882 2026] [:error] [pid 34290:tid 34327] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Sat Apr 18 10:11:35.837948 2026] [:error] [pid 34290:tid 34321] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/006.php
[Sat Apr 18 10:11:36.106999 2026] [:error] [pid 34290:tid 34328] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Sat Apr 18 10:11:36.378139 2026] [:error] [pid 34290:tid 34330] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/zogy1.php
[Sat Apr 18 10:11:36.666876 2026] [:error] [pid 34290:tid 34341] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/aios-bootstrap.php
[Sat Apr 18 10:11:36.946393 2026] [:error] [pid 34290:tid 34338] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sat Apr 18 10:11:37.216739 2026] [:error] [pid 34290:tid 34340] [client 20.203.143.130:65388] File does not exist: /usr/local/apache/htdocs/suspended-page/gz.php
[Sat Apr 18 10:11:37.496577 2026] [:error] [pid 34290:tid 34320] [client 20.203.143.130:65388] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "aeLoWRqX6WpmmAXOBi-KwgAAAcE"]
[Sat Apr 18 10:11:39.269096 2026] [:error] [pid 9970:tid 9984] [client 20.203.143.130:65280] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "aeLoWyYdRLRhVmaIMx0i_QAAAMo"]
[Sat Apr 18 10:11:40.331131 2026] [:error] [pid 34237:tid 34247] [client 20.203.143.130:4386] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "aeLoXBBmX4Wq5a6rxfYTnwAAAUg"]
[Sat Apr 18 10:11:42.409404 2026] [:error] [pid 9863:tid 9894] [client 20.203.143.130:65291] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "aeLoXjjjiypiFrTucbJOgAAAABU"]
[Sat Apr 18 10:12:08.935111 2026] [:error] [pid 9863:tid 9897] [client 20.203.143.130:65318] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qqa.php"] [unique_id "aeLoeDjjiypiFrTucbJOxgAAABg"]
[Sat Apr 18 10:12:12.438711 2026] [:error] [pid 9863:tid 9880] [client 20.203.143.130:65344] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qqa.php"] [unique_id "aeLofDjjiypiFrTucbJOzgAAAAc"]
[Sat Apr 18 10:12:13.704281 2026] [:error] [pid 34288:tid 34310] [client 20.203.143.130:65343] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qqa.php"] [unique_id "aeLofeTIiy__PtiLmplyFAAAAZI"]
[Sat Apr 18 10:12:15.039562 2026] [:error] [pid 34288:tid 34296] [client 20.203.143.130:64846] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qqa.php"] [unique_id "aeLof-TIiy__PtiLmplyFgAAAYQ"]
[Sat Apr 18 10:12:17.770490 2026] [:error] [pid 34288:tid 34311] [client 20.203.143.130:65310] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeLogeTIiy__PtiLmplyIQAAAZM"]
[Sat Apr 18 10:12:18.953566 2026] [:error] [pid 34237:tid 34256] [client 20.203.143.130:65364] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeLoghBmX4Wq5a6rxfYTrQAAAVE"]
[Sat Apr 18 10:12:21.246815 2026] [:error] [pid 34237:tid 34254] [client 20.203.143.130:64786] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeLohRBmX4Wq5a6rxfYTrgAAAU8"]
[Sat Apr 18 10:12:23.736473 2026] [:error] [pid 9863:tid 9879] [client 20.203.143.130:64784] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeLohzjjiypiFrTucbJO5AAAAAY"]
[Sat Apr 18 10:12:24.930133 2026] [:error] [pid 9863:tid 9886] [client 20.203.143.130:65313] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ga.php"] [unique_id "aeLoiDjjiypiFrTucbJO6gAAAA0"]
[Sat Apr 18 10:12:31.074256 2026] [:error] [pid 34237:tid 34262] [client 20.203.143.130:65367] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ga.php"] [unique_id "aeLojxBmX4Wq5a6rxfYTsQAAAVc"]
[Sat Apr 18 10:12:39.713017 2026] [:error] [pid 34288:tid 34297] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/xozx.php
[Sat Apr 18 10:12:39.951686 2026] [:error] [pid 34288:tid 34310] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/1100.php
[Sat Apr 18 10:12:40.193172 2026] [:error] [pid 34288:tid 34307] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Sat Apr 18 10:12:40.434576 2026] [:error] [pid 34288:tid 34294] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Apr 18 10:12:40.699581 2026] [:error] [pid 34288:tid 34299] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kz.php
[Sat Apr 18 10:12:40.959605 2026] [:error] [pid 34288:tid 34313] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lo.php
[Sat Apr 18 10:12:41.198228 2026] [:error] [pid 34288:tid 34308] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Sat Apr 18 10:12:41.467383 2026] [:error] [pid 34288:tid 34296] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/Ipv6.php
[Sat Apr 18 10:12:41.712589 2026] [:error] [pid 34288:tid 34314] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/file-gertdxz.php
[Sat Apr 18 10:12:41.963267 2026] [:error] [pid 34288:tid 34303] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Sat Apr 18 10:12:42.226093 2026] [:error] [pid 34288:tid 34304] [client 20.203.143.130:65369] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Sat Apr 18 10:12:42.470334 2026] [:error] [pid 34288:tid 34312] [client 20.203.143.130:65369] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wglum1.php"] [unique_id "aeLomuTIiy__PtiLmplyZwAAAZQ"]
[Sat Apr 18 10:13:04.302229 2026] [:error] [pid 9970:tid 9997] [client 20.203.143.130:4352] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aeLosCYdRLRhVmaIMx0kNwAAANc"]
[Sat Apr 18 10:13:07.392921 2026] [:error] [pid 9865:tid 9939] [client 20.203.143.130:65320] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aeLos6zb5knECIY-C-j4VgAAAII"]
[Sat Apr 18 10:13:09.078713 2026] [:error] [pid 9864:tid 9916] [client 20.203.143.130:65406] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aeLotYCFeowknfXHM7lr_QAAAEo"]
[Sat Apr 18 10:13:10.186733 2026] [:error] [pid 9863:tid 9897] [client 20.203.143.130:37025] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aeLotjjjiypiFrTucbJQYwAAABg"]
[Sat Apr 18 10:13:11.518087 2026] [:error] [pid 13023:tid 13028] [client 20.203.143.130:64794] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper.php"] [unique_id "aeLot_1e7hG8DAeABB9w8AAAAQM"]
[Sat Apr 18 10:13:12.133376 2026] [:error] [pid 9970:tid 9978] [client 20.203.143.130:64321] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper.php"] [unique_id "aeLouCYdRLRhVmaIMx0kPwAAAMQ"]
[Sat Apr 18 10:13:20.810727 2026] [:error] [pid 9865:tid 9945] [client 20.203.143.130:64284] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper.php"] [unique_id "aeLowKzb5knECIY-C-j4bgAAAIg"]
[Sat Apr 18 10:13:22.796322 2026] [:error] [pid 9863:tid 9880] [client 20.203.143.130:65285] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper.php"] [unique_id "aeLowjjjiypiFrTucbJQcgAAAAc"]
[Sat Apr 18 10:13:24.432558 2026] [:error] [pid 9864:tid 9929] [client 20.203.143.130:65371] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wxpass.php"] [unique_id "aeLoxICFeowknfXHM7lsBgAAAFc"]
[Sat Apr 18 10:13:26.823777 2026] [:error] [pid 9863:tid 9884] [client 20.203.143.130:36994] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wxpass.php"] [unique_id "aeLoxjjjiypiFrTucbJQdAAAAAs"]
[Sat Apr 18 10:13:28.089785 2026] [:error] [pid 34290:tid 34327] [client 20.203.143.130:4359] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wxpass.php"] [unique_id "aeLoyBqX6WpmmAXOBi-K-wAAAcg"]
[Sat Apr 18 10:13:29.952660 2026] [:error] [pid 34237:tid 34243] [client 20.203.143.130:64847] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wxpass.php"] [unique_id "aeLoyRBmX4Wq5a6rxfYT9QAAAUQ"]
[Sat Apr 18 10:13:30.588839 2026] [:error] [pid 9863:tid 9882] [client 20.203.143.130:64273] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "aeLoyjjjiypiFrTucbJQegAAAAk"]
[Sat Apr 18 10:13:32.059597 2026] [:error] [pid 9863:tid 9879] [client 20.203.143.130:65393] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "aeLozDjjiypiFrTucbJQfQAAAAY"]
[Sat Apr 18 10:13:37.505545 2026] [:error] [pid 9863:tid 9893] [client 20.203.143.130:4364] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "aeLo0TjjiypiFrTucbJQjwAAABQ"]
[Sat Apr 18 10:13:45.853475 2026] [:error] [pid 9970:tid 9981] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sat Apr 18 10:13:46.093454 2026] [:error] [pid 9970:tid 9995] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/x3x.php
[Sat Apr 18 10:13:46.332619 2026] [:error] [pid 9970:tid 9980] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Sat Apr 18 10:13:46.572736 2026] [:error] [pid 9970:tid 9996] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/global.php
[Sat Apr 18 10:13:46.811928 2026] [:error] [pid 9970:tid 9990] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Apr 18 10:13:47.074785 2026] [:error] [pid 9970:tid 9975] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Sat Apr 18 10:13:47.320173 2026] [:error] [pid 9970:tid 9984] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Sat Apr 18 10:13:47.572610 2026] [:error] [pid 9970:tid 9976] [client 20.203.143.130:64836] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Sat Apr 18 10:13:47.810991 2026] [:error] [pid 9970:tid 9997] [client 20.203.143.130:64836] [client 20.203.143.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wincust.php"] [unique_id "aeLo2yYdRLRhVmaIMx0kWgAAANc"]
[Sat Apr 18 10:13:51.093896 2026] [:error] [pid 34288:tid 34311] [client 20.203.143.130:65304] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sat Apr 18 10:13:51.364363 2026] [:error] [pid 34288:tid 34306] [client 20.203.143.130:65304] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Sat Apr 18 10:13:51.718458 2026] [:error] [pid 34288:tid 34305] [client 20.203.143.130:65304] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Sat Apr 18 10:13:51.983987 2026] [:error] [pid 34288:tid 34314] [client 20.203.143.130:65304] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aeLo3-TIiy__PtiLmplyzgAAAZY"]
[Sat Apr 18 10:13:53.873126 2026] [:error] [pid 9970:tid 9993] [client 20.203.143.130:64844] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aeLo4SYdRLRhVmaIMx0kXQAAANM"]
[Sat Apr 18 10:13:56.986578 2026] [:error] [pid 9863:tid 9877] [client 20.203.143.130:65314] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aeLo5DjjiypiFrTucbJQqgAAAAQ"]
[Sat Apr 18 10:14:00.347100 2026] [:error] [pid 9970:tid 9995] [client 20.203.143.130:64350] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aeLo6CYdRLRhVmaIMx0kYwAAANU"]
[Sat Apr 18 10:14:11.885497 2026] [:error] [pid 34288:tid 34314] [client 20.203.143.130:65374] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws61.php"] [unique_id "aeLo8-TIiy__PtiLmply3AAAAZY"]
[Sat Apr 18 10:14:15.018512 2026] [:error] [pid 13023:tid 13031] [client 20.203.143.130:4367] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws61.php"] [unique_id "aeLo9_1e7hG8DAeABB9xiAAAAQY"]
[Sat Apr 18 10:14:16.141854 2026] [:error] [pid 13023:tid 13034] [client 20.203.143.130:64894] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aeLo-P1e7hG8DAeABB9xjAAAAQk"]
[Sat Apr 18 10:14:17.768969 2026] [:error] [pid 9865:tid 9940] [client 20.203.143.130:64871] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aeLo-azb5knECIY-C-j4nAAAAIM"]
[Sat Apr 18 10:14:18.524613 2026] [:error] [pid 9863:tid 9877] [client 20.203.143.130:4399] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aeLo-jjjiypiFrTucbJQ0wAAAAQ"]
[Sat Apr 18 10:14:29.342616 2026] [:error] [pid 9865:tid 9949] [client 20.203.143.130:64815] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aeLpBazb5knECIY-C-j4ogAAAIw"]
[Sat Apr 18 10:14:32.098378 2026] [:error] [pid 34237:tid 34239] [client 20.203.143.130:65354] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aeLpCBBmX4Wq5a6rxfYUCAAAAUA"]
[Sat Apr 18 10:14:33.425570 2026] [:error] [pid 9863:tid 9897] [client 20.203.143.130:37004] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aeLpCTjjiypiFrTucbJQ1QAAABg"]
[Sat Apr 18 10:14:36.128165 2026] [:error] [pid 13023:tid 13038] [client 20.203.143.130:64851] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aeLpDP1e7hG8DAeABB9xsAAAAQ0"]
[Sat Apr 18 10:14:37.013664 2026] [:error] [pid 13023:tid 13031] [client 20.203.143.130:65322] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aeLpDf1e7hG8DAeABB9xtwAAAQY"]
[Sat Apr 18 10:14:38.659476 2026] [:error] [pid 9863:tid 9879] [client 20.203.143.130:65282] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xynz.php"] [unique_id "aeLpDjjjiypiFrTucbJQ2QAAAAY"]
[Sat Apr 18 10:14:39.792821 2026] [:error] [pid 9970:tid 9994] [client 20.203.143.130:65332] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xynz.php"] [unique_id "aeLpDyYdRLRhVmaIMx0kowAAANQ"]
[Sat Apr 18 10:14:40.452851 2026] [:error] [pid 9970:tid 9976] [client 20.203.143.130:4362] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xynz.php"] [unique_id "aeLpECYdRLRhVmaIMx0kqQAAAMI"]
[Sat Apr 18 10:14:42.475556 2026] [:error] [pid 34288:tid 34300] [client 20.203.143.130:4396] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xynz.php"] [unique_id "aeLpEuTIiy__PtiLmply9AAAAYg"]
[Sat Apr 18 10:14:44.979776 2026] [:error] [pid 9865:tid 9946] [client 20.203.143.130:64865] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-01ul.php"] [unique_id "aeLpFKzb5knECIY-C-j4pwAAAIk"]
[Sat Apr 18 10:14:46.536373 2026] [:error] [pid 34288:tid 34311] [client 20.203.143.130:65396] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-01ul.php"] [unique_id "aeLpFuTIiy__PtiLmply9gAAAZM"]
[Sat Apr 18 10:14:48.209790 2026] [:error] [pid 9970:tid 9977] [client 20.203.143.130:63953] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-01ul.php"] [unique_id "aeLpGCYdRLRhVmaIMx0kswAAAMM"]
[Sat Apr 18 10:14:49.160610 2026] [:error] [pid 34237:tid 34260] [client 20.203.143.130:37054] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-01ul.php"] [unique_id "aeLpGRBmX4Wq5a6rxfYUMAAAAVU"]
[Sat Apr 18 10:14:51.356566 2026] [:error] [pid 34288:tid 34310] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/e7.php
[Sat Apr 18 10:14:51.597810 2026] [:error] [pid 34288:tid 34315] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/e3.php
[Sat Apr 18 10:14:52.162519 2026] [:error] [pid 34288:tid 34302] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Sat Apr 18 10:14:52.400774 2026] [:error] [pid 34288:tid 34305] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Sat Apr 18 10:14:52.841980 2026] [:error] [pid 34288:tid 34304] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Apr 18 10:14:53.082277 2026] [:error] [pid 34288:tid 34295] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Sat Apr 18 10:14:53.335724 2026] [:error] [pid 34288:tid 34298] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Sat Apr 18 10:14:53.586986 2026] [:error] [pid 34288:tid 34312] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Sat Apr 18 10:14:53.832552 2026] [:error] [pid 34288:tid 34292] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Sat Apr 18 10:14:54.072659 2026] [:error] [pid 34288:tid 34307] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/curl.php
[Sat Apr 18 10:14:54.335926 2026] [:error] [pid 34288:tid 34314] [client 20.203.143.130:64807] File does not exist: /usr/local/apache/htdocs/suspended-page/sallu.php
[Sat Apr 18 10:14:54.572027 2026] [:error] [pid 34288:tid 34316] [client 20.203.143.130:64807] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aeLpHuTIiy__PtiLmplzFgAAAZg"]
[Sat Apr 18 10:15:03.146687 2026] [:error] [pid 9864:tid 9920] [client 20.203.143.130:4391] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aeLpJ4CFeowknfXHM7lsIwAAAE4"]
[Sat Apr 18 10:15:05.742144 2026] [:error] [pid 9970:tid 9989] [client 20.203.143.130:4395] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aeLpKSYdRLRhVmaIMx0kxwAAAM8"]
[Sat Apr 18 10:15:12.599567 2026] [:error] [pid 9864:tid 9918] [client 20.203.143.130:4371] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeLpMICFeowknfXHM7lsJQAAAEw"]
[Sat Apr 18 10:15:15.216112 2026] [:error] [pid 9970:tid 9993] [client 20.203.143.130:4406] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeLpMyYdRLRhVmaIMx0k0gAAANM"]
[Sat Apr 18 10:15:16.623034 2026] [:error] [pid 34288:tid 34316] [client 20.203.143.130:65377] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeLpNOTIiy__PtiLmplzOgAAAZg"]
[Sat Apr 18 10:15:17.542802 2026] [:error] [pid 34288:tid 34302] [client 20.203.143.130:37010] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeLpNeTIiy__PtiLmplzPwAAAYo"]
[Sat Apr 18 10:15:27.928651 2026] [:error] [pid 9970:tid 9990] [client 20.203.143.130:64848] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aeLpPyYdRLRhVmaIMx0k4gAAANA"]
[Sat Apr 18 10:15:29.467093 2026] [:error] [pid 34290:tid 34341] [client 20.203.143.130:65296] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aeLpQRqX6WpmmAXOBi-LCwAAAdY"]
[Sat Apr 18 10:15:31.344490 2026] [:error] [pid 9970:tid 9982] [client 20.203.143.130:65307] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aeLpQyYdRLRhVmaIMx0k6QAAAMg"]
[Sat Apr 18 10:15:32.620936 2026] [:error] [pid 9864:tid 9927] [client 20.203.143.130:4369] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aeLpRICFeowknfXHM7lsJwAAAFU"]
[Sat Apr 18 10:15:34.384174 2026] [:error] [pid 9863:tid 9895] [client 20.203.143.130:4363] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods_260325043000.php"] [unique_id "aeLpRjjjiypiFrTucbJRQQAAABY"]
[Sat Apr 18 10:15:39.174433 2026] [:error] [pid 9865:tid 9952] [client 20.203.143.130:65395] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods_260325043000.php"] [unique_id "aeLpS6zb5knECIY-C-j43wAAAI8"]
[Sat Apr 18 10:15:39.897793 2026] [:error] [pid 9865:tid 9938] [client 20.203.143.130:4402] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods_260325043000.php"] [unique_id "aeLpS6zb5knECIY-C-j44AAAAIE"]
[Sat Apr 18 10:15:40.751929 2026] [:error] [pid 9863:tid 9897] [client 20.203.143.130:65311] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods_260325043000.php"] [unique_id "aeLpTDjjiypiFrTucbJRRQAAABg"]
[Sat Apr 18 10:15:41.687619 2026] [:error] [pid 9970:tid 9996] [client 20.203.143.130:64813] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods_260401065719.php"] [unique_id "aeLpTSYdRLRhVmaIMx0k6wAAANY"]
[Sat Apr 18 10:15:42.530962 2026] [:error] [pid 9970:tid 9991] [client 20.203.143.130:37024] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods_260401065719.php"] [unique_id "aeLpTiYdRLRhVmaIMx0k7gAAANE"]
[Sat Apr 18 10:15:43.602723 2026] [:error] [pid 9864:tid 9928] [client 20.203.143.130:65352] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods_260401065719.php"] [unique_id "aeLpT4CFeowknfXHM7lsKgAAAFY"]
[Sat Apr 18 10:15:46.583009 2026] [:error] [pid 13023:tid 13030] [client 20.203.143.130:4412] [client 20.203.143.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/goods_260401065719.php"] [unique_id "aeLpUv1e7hG8DAeABB9x3QAAAQU"]
[Sun Apr 19 07:18:41.674895 2026] [:error] [pid 47772:tid 47802] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 19 07:18:41.886922 2026] [:error] [pid 47772:tid 47807] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Apr 19 07:18:42.154435 2026] [:error] [pid 47772:tid 47794] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Apr 19 07:18:42.367565 2026] [:error] [pid 47772:tid 47793] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Apr 19 07:18:42.609149 2026] [:error] [pid 47772:tid 47813] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sun Apr 19 07:18:42.819753 2026] [:error] [pid 47772:tid 47800] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Apr 19 07:18:43.064136 2026] [:error] [pid 47772:tid 47810] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sun Apr 19 07:18:43.481573 2026] [:error] [pid 47772:tid 47812] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Apr 19 07:18:43.699243 2026] [:error] [pid 47772:tid 47804] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Sun Apr 19 07:18:43.910701 2026] [:error] [pid 47772:tid 47791] [client 20.48.254.119:57533] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Apr 19 07:18:44.117610 2026] [:error] [pid 47772:tid 47806] [client 20.48.254.119:57533] [client 20.48.254.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeQRVIc0L16cb4smAz_GkwAAABE"]
[Sun Apr 19 07:18:46.852095 2026] [:error] [pid 47775:tid 47848] [client 20.48.254.119:57486] [client 20.48.254.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeQRVrmztjlk9tsmoeyPZAAAAIU"]
[Sun Apr 19 07:18:48.436424 2026] [:error] [pid 47886:tid 47912] [client 20.48.254.119:16455] [client 20.48.254.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeQRWESe8yiyuPrD7yMFSQAAANg"]
[Sun Apr 19 07:18:54.982629 2026] [:error] [pid 15765:tid 15867] [client 20.48.254.119:60622] [client 20.48.254.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeQRXvRqinw-W5EwQ76X5AAAAo4"]
[Sun Apr 19 13:43:18.076805 2026] [:error] [pid 47775:tid 47864] [client 82.112.253.162:45130] [client 82.112.253.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aeRrdrmztjlk9tsmoezTzAAAAJU"]
[Sun Apr 19 21:59:15.165140 2026] [:error] [pid 15760:tid 15783] [client 34.46.243.112:64025] [client 34.46.243.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.46.243.112, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aeTfs_SdD_XHQMJ_IStE5gAAAc8"]
[Sun Apr 19 21:59:15.168497 2026] [:error] [pid 15760:tid 15783] [client 34.46.243.112:64025] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 19 21:59:15.912029 2026] [:error] [pid 15760:tid 15771] [client 34.46.243.112:64025] [client 34.46.243.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "aeTfs_SdD_XHQMJ_IStE7AAAAcM"]
[Sun Apr 19 21:59:16.374255 2026] [:error] [pid 47773:tid 47829] [client 34.46.243.112:59956] [client 34.46.243.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "aeTftOiBHdnCJDuPq9BLwwAAAE0"]
[Sun Apr 19 21:59:16.796117 2026] [:error] [pid 47886:tid 47892] [client 34.46.243.112:53135] [client 34.46.243.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "aeTftESe8yiyuPrD7yN-HwAAAMQ"]
[Sun Apr 19 21:59:17.201855 2026] [:error] [pid 47772:tid 47812] [client 34.46.243.112:51870] [client 34.46.243.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "aeTftYc0L16cb4smAz_JcwAAABc"]
[Sun Apr 19 21:59:17.718693 2026] [:error] [pid 15760:tid 15788] [client 34.46.243.112:59390] [client 34.46.243.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "aeTftfSdD_XHQMJ_IStE-gAAAdQ"]
[Sun Apr 19 21:59:18.177459 2026] [:error] [pid 15763:tid 15814] [client 34.46.243.112:64822] [client 34.46.243.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "aeTftrMXv1Y1THOoxaAFKwAAAhI"]
[Sun Apr 19 21:59:18.734160 2026] [:error] [pid 15694:tid 15745] [client 34.46.243.112:61098] [client 34.46.243.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "aeTftrimB-jol1fwqAoSpAAAAZM"]
[Sun Apr 19 23:54:46.354445 2026] [:error] [pid 15764:tid 15830] [client 136.116.128.106:51409] [client 136.116.128.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.116.128.106, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aeT6xmLL_sqdSHoVp-RRggAAAkQ"]
[Sun Apr 19 23:54:46.357799 2026] [:error] [pid 15764:tid 15830] [client 136.116.128.106:51409] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 19 23:54:46.569683 2026] [:error] [pid 15764:tid 15826] [client 136.116.128.106:51409] [client 136.116.128.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aeT6xmLL_sqdSHoVp-RRhQAAAkA"]
[Sun Apr 19 23:54:47.040073 2026] [:error] [pid 15763:tid 15809] [client 136.116.128.106:64410] [client 136.116.128.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "aeT6x7MXv1Y1THOoxaAh7AAAAg0"]
[Sun Apr 19 23:54:47.535775 2026] [:error] [pid 15763:tid 15800] [client 136.116.128.106:52991] [client 136.116.128.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "aeT6x7MXv1Y1THOoxaAh7gAAAgQ"]
[Sun Apr 19 23:54:48.002161 2026] [:error] [pid 47772:tid 47796] [client 136.116.128.106:62391] [client 136.116.128.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "aeT6yIc0L16cb4smAz_sEgAAAAc"]
[Sun Apr 19 23:54:48.467749 2026] [:error] [pid 15764:tid 15844] [client 136.116.128.106:51485] [client 136.116.128.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "aeT6yGLL_sqdSHoVp-RRlgAAAlI"]
[Mon Apr 20 07:20:31.858231 2026] [:error] [pid 48101:tid 48128] [client 2.24.210.210:36470] [client 2.24.210.210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aeVjP_IgenNbs2bVQGsfNgAAAZg"]
[Mon Apr 20 07:58:28.283207 2026] [:error] [pid 47731:tid 47738] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Mon Apr 20 07:58:28.703846 2026] [:error] [pid 47731:tid 47751] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Mon Apr 20 07:58:28.992135 2026] [:error] [pid 47731:tid 47735] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/flox.php
[Mon Apr 20 07:58:29.234346 2026] [:error] [pid 47731:tid 47750] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/mff.php
[Mon Apr 20 07:58:29.482426 2026] [:error] [pid 47731:tid 47749] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Mon Apr 20 07:58:29.987584 2026] [:error] [pid 47731:tid 47740] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/filemanger2.php
[Mon Apr 20 07:58:30.642959 2026] [:error] [pid 47731:tid 47753] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Mon Apr 20 07:58:30.880914 2026] [:error] [pid 47731:tid 47741] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-vn1.php
[Mon Apr 20 07:58:31.118673 2026] [:error] [pid 47731:tid 47745] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Mon Apr 20 07:58:31.358059 2026] [:error] [pid 47731:tid 47751] [client 51.103.45.195:18762] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Mon Apr 20 07:58:31.768085 2026] [:error] [pid 47731:tid 47742] [client 51.103.45.195:18762] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "aeVsJ1Owpc-h7Nzn-iO6qgAAAQk"]
[Mon Apr 20 07:58:32.996906 2026] [:error] [pid 47779:tid 47783] [client 51.103.45.195:18802] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "aeVsKIahGl1n9UkmcNj6cQAAAUI"]
[Mon Apr 20 07:58:35.474225 2026] [:error] [pid 64332:tid 64363] [client 51.103.45.195:18695] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "aeVsK8AQ57uMKAVSYEklbgAAABU"]
[Mon Apr 20 07:58:37.005654 2026] [:error] [pid 64334:tid 64403] [client 51.103.45.195:18766] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nwflm.php"] [unique_id "aeVsLcNh9IxxDqsrPyO1CwAAAIA"]
[Mon Apr 20 07:58:38.587857 2026] [:error] [pid 47731:tid 47753] [client 51.103.45.195:18691] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeVsLlOwpc-h7Nzn-iO6uQAAARQ"]
[Mon Apr 20 07:58:39.695529 2026] [:error] [pid 64332:tid 64352] [client 51.103.45.195:18705] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeVsL8AQ57uMKAVSYEkldAAAAAo"]
[Mon Apr 20 07:58:40.958752 2026] [:error] [pid 60072:tid 60090] [client 51.103.45.195:18765] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeVsMPuj5dzu2v3Qr6GvJwAAAdA"]
[Mon Apr 20 07:58:41.840069 2026] [:error] [pid 60072:tid 60082] [client 51.103.45.195:18804] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aeVsMfuj5dzu2v3Qr6GvLAAAAcg"]
[Mon Apr 20 07:58:42.613819 2026] [:error] [pid 64333:tid 64386] [client 51.103.45.195:18775] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeVsMnZav9wH8wxMd_uDCQAAAEo"]
[Mon Apr 20 07:58:43.501358 2026] [:error] [pid 47731:tid 47742] [client 51.103.45.195:18811] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeVsM1Owpc-h7Nzn-iO6yAAAAQk"]
[Mon Apr 20 07:58:44.333842 2026] [:error] [pid 47731:tid 47738] [client 51.103.45.195:18789] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeVsNFOwpc-h7Nzn-iO6ygAAAQU"]
[Mon Apr 20 07:58:45.031733 2026] [:error] [pid 64333:tid 64384] [client 51.103.45.195:18785] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aeVsNXZav9wH8wxMd_uDEQAAAEg"]
[Mon Apr 20 07:58:45.921439 2026] [:error] [pid 64440:tid 64447] [client 51.103.45.195:18805] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aeVsNdkVUvTgp8p7mrP7GgAAAMQ"]
[Mon Apr 20 07:58:46.684460 2026] [:error] [pid 60072:tid 60089] [client 51.103.45.195:18694] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aeVsNvuj5dzu2v3Qr6GvNAAAAc8"]
[Mon Apr 20 07:58:47.286397 2026] [:error] [pid 64334:tid 64405] [client 51.103.45.195:18815] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aeVsN8Nh9IxxDqsrPyO1FwAAAII"]
[Mon Apr 20 07:58:47.895671 2026] [:error] [pid 47731:tid 47753] [client 51.103.45.195:18779] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aeVsN1Owpc-h7Nzn-iO61AAAARQ"]
[Mon Apr 20 07:58:48.813539 2026] [:error] [pid 47731:tid 47756] [client 51.103.45.195:18790] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aeVsOFOwpc-h7Nzn-iO63QAAARc"]
[Mon Apr 20 07:58:49.459068 2026] [:error] [pid 64332:tid 64344] [client 51.103.45.195:18698] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aeVsOcAQ57uMKAVSYEklfAAAAAI"]
[Mon Apr 20 07:58:52.156001 2026] [:error] [pid 64334:tid 64422] [client 51.103.45.195:18708] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aeVsPMNh9IxxDqsrPyO1GwAAAJM"]
[Mon Apr 20 07:58:53.714458 2026] [:error] [pid 64334:tid 64414] [client 51.103.45.195:18771] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aeVsPcNh9IxxDqsrPyO1HwAAAIs"]
[Mon Apr 20 07:58:54.263379 2026] [:error] [pid 64440:tid 64456] [client 51.103.45.195:18693] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeVsPtkVUvTgp8p7mrP7SwAAAM0"]
[Mon Apr 20 07:58:55.317366 2026] [:error] [pid 60072:tid 60087] [client 51.103.45.195:18767] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeVsP_uj5dzu2v3Qr6GvRAAAAc0"]
[Mon Apr 20 07:58:55.935801 2026] [:error] [pid 64332:tid 64347] [client 51.103.45.195:18721] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeVsP8AQ57uMKAVSYEkliQAAAAU"]
[Mon Apr 20 07:58:56.769730 2026] [:error] [pid 64440:tid 64464] [client 51.103.45.195:18688] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeVsQNkVUvTgp8p7mrP7TgAAANU"]
[Mon Apr 20 07:58:57.494659 2026] [:error] [pid 64334:tid 64418] [client 51.103.45.195:18809] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aeVsQcNh9IxxDqsrPyO1NAAAAI8"]
[Mon Apr 20 07:58:58.237827 2026] [:error] [pid 47779:tid 47804] [client 51.103.45.195:18757] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aeVsQoahGl1n9UkmcNj6eQAAAVc"]
[Mon Apr 20 07:58:58.826281 2026] [:error] [pid 47731:tid 47750] [client 51.103.45.195:18784] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aeVsQlOwpc-h7Nzn-iO66AAAARE"]
[Mon Apr 20 07:58:59.340307 2026] [:error] [pid 64332:tid 64358] [client 51.103.45.195:18799] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aeVsQ8AQ57uMKAVSYEklkgAAABA"]
[Mon Apr 20 07:58:59.843396 2026] [:error] [pid 64333:tid 64381] [client 51.103.45.195:18800] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/water.php"] [unique_id "aeVsQ3Zav9wH8wxMd_uDLQAAAEU"]
[Mon Apr 20 07:59:00.465636 2026] [:error] [pid 64333:tid 64391] [client 51.103.45.195:18748] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/water.php"] [unique_id "aeVsRHZav9wH8wxMd_uDNgAAAE8"]
[Mon Apr 20 07:59:01.170006 2026] [:error] [pid 47731:tid 47747] [client 51.103.45.195:18810] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/water.php"] [unique_id "aeVsRVOwpc-h7Nzn-iO66wAAAQ4"]
[Mon Apr 20 07:59:02.028865 2026] [:error] [pid 64333:tid 64379] [client 51.103.45.195:18773] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/water.php"] [unique_id "aeVsRnZav9wH8wxMd_uDRAAAAEM"]
[Mon Apr 20 07:59:02.959669 2026] [:error] [pid 60072:tid 60083] [client 51.103.45.195:18689] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "aeVsRvuj5dzu2v3Qr6GvSAAAAck"]
[Mon Apr 20 07:59:03.941116 2026] [:error] [pid 64333:tid 64388] [client 51.103.45.195:18792] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "aeVsR3Zav9wH8wxMd_uDXAAAAEw"]
[Mon Apr 20 07:59:04.748082 2026] [:error] [pid 64440:tid 64462] [client 51.103.45.195:18774] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "aeVsSNkVUvTgp8p7mrP7VAAAANM"]
[Mon Apr 20 07:59:05.247123 2026] [:error] [pid 48101:tid 48109] [client 51.103.45.195:18782] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "aeVsSfIgenNbs2bVQGskIgAAAYU"]
[Mon Apr 20 07:59:05.805176 2026] [:error] [pid 64333:tid 64390] [client 51.103.45.195:18706] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "aeVsSXZav9wH8wxMd_uDgQAAAE4"]
[Mon Apr 20 07:59:06.373462 2026] [:error] [pid 47731:tid 47744] [client 51.103.45.195:18813] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "aeVsSlOwpc-h7Nzn-iO68AAAAQs"]
[Mon Apr 20 07:59:06.874585 2026] [:error] [pid 47731:tid 47737] [client 51.103.45.195:18812] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "aeVsSlOwpc-h7Nzn-iO68QAAAQQ"]
[Mon Apr 20 07:59:07.619700 2026] [:error] [pid 64333:tid 64382] [client 51.103.45.195:18702] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "aeVsS3Zav9wH8wxMd_uDlwAAAEY"]
[Mon Apr 20 07:59:08.365481 2026] [:error] [pid 64332:tid 64347] [client 51.103.45.195:18793] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wert.php"] [unique_id "aeVsTMAQ57uMKAVSYEklmQAAAAU"]
[Mon Apr 20 07:59:09.925783 2026] [:error] [pid 64334:tid 64403] [client 51.103.45.195:18761] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wert.php"] [unique_id "aeVsTcNh9IxxDqsrPyO1OwAAAIA"]
[Mon Apr 20 07:59:11.045878 2026] [:error] [pid 60072:tid 60094] [client 51.103.45.195:18794] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wert.php"] [unique_id "aeVsT_uj5dzu2v3Qr6GvfgAAAdQ"]
[Mon Apr 20 07:59:11.637040 2026] [:error] [pid 64333:tid 64392] [client 51.103.45.195:18808] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wert.php"] [unique_id "aeVsT3Zav9wH8wxMd_uDugAAAFA"]
[Mon Apr 20 07:59:12.600574 2026] [:error] [pid 48101:tid 48114] [client 51.103.45.195:18715] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "aeVsUPIgenNbs2bVQGskKgAAAYo"]
[Mon Apr 20 07:59:13.574359 2026] [:error] [pid 60072:tid 60078] [client 51.103.45.195:18704] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "aeVsUfuj5dzu2v3Qr6GviwAAAcQ"]
[Mon Apr 20 07:59:14.484583 2026] [:error] [pid 64440:tid 64448] [client 51.103.45.195:18707] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "aeVsUtkVUvTgp8p7mrP7YwAAAMU"]
[Mon Apr 20 07:59:15.449751 2026] [:error] [pid 64333:tid 64397] [client 51.103.45.195:18696] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "aeVsU3Zav9wH8wxMd_uD1QAAAFU"]
[Mon Apr 20 07:59:15.982292 2026] [:error] [pid 64333:tid 64383] [client 51.103.45.195:18755] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "aeVsU3Zav9wH8wxMd_uD3QAAAEc"]
[Mon Apr 20 07:59:16.667501 2026] [:error] [pid 64333:tid 64376] [client 51.103.45.195:18747] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "aeVsVHZav9wH8wxMd_uD5QAAAEA"]
[Mon Apr 20 07:59:17.402238 2026] [:error] [pid 64333:tid 64383] [client 51.103.45.195:18760] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "aeVsVXZav9wH8wxMd_uD7AAAAEc"]
[Mon Apr 20 07:59:18.540037 2026] [:error] [pid 64333:tid 64391] [client 51.103.45.195:18769] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "aeVsVnZav9wH8wxMd_uD-AAAAE8"]
[Mon Apr 20 07:59:19.432271 2026] [:error] [pid 64333:tid 64381] [client 51.103.45.195:18700] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oij98gy.php"] [unique_id "aeVsV3Zav9wH8wxMd_uD_wAAAEU"]
[Mon Apr 20 07:59:20.338710 2026] [:error] [pid 64440:tid 64451] [client 51.103.45.195:18770] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oij98gy.php"] [unique_id "aeVsWNkVUvTgp8p7mrP7ZwAAAMg"]
[Mon Apr 20 07:59:21.249930 2026] [:error] [pid 64332:tid 64366] [client 51.103.45.195:18776] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oij98gy.php"] [unique_id "aeVsWcAQ57uMKAVSYEklpAAAABg"]
[Mon Apr 20 07:59:21.820035 2026] [:error] [pid 64334:tid 64422] [client 51.103.45.195:18787] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/oij98gy.php"] [unique_id "aeVsWcNh9IxxDqsrPyO1RAAAAJM"]
[Mon Apr 20 07:59:23.113706 2026] [:error] [pid 64440:tid 64454] [client 51.103.45.195:18631] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aeVsW9kVUvTgp8p7mrP7aQAAAMs"]
[Mon Apr 20 07:59:24.229804 2026] [:error] [pid 47779:tid 47803] [client 51.103.45.195:18710] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aeVsXIahGl1n9UkmcNj6fwAAAVY"]
[Mon Apr 20 07:59:25.912445 2026] [:error] [pid 64333:tid 64381] [client 51.103.45.195:18746] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aeVsXXZav9wH8wxMd_uELQAAAEU"]
[Mon Apr 20 07:59:26.677583 2026] [:error] [pid 48101:tid 48123] [client 51.103.45.195:18636] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aeVsXvIgenNbs2bVQGskMwAAAZM"]
[Mon Apr 20 07:59:27.885397 2026] [:error] [pid 48101:tid 48114] [client 51.103.45.195:18690] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/turkshell.php"] [unique_id "aeVsX_IgenNbs2bVQGskOgAAAYo"]
[Mon Apr 20 07:59:28.633323 2026] [:error] [pid 64440:tid 64445] [client 51.103.45.195:18724] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/turkshell.php"] [unique_id "aeVsYNkVUvTgp8p7mrP7bgAAAMI"]
[Mon Apr 20 07:59:30.050274 2026] [:error] [pid 47779:tid 47795] [client 51.103.45.195:18732] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/turkshell.php"] [unique_id "aeVsYoahGl1n9UkmcNj6hAAAAU4"]
[Mon Apr 20 07:59:31.037696 2026] [:error] [pid 64333:tid 64383] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/turkshell.php
[Mon Apr 20 07:59:31.306377 2026] [:error] [pid 64333:tid 64377] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Mon Apr 20 07:59:31.632963 2026] [:error] [pid 64333:tid 64398] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Mon Apr 20 07:59:31.873477 2026] [:error] [pid 64333:tid 64400] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Mon Apr 20 07:59:32.132520 2026] [:error] [pid 64333:tid 64393] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Mon Apr 20 07:59:32.384676 2026] [:error] [pid 64333:tid 64397] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Apr 20 07:59:32.629865 2026] [:error] [pid 64333:tid 64380] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Mon Apr 20 07:59:32.893028 2026] [:error] [pid 64333:tid 64378] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Mon Apr 20 07:59:33.132755 2026] [:error] [pid 64333:tid 64377] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Mon Apr 20 07:59:33.414853 2026] [:error] [pid 64333:tid 64398] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Mon Apr 20 07:59:33.655249 2026] [:error] [pid 64333:tid 64396] [client 51.103.45.195:18777] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Mon Apr 20 07:59:33.891421 2026] [:error] [pid 64333:tid 64393] [client 51.103.45.195:18777] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "aeVsZXZav9wH8wxMd_uEbQAAAFE"]
[Mon Apr 20 07:59:34.452963 2026] [:error] [pid 64334:tid 64424] [client 51.103.45.195:18626] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "aeVsZsNh9IxxDqsrPyO1TQAAAJU"]
[Mon Apr 20 07:59:35.246200 2026] [:error] [pid 64333:tid 64381] [client 51.103.45.195:18736] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "aeVsZ3Zav9wH8wxMd_uEeAAAAEU"]
[Mon Apr 20 07:59:36.178778 2026] [:error] [pid 64333:tid 64400] [client 51.103.45.195:18703] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "aeVsaHZav9wH8wxMd_uEgAAAAFg"]
[Mon Apr 20 07:59:36.946676 2026] [:error] [pid 64333:tid 64380] [client 51.103.45.195:18701] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "aeVsaHZav9wH8wxMd_uEhgAAAEQ"]
[Mon Apr 20 07:59:37.495639 2026] [:error] [pid 64332:tid 64363] [client 51.103.45.195:18778] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "aeVsacAQ57uMKAVSYEkltwAAABU"]
[Mon Apr 20 07:59:38.254941 2026] [:error] [pid 64333:tid 64376] [client 51.103.45.195:18814] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "aeVsanZav9wH8wxMd_uEkAAAAEA"]
[Mon Apr 20 07:59:38.895922 2026] [:error] [pid 60072:tid 60078] [client 51.103.45.195:18655] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "aeVsavuj5dzu2v3Qr6GvqAAAAcQ"]
[Mon Apr 20 07:59:39.603980 2026] [:error] [pid 64334:tid 64423] [client 51.103.45.195:18634] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.mopj.php"] [unique_id "aeVsa8Nh9IxxDqsrPyO1XgAAAJQ"]
[Mon Apr 20 07:59:40.223808 2026] [:error] [pid 47731:tid 47751] [client 51.103.45.195:18788] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.mopj.php"] [unique_id "aeVsbFOwpc-h7Nzn-iO7KwAAARI"]
[Mon Apr 20 07:59:41.070404 2026] [:error] [pid 60072:tid 60094] [client 51.103.45.195:18625] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.mopj.php"] [unique_id "aeVsbfuj5dzu2v3Qr6GvqwAAAdQ"]
[Mon Apr 20 07:59:41.561067 2026] [:error] [pid 48101:tid 48119] [client 51.103.45.195:18744] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.mopj.php"] [unique_id "aeVsbfIgenNbs2bVQGskQwAAAY8"]
[Mon Apr 20 07:59:42.231660 2026] [:error] [pid 64440:tid 64465] [client 51.103.45.195:18697] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aeVsbtkVUvTgp8p7mrP7dAAAANY"]
[Mon Apr 20 07:59:43.189320 2026] [:error] [pid 64334:tid 64417] [client 51.103.45.195:18763] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aeVsb8Nh9IxxDqsrPyO1YwAAAI4"]
[Mon Apr 20 07:59:44.262340 2026] [:error] [pid 47731:tid 47738] [client 51.103.45.195:18624] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aeVscFOwpc-h7Nzn-iO7LwAAAQU"]
[Mon Apr 20 07:59:45.861922 2026] [:error] [pid 60072:tid 60096] [client 51.103.45.195:18644] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aeVscfuj5dzu2v3Qr6GvswAAAdY"]
[Mon Apr 20 07:59:49.024377 2026] [:error] [pid 47779:tid 47787] [client 51.103.45.195:18717] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nano.php"] [unique_id "aeVsdYahGl1n9UkmcNj6kAAAAUY"]
[Mon Apr 20 07:59:51.190322 2026] [:error] [pid 64332:tid 64366] [client 51.103.45.195:18752] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nano.php"] [unique_id "aeVsd8AQ57uMKAVSYEklygAAABg"]
[Mon Apr 20 07:59:52.362355 2026] [:error] [pid 64332:tid 64356] [client 51.103.45.195:18756] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nano.php"] [unique_id "aeVseMAQ57uMKAVSYEkl0gAAAA4"]
[Mon Apr 20 07:59:53.434196 2026] [:error] [pid 60072:tid 60093] [client 51.103.45.195:18639] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/nano.php"] [unique_id "aeVsefuj5dzu2v3Qr6GvtwAAAdM"]
[Mon Apr 20 07:59:54.086177 2026] [:error] [pid 47731:tid 47748] [client 51.103.45.195:18803] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "aeVselOwpc-h7Nzn-iO7QwAAAQ8"]
[Mon Apr 20 07:59:55.354149 2026] [:error] [pid 64440:tid 64465] [client 51.103.45.195:18725] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "aeVse9kVUvTgp8p7mrP7gwAAANY"]
[Mon Apr 20 07:59:56.666212 2026] [:error] [pid 48101:tid 48124] [client 51.103.45.195:18722] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "aeVsfPIgenNbs2bVQGskTwAAAZQ"]
[Mon Apr 20 07:59:57.926687 2026] [:error] [pid 47731:tid 47750] [client 51.103.45.195:18637] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "aeVsfVOwpc-h7Nzn-iO7SgAAARE"]
[Mon Apr 20 07:59:58.897379 2026] [:error] [pid 47731:tid 47749] [client 51.103.45.195:18692] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "aeVsflOwpc-h7Nzn-iO7SwAAARA"]
[Mon Apr 20 08:00:00.724624 2026] [:error] [pid 64332:tid 64365] [client 51.103.45.195:18750] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "aeVsgMAQ57uMKAVSYEkl4wAAABc"]
[Mon Apr 20 08:00:01.638645 2026] [:error] [pid 64333:tid 64396] [client 51.103.45.195:18759] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "aeVsgXZav9wH8wxMd_uExQAAAFQ"]
[Mon Apr 20 08:00:02.554715 2026] [:error] [pid 64333:tid 64384] [client 51.103.45.195:18764] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "aeVsgnZav9wH8wxMd_uEyAAAAEg"]
[Mon Apr 20 08:00:03.786933 2026] [:error] [pid 64440:tid 64451] [client 51.103.45.195:18801] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "aeVsg9kVUvTgp8p7mrP7xAAAAMg"]
[Mon Apr 20 08:00:05.260214 2026] [:error] [pid 47779:tid 47800] [client 51.103.45.195:18633] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "aeVshYahGl1n9UkmcNj6mAAAAVM"]
[Mon Apr 20 08:00:05.855690 2026] [:error] [pid 64333:tid 64376] [client 51.103.45.195:18735] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "aeVshXZav9wH8wxMd_uEzgAAAEA"]
[Mon Apr 20 08:00:07.031684 2026] [:error] [pid 64332:tid 64366] [client 51.103.45.195:18678] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "aeVsh8AQ57uMKAVSYEkl9AAAABg"]
[Mon Apr 20 08:00:08.019755 2026] [:error] [pid 47731:tid 47743] [client 51.103.45.195:18754] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "aeVsiFOwpc-h7Nzn-iO7UAAAAQo"]
[Mon Apr 20 08:00:08.718109 2026] [:error] [pid 47731:tid 47754] [client 51.103.45.195:18693] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "aeVsiFOwpc-h7Nzn-iO7UQAAARU"]
[Mon Apr 20 08:00:10.309935 2026] [:error] [pid 60072:tid 60087] [client 51.103.45.195:18712] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "aeVsivuj5dzu2v3Qr6GvxQAAAc0"]
[Mon Apr 20 08:00:11.686106 2026] [:error] [pid 47731:tid 47752] [client 51.103.45.195:18718] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "aeVsi1Owpc-h7Nzn-iO7WgAAARM"]
[Mon Apr 20 08:00:12.245621 2026] [:error] [pid 47779:tid 47787] [client 51.103.45.195:18630] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeVsjIahGl1n9UkmcNj6nQAAAUY"]
[Mon Apr 20 08:00:13.253366 2026] [:error] [pid 64334:tid 64421] [client 51.103.45.195:18783] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeVsjcNh9IxxDqsrPyO1oAAAAJI"]
[Mon Apr 20 08:00:14.401106 2026] [:error] [pid 48101:tid 48122] [client 51.103.45.195:18786] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeVsjvIgenNbs2bVQGskVwAAAZI"]
[Mon Apr 20 08:00:15.456902 2026] [:error] [pid 60072:tid 60097] [client 51.103.45.195:18714] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aeVsj_uj5dzu2v3Qr6GvywAAAdc"]
[Mon Apr 20 08:00:16.152592 2026] [:error] [pid 64333:tid 64391] [client 51.103.45.195:18742] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aeVskHZav9wH8wxMd_uE2wAAAE8"]
[Mon Apr 20 08:00:16.904658 2026] [:error] [pid 64333:tid 64393] [client 51.103.45.195:18632] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aeVskHZav9wH8wxMd_uE4AAAAFE"]
[Mon Apr 20 08:00:17.646012 2026] [:error] [pid 64334:tid 64424] [client 51.103.45.195:18635] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aeVskcNh9IxxDqsrPyO1rQAAAJU"]
[Mon Apr 20 08:00:18.439379 2026] [:error] [pid 64334:tid 64418] [client 51.103.45.195:18795] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aeVsksNh9IxxDqsrPyO1tAAAAI8"]
[Mon Apr 20 08:00:19.457476 2026] [:error] [pid 47731:tid 47757] [client 51.103.45.195:18758] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aeVsk1Owpc-h7Nzn-iO7YwAAARg"]
[Mon Apr 20 08:00:19.988313 2026] [:error] [pid 47731:tid 47746] [client 51.103.45.195:18672] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aeVsk1Owpc-h7Nzn-iO7ZwAAAQ0"]
[Mon Apr 20 08:00:20.503834 2026] [:error] [pid 64332:tid 64365] [client 51.103.45.195:18627] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aeVslMAQ57uMKAVSYEkmDQAAABc"]
[Mon Apr 20 08:00:21.199040 2026] [:error] [pid 64333:tid 64379] [client 51.103.45.195:18743] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aeVslXZav9wH8wxMd_uE4wAAAEM"]
[Mon Apr 20 08:00:21.835541 2026] [:error] [pid 64332:tid 64355] [client 51.103.45.195:18675] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aeVslcAQ57uMKAVSYEkmDwAAAA0"]
[Mon Apr 20 08:00:22.340962 2026] [:error] [pid 64333:tid 64399] [client 51.103.45.195:18660] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aeVslnZav9wH8wxMd_uE6AAAAFc"]
[Mon Apr 20 08:00:22.932530 2026] [:error] [pid 64333:tid 64392] [client 51.103.45.195:18806] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aeVslnZav9wH8wxMd_uE7wAAAFA"]
[Mon Apr 20 08:00:23.581226 2026] [:error] [pid 64332:tid 64343] [client 51.103.45.195:18669] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aeVsl8AQ57uMKAVSYEkmEQAAAAE"]
[Mon Apr 20 08:00:24.140112 2026] [:error] [pid 48101:tid 48109] [client 51.103.45.195:18596] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeVsmPIgenNbs2bVQGskXgAAAYU"]
[Mon Apr 20 08:00:25.095270 2026] [:error] [pid 64333:tid 64400] [client 51.103.45.195:18643] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeVsmXZav9wH8wxMd_uE9AAAAFg"]
[Mon Apr 20 08:00:25.630764 2026] [:error] [pid 60072:tid 60083] [client 51.103.45.195:18791] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeVsmfuj5dzu2v3Qr6Gv0gAAAck"]
[Mon Apr 20 08:00:26.429059 2026] [:error] [pid 64333:tid 64389] [client 51.103.45.195:18578] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aeVsmnZav9wH8wxMd_uE-gAAAE0"]
[Mon Apr 20 08:00:27.102127 2026] [:error] [pid 64333:tid 64394] [client 51.103.45.195:18716] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeVsm3Zav9wH8wxMd_uE_QAAAFI"]
[Mon Apr 20 08:00:27.663595 2026] [:error] [pid 64332:tid 64361] [client 51.103.45.195:18798] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeVsm8AQ57uMKAVSYEkmGgAAABM"]
[Mon Apr 20 08:00:28.169341 2026] [:error] [pid 64440:tid 64443] [client 51.103.45.195:18645] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeVsnNkVUvTgp8p7mrP8FAAAAMA"]
[Mon Apr 20 08:00:28.666036 2026] [:error] [pid 64332:tid 64360] [client 51.103.45.195:18699] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aeVsnMAQ57uMKAVSYEkmIgAAABI"]
[Mon Apr 20 08:00:29.172261 2026] [:error] [pid 47731:tid 47757] [client 51.103.45.195:18733] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aeVsnVOwpc-h7Nzn-iO7bwAAARg"]
[Mon Apr 20 08:00:30.103108 2026] [:error] [pid 47779:tid 47781] [client 51.103.45.195:18727] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aeVsnoahGl1n9UkmcNj6rgAAAUA"]
[Mon Apr 20 08:00:30.880648 2026] [:error] [pid 64440:tid 64452] [client 51.103.45.195:18643] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aeVsntkVUvTgp8p7mrP8HQAAAMk"]
[Mon Apr 20 08:00:31.868201 2026] [:error] [pid 64334:tid 64424] [client 51.103.45.195:18674] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aeVsn8Nh9IxxDqsrPyO1yAAAAJU"]
[Mon Apr 20 08:00:32.847592 2026] [:error] [pid 64333:tid 64397] [client 51.103.45.195:18729] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zample.php"] [unique_id "aeVsoHZav9wH8wxMd_uFCQAAAFU"]
[Mon Apr 20 08:00:35.068795 2026] [:error] [pid 64333:tid 64390] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/zample.php
[Mon Apr 20 08:00:35.311378 2026] [:error] [pid 64333:tid 64384] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Mon Apr 20 08:00:35.551035 2026] [:error] [pid 64333:tid 64393] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Mon Apr 20 08:00:35.822082 2026] [:error] [pid 64333:tid 64380] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 20 08:00:36.064177 2026] [:error] [pid 64333:tid 64400] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Mon Apr 20 08:00:36.307959 2026] [:error] [pid 64333:tid 64392] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Mon Apr 20 08:00:36.798464 2026] [:error] [pid 64333:tid 64378] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Mon Apr 20 08:00:37.039087 2026] [:error] [pid 64333:tid 64396] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Mon Apr 20 08:00:37.279533 2026] [:error] [pid 64333:tid 64389] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Mon Apr 20 08:00:37.519735 2026] [:error] [pid 64333:tid 64388] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Mon Apr 20 08:00:37.759594 2026] [:error] [pid 64333:tid 64384] [client 51.103.45.195:18728] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Mon Apr 20 08:00:37.996576 2026] [:error] [pid 64333:tid 64394] [client 51.103.45.195:18728] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "aeVspXZav9wH8wxMd_uFJQAAAFI"]
[Mon Apr 20 08:00:39.610154 2026] [:error] [pid 64333:tid 64382] [client 51.103.45.195:18650] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "aeVsp3Zav9wH8wxMd_uFLAAAAEY"]
[Mon Apr 20 08:00:42.762776 2026] [:error] [pid 64332:tid 64364] [client 51.103.45.195:18737] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "aeVsqsAQ57uMKAVSYEkmYgAAABY"]
[Mon Apr 20 08:00:44.378660 2026] [:error] [pid 47779:tid 47789] [client 51.103.45.195:18657] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "aeVsrIahGl1n9UkmcNj6swAAAUg"]
[Mon Apr 20 08:00:45.204628 2026] [:error] [pid 47731:tid 47733] [client 51.103.45.195:18661] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeVsrVOwpc-h7Nzn-iO7fQAAAQA"]
[Mon Apr 20 08:00:45.935994 2026] [:error] [pid 47779:tid 47791] [client 51.103.45.195:18668] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeVsrYahGl1n9UkmcNj6tgAAAUo"]
[Mon Apr 20 08:00:46.622323 2026] [:error] [pid 64440:tid 64452] [client 51.103.45.195:18647] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeVsrtkVUvTgp8p7mrP8KAAAAMk"]
[Mon Apr 20 08:00:47.305407 2026] [:error] [pid 47731:tid 47736] [client 51.103.45.195:18666] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "aeVsr1Owpc-h7Nzn-iO7gAAAAQM"]
[Mon Apr 20 08:00:48.500561 2026] [:error] [pid 64333:tid 64399] [client 51.103.45.195:18656] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aeVssHZav9wH8wxMd_uFQwAAAFc"]
[Mon Apr 20 08:00:49.380027 2026] [:error] [pid 64332:tid 64357] [client 51.103.45.195:18734] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aeVsscAQ57uMKAVSYEkmZwAAAA8"]
[Mon Apr 20 08:00:50.080354 2026] [:error] [pid 64440:tid 64462] [client 51.103.45.195:18709] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aeVsstkVUvTgp8p7mrP8MAAAANM"]
[Mon Apr 20 08:00:50.953644 2026] [:error] [pid 48101:tid 48125] [client 51.103.45.195:18749] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aeVssvIgenNbs2bVQGskZAAAAZU"]
[Mon Apr 20 08:00:51.448963 2026] [:error] [pid 64334:tid 64420] [client 51.103.45.195:18797] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aeVss8Nh9IxxDqsrPyO1zwAAAJE"]
[Mon Apr 20 08:00:52.047986 2026] [:error] [pid 47731:tid 47738] [client 51.103.45.195:18646] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aeVstFOwpc-h7Nzn-iO7jQAAAQU"]
[Mon Apr 20 08:00:52.924406 2026] [:error] [pid 64332:tid 64360] [client 51.103.45.195:18564] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aeVstMAQ57uMKAVSYEkmbQAAABI"]
[Mon Apr 20 08:00:53.499348 2026] [:error] [pid 64332:tid 64347] [client 51.103.45.195:18649] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aeVstcAQ57uMKAVSYEkmcAAAAAU"]
[Mon Apr 20 08:00:57.280784 2026] [:error] [pid 64333:tid 64390] [client 51.103.45.195:18562] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "aeVsuXZav9wH8wxMd_uFTwAAAE4"]
[Mon Apr 20 08:01:01.373396 2026] [:error] [pid 64334:tid 64408] [client 51.103.45.195:18676] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "aeVsvcNh9IxxDqsrPyO13gAAAIU"]
[Mon Apr 20 08:01:04.781984 2026] [:error] [pid 64334:tid 64427] [client 51.103.45.195:18796] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "aeVswMNh9IxxDqsrPyO15gAAAJg"]
[Mon Apr 20 08:01:12.168220 2026] [:error] [pid 64332:tid 64355] [client 51.103.45.195:18723] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aeVsyMAQ57uMKAVSYEkmhwAAAA0"]
[Mon Apr 20 08:01:13.370066 2026] [:error] [pid 64334:tid 64404] [client 51.103.45.195:18654] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aeVsycNh9IxxDqsrPyO18AAAAIE"]
[Mon Apr 20 08:01:14.067883 2026] [:error] [pid 64332:tid 64345] [client 51.103.45.195:18640] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aeVsysAQ57uMKAVSYEkmiQAAAAM"]
[Mon Apr 20 08:01:14.956207 2026] [:error] [pid 64333:tid 64391] [client 51.103.45.195:18726] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aeVsynZav9wH8wxMd_uFgAAAAE8"]
[Mon Apr 20 08:01:16.361742 2026] [:error] [pid 48101:tid 48124] [client 51.103.45.195:18713] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "aeVszPIgenNbs2bVQGskbwAAAZQ"]
[Mon Apr 20 08:01:17.222834 2026] [:error] [pid 64334:tid 64413] [client 51.103.45.195:18580] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "aeVszcNh9IxxDqsrPyO19QAAAIo"]
[Mon Apr 20 08:01:17.862655 2026] [:error] [pid 47779:tid 47786] [client 51.103.45.195:18740] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "aeVszYahGl1n9UkmcNj6xQAAAUU"]
[Mon Apr 20 08:01:18.789436 2026] [:error] [pid 60072:tid 60090] [client 51.103.45.195:18571] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "aeVszvuj5dzu2v3Qr6Gv-wAAAdA"]
[Mon Apr 20 08:01:19.781798 2026] [:error] [pid 64332:tid 64360] [client 51.103.45.195:18570] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aeVsz8AQ57uMKAVSYEkmnwAAABI"]
[Mon Apr 20 08:01:21.232528 2026] [:error] [pid 64333:tid 64390] [client 51.103.45.195:18772] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aeVs0XZav9wH8wxMd_uFlwAAAE4"]
[Mon Apr 20 08:01:21.880984 2026] [:error] [pid 64332:tid 64354] [client 51.103.45.195:18638] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aeVs0cAQ57uMKAVSYEkmpQAAAAw"]
[Mon Apr 20 08:01:22.603447 2026] [:error] [pid 47731:tid 47738] [client 51.103.45.195:18601] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aeVs0lOwpc-h7Nzn-iO7uwAAAQU"]
[Mon Apr 20 08:01:23.398146 2026] [:error] [pid 64332:tid 64346] [client 51.103.45.195:18720] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aeVs08AQ57uMKAVSYEkmqQAAAAQ"]
[Mon Apr 20 08:01:23.959967 2026] [:error] [pid 64333:tid 64388] [client 51.103.45.195:18586] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aeVs03Zav9wH8wxMd_uFnQAAAEw"]
[Mon Apr 20 08:01:25.050855 2026] [:error] [pid 47731:tid 47743] [client 51.103.45.195:18663] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aeVs1VOwpc-h7Nzn-iO7vgAAAQo"]
[Mon Apr 20 08:01:26.003691 2026] [:error] [pid 64332:tid 64363] [client 51.103.45.195:18731] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aeVs1sAQ57uMKAVSYEkmugAAABU"]
[Mon Apr 20 08:01:26.846662 2026] [:error] [pid 64333:tid 64382] [client 51.103.45.195:18665] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "aeVs1nZav9wH8wxMd_uFogAAAEY"]
[Mon Apr 20 08:01:27.873846 2026] [:error] [pid 60072:tid 60084] [client 51.103.45.195:18516] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "aeVs1_uj5dzu2v3Qr6GwAAAAAco"]
[Mon Apr 20 08:01:29.642380 2026] [:error] [pid 64333:tid 64386] [client 51.103.45.195:18658] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "aeVs2XZav9wH8wxMd_uFpgAAAEo"]
[Mon Apr 20 08:01:30.728714 2026] [:error] [pid 64332:tid 64349] [client 51.103.45.195:18616] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "aeVs2sAQ57uMKAVSYEkmxwAAAAc"]
[Mon Apr 20 08:01:31.550202 2026] [:error] [pid 64334:tid 64413] [client 51.103.45.195:18597] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aeVs28Nh9IxxDqsrPyO1_wAAAIo"]
[Mon Apr 20 08:01:32.863553 2026] [:error] [pid 60072:tid 60098] [client 51.103.45.195:18679] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aeVs3Puj5dzu2v3Qr6GwAwAAAdg"]
[Mon Apr 20 08:01:34.011943 2026] [:error] [pid 64334:tid 64427] [client 51.103.45.195:18602] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aeVs3sNh9IxxDqsrPyO2BwAAAJg"]
[Mon Apr 20 08:01:35.496111 2026] [:error] [pid 64333:tid 64393] [client 51.103.45.195:18497] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aeVs33Zav9wH8wxMd_uFrAAAAFE"]
[Mon Apr 20 08:01:37.107011 2026] [:error] [pid 64332:tid 64344] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Mon Apr 20 08:01:37.615818 2026] [:error] [pid 64332:tid 64349] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/bless4.php
[Mon Apr 20 08:01:37.854828 2026] [:error] [pid 64332:tid 64352] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Mon Apr 20 08:01:38.103881 2026] [:error] [pid 64332:tid 64356] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Mon Apr 20 08:01:38.383500 2026] [:error] [pid 64332:tid 64350] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Mon Apr 20 08:01:38.636650 2026] [:error] [pid 64332:tid 64361] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Mon Apr 20 08:01:38.909836 2026] [:error] [pid 64332:tid 64355] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Apr 20 08:01:39.400022 2026] [:error] [pid 64332:tid 64342] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Mon Apr 20 08:01:39.661881 2026] [:error] [pid 64332:tid 64365] [client 51.103.45.195:18432] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Mon Apr 20 08:01:40.059575 2026] [:error] [pid 64332:tid 64359] [client 51.103.45.195:18432] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "aeVs5MAQ57uMKAVSYEkm4wAAABE"]
[Mon Apr 20 08:01:40.644838 2026] [:error] [pid 64334:tid 64404] [client 51.103.45.195:18745] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "aeVs5MNh9IxxDqsrPyO2GwAAAIE"]
[Mon Apr 20 08:01:41.442820 2026] [:error] [pid 64332:tid 64342] [client 51.103.45.195:18768] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "aeVs5cAQ57uMKAVSYEkm7AAAAAA"]
[Mon Apr 20 08:01:42.351917 2026] [:error] [pid 64332:tid 64363] [client 51.103.45.195:18670] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "aeVs5sAQ57uMKAVSYEkm8gAAABU"]
[Mon Apr 20 08:01:44.109822 2026] [:error] [pid 64334:tid 64411] [client 51.103.45.195:18574] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aeVs6MNh9IxxDqsrPyO2KwAAAIg"]
[Mon Apr 20 08:01:45.617960 2026] [:error] [pid 47731:tid 47755] [client 51.103.45.195:18590] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aeVs6VOwpc-h7Nzn-iO70AAAARY"]
[Mon Apr 20 08:01:47.201959 2026] [:error] [pid 64332:tid 64359] [client 51.103.45.195:18673] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aeVs68AQ57uMKAVSYEknAgAAABE"]
[Mon Apr 20 08:01:48.385372 2026] [:error] [pid 60072:tid 60080] [client 51.103.45.195:18753] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aeVs7Puj5dzu2v3Qr6GwGgAAAcY"]
[Mon Apr 20 08:01:49.464866 2026] [:error] [pid 64333:tid 64400] [client 51.103.45.195:18641] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeVs7XZav9wH8wxMd_uFtQAAAFg"]
[Mon Apr 20 08:01:50.168863 2026] [:error] [pid 47779:tid 47798] [client 51.103.45.195:18680] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeVs7oahGl1n9UkmcNj60gAAAVE"]
[Mon Apr 20 08:01:51.178288 2026] [:error] [pid 64440:tid 64447] [client 51.103.45.195:18667] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeVs79kVUvTgp8p7mrP8WwAAAMQ"]
[Mon Apr 20 08:01:52.320225 2026] [:error] [pid 48101:tid 48124] [client 51.103.45.195:18780] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeVs8PIgenNbs2bVQGskiwAAAZQ"]
[Mon Apr 20 08:01:53.019026 2026] [:error] [pid 64333:tid 64394] [client 51.103.45.195:18651] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aeVs8XZav9wH8wxMd_uFvwAAAFI"]
[Mon Apr 20 08:01:54.538825 2026] [:error] [pid 64333:tid 64391] [client 51.103.45.195:18807] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aeVs8nZav9wH8wxMd_uFywAAAE8"]
[Mon Apr 20 08:01:55.340980 2026] [:error] [pid 64332:tid 64348] [client 51.103.45.195:18652] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aeVs88AQ57uMKAVSYEknGwAAAAY"]
[Mon Apr 20 08:01:56.565596 2026] [:error] [pid 64333:tid 64395] [client 51.103.45.195:18520] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aeVs9HZav9wH8wxMd_uF2QAAAFM"]
[Mon Apr 20 08:01:57.951180 2026] [:error] [pid 64333:tid 64378] [client 51.103.45.195:18719] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeVs9XZav9wH8wxMd_uF3QAAAEI"]
[Mon Apr 20 08:01:59.262745 2026] [:error] [pid 64333:tid 64392] [client 51.103.45.195:18730] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeVs93Zav9wH8wxMd_uF5AAAAFA"]
[Mon Apr 20 08:02:00.888916 2026] [:error] [pid 47731:tid 47749] [client 51.103.45.195:18781] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeVs-FOwpc-h7Nzn-iO72gAAARA"]
[Mon Apr 20 08:02:03.192419 2026] [:error] [pid 64440:tid 64454] [client 51.103.45.195:18572] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeVs-9kVUvTgp8p7mrP8ZQAAAMs"]
[Mon Apr 20 08:02:07.053390 2026] [:error] [pid 64333:tid 64388] [client 51.103.45.195:18659] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "aeVs_3Zav9wH8wxMd_uF9gAAAEw"]
[Mon Apr 20 08:02:10.196942 2026] [:error] [pid 60072:tid 60077] [client 51.103.45.195:18560] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "aeVtAvuj5dzu2v3Qr6GwGwAAAcM"]
[Mon Apr 20 08:02:11.387376 2026] [:error] [pid 47731:tid 47754] [client 51.103.45.195:18751] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "aeVtA1Owpc-h7Nzn-iO73QAAARU"]
[Mon Apr 20 08:02:12.004003 2026] [:error] [pid 48101:tid 48113] [client 51.103.45.195:18687] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "aeVtBPIgenNbs2bVQGskmAAAAYk"]
[Mon Apr 20 08:02:12.827768 2026] [:error] [pid 64334:tid 64404] [client 51.103.45.195:18565] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aeVtBMNh9IxxDqsrPyO2PQAAAIE"]
[Mon Apr 20 08:02:13.569002 2026] [:error] [pid 47731:tid 47733] [client 51.103.45.195:18518] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aeVtBVOwpc-h7Nzn-iO74QAAAQA"]
[Mon Apr 20 08:02:14.390158 2026] [:error] [pid 64440:tid 64444] [client 51.103.45.195:18568] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aeVtBtkVUvTgp8p7mrP8agAAAME"]
[Mon Apr 20 08:02:15.282362 2026] [:error] [pid 47731:tid 47736] [client 51.103.45.195:18600] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aeVtB1Owpc-h7Nzn-iO74wAAAQM"]
[Mon Apr 20 08:02:15.833816 2026] [:error] [pid 60072:tid 60084] [client 51.103.45.195:18567] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeVtB_uj5dzu2v3Qr6GwIAAAAco"]
[Mon Apr 20 08:02:16.332020 2026] [:error] [pid 47731:tid 47737] [client 51.103.45.195:18511] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeVtCFOwpc-h7Nzn-iO75gAAAQQ"]
[Mon Apr 20 08:02:16.919865 2026] [:error] [pid 64333:tid 64382] [client 51.103.45.195:18683] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeVtCHZav9wH8wxMd_uF_QAAAEY"]
[Mon Apr 20 08:02:17.503878 2026] [:error] [pid 60072:tid 60094] [client 51.103.45.195:18664] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aeVtCfuj5dzu2v3Qr6GwIQAAAdQ"]
[Mon Apr 20 08:02:18.280944 2026] [:error] [pid 64440:tid 64460] [client 51.103.45.195:18628] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aeVtCtkVUvTgp8p7mrP8bgAAANE"]
[Mon Apr 20 08:02:18.869569 2026] [:error] [pid 47779:tid 47787] [client 51.103.45.195:18566] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aeVtCoahGl1n9UkmcNj64gAAAUY"]
[Mon Apr 20 08:02:19.466357 2026] [:error] [pid 64333:tid 64383] [client 51.103.45.195:18569] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aeVtC3Zav9wH8wxMd_uGAAAAAEc"]
[Mon Apr 20 08:02:20.185749 2026] [:error] [pid 64333:tid 64400] [client 51.103.45.195:18499] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aeVtDHZav9wH8wxMd_uGBgAAAFg"]
[Mon Apr 20 08:02:20.820268 2026] [:error] [pid 64333:tid 64384] [client 51.103.45.195:18577] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aeVtDHZav9wH8wxMd_uGCAAAAEg"]
[Mon Apr 20 08:02:21.729662 2026] [:error] [pid 64333:tid 64390] [client 51.103.45.195:18653] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aeVtDXZav9wH8wxMd_uGDQAAAE4"]
[Mon Apr 20 08:02:22.359345 2026] [:error] [pid 64333:tid 64395] [client 51.103.45.195:18506] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aeVtDnZav9wH8wxMd_uGEQAAAFM"]
[Mon Apr 20 08:02:23.229683 2026] [:error] [pid 64440:tid 64452] [client 51.103.45.195:18535] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "aeVtD9kVUvTgp8p7mrP8bwAAAMk"]
[Mon Apr 20 08:02:24.002906 2026] [:error] [pid 64333:tid 64387] [client 51.103.45.195:18711] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "aeVtEHZav9wH8wxMd_uGGAAAAEs"]
[Mon Apr 20 08:02:24.812200 2026] [:error] [pid 64333:tid 64392] [client 51.103.45.195:18642] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "aeVtEHZav9wH8wxMd_uGGgAAAFA"]
[Mon Apr 20 08:02:26.026323 2026] [:error] [pid 64333:tid 64391] [client 51.103.45.195:18598] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "aeVtEnZav9wH8wxMd_uGIgAAAE8"]
[Mon Apr 20 08:02:28.235427 2026] [:error] [pid 60072:tid 60090] [client 51.103.45.195:18621] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "aeVtFPuj5dzu2v3Qr6GwIwAAAdA"]
[Mon Apr 20 08:02:32.192069 2026] [:error] [pid 47779:tid 47797] [client 51.103.45.195:18677] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeVtGIahGl1n9UkmcNj65QAAAVA"]
[Mon Apr 20 08:02:34.324124 2026] [:error] [pid 64333:tid 64399] [client 51.103.45.195:18738] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeVtGnZav9wH8wxMd_uGMAAAAFc"]
[Mon Apr 20 08:02:35.863787 2026] [:error] [pid 64440:tid 64446] [client 51.103.45.195:18588] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeVtG9kVUvTgp8p7mrP8dQAAAMM"]
[Mon Apr 20 08:02:37.357628 2026] [:error] [pid 64332:tid 64362] [client 51.103.45.195:18584] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeVtHcAQ57uMKAVSYEknPQAAABQ"]
[Mon Apr 20 08:02:38.254285 2026] [:error] [pid 60072:tid 60084] [client 51.103.45.195:18501] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "aeVtHvuj5dzu2v3Qr6GwKQAAAco"]
[Mon Apr 20 08:02:38.888880 2026] [:error] [pid 47731:tid 47747] [client 51.103.45.195:18498] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "aeVtHlOwpc-h7Nzn-iO7-QAAAQ4"]
[Mon Apr 20 08:02:39.453383 2026] [:error] [pid 48101:tid 48115] [client 51.103.45.195:18515] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Mon Apr 20 08:02:39.691783 2026] [:error] [pid 48101:tid 48125] [client 51.103.45.195:18515] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Mon Apr 20 08:02:39.959393 2026] [:error] [pid 48101:tid 48111] [client 51.103.45.195:18515] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Mon Apr 20 08:02:40.249149 2026] [:error] [pid 48101:tid 48107] [client 51.103.45.195:18515] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Mon Apr 20 08:02:40.518968 2026] [:error] [pid 48101:tid 48116] [client 51.103.45.195:18515] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Mon Apr 20 08:02:41.412005 2026] [:error] [pid 48101:tid 48128] [client 51.103.45.195:18515] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Mon Apr 20 08:02:42.072908 2026] [:error] [pid 48101:tid 48105] [client 51.103.45.195:18515] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Mon Apr 20 08:02:42.339755 2026] [:error] [pid 48101:tid 48109] [client 51.103.45.195:18515] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Mon Apr 20 08:02:44.246385 2026] [:error] [pid 48101:tid 48120] [client 51.103.45.195:18515] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "aeVtJPIgenNbs2bVQGskswAAAZA"]
[Mon Apr 20 08:02:45.174152 2026] [:error] [pid 64333:tid 64376] [client 51.103.45.195:18576] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "aeVtJXZav9wH8wxMd_uGQwAAAEA"]
[Mon Apr 20 08:02:46.060784 2026] [:error] [pid 64333:tid 64381] [client 51.103.45.195:18609] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "aeVtJnZav9wH8wxMd_uGRgAAAEU"]
[Mon Apr 20 08:02:46.721211 2026] [:error] [pid 64333:tid 64380] [client 51.103.45.195:18685] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "aeVtJnZav9wH8wxMd_uGSQAAAEQ"]
[Mon Apr 20 08:02:48.099597 2026] [:error] [pid 64333:tid 64381] [client 51.103.45.195:18583] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeVtKHZav9wH8wxMd_uGVAAAAEU"]
[Mon Apr 20 08:02:50.427078 2026] [:error] [pid 64332:tid 64342] [client 51.103.45.195:18648] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeVtKsAQ57uMKAVSYEknTAAAAAA"]
[Mon Apr 20 08:02:53.111808 2026] [:error] [pid 64333:tid 64397] [client 51.103.45.195:18599] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeVtLXZav9wH8wxMd_uGcAAAAFU"]
[Mon Apr 20 08:02:54.455123 2026] [:error] [pid 64440:tid 64465] [client 51.103.45.195:18592] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeVtLtkVUvTgp8p7mrP8hQAAANY"]
[Mon Apr 20 08:02:58.539101 2026] [:error] [pid 64333:tid 64377] [client 51.103.45.195:18708] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aeVtMnZav9wH8wxMd_uGgAAAAEE"]
[Mon Apr 20 08:03:00.457800 2026] [:error] [pid 47731:tid 47746] [client 51.103.45.195:18695] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aeVtNFOwpc-h7Nzn-iO8AgAAAQ0"]
[Mon Apr 20 08:03:03.574318 2026] [:error] [pid 48101:tid 48106] [client 51.103.45.195:18659] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aeVtN_IgenNbs2bVQGskwwAAAYI"]
[Mon Apr 20 08:03:05.054773 2026] [:error] [pid 47731:tid 47737] [client 51.103.45.195:18799] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aeVtOVOwpc-h7Nzn-iO8CQAAAQQ"]
[Mon Apr 20 08:03:06.554291 2026] [:error] [pid 64333:tid 64392] [client 51.103.45.195:18800] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "aeVtOnZav9wH8wxMd_uGlAAAAFA"]
[Mon Apr 20 08:03:07.506116 2026] [:error] [pid 48101:tid 48109] [client 51.103.45.195:18789] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "aeVtO_IgenNbs2bVQGskygAAAYU"]
[Mon Apr 20 08:03:08.049165 2026] [:error] [pid 64440:tid 64467] [client 51.103.45.195:18587] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "aeVtPNkVUvTgp8p7mrP8jQAAANg"]
[Mon Apr 20 08:03:08.774320 2026] [:error] [pid 64332:tid 64365] [client 51.103.45.195:18629] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "aeVtPMAQ57uMKAVSYEknYAAAABc"]
[Mon Apr 20 08:03:09.363194 2026] [:error] [pid 47731:tid 47736] [client 51.103.45.195:18611] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "aeVtPVOwpc-h7Nzn-iO8FQAAAQM"]
[Mon Apr 20 08:03:10.136096 2026] [:error] [pid 47731:tid 47743] [client 51.103.45.195:18771] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "aeVtPlOwpc-h7Nzn-iO8FwAAAQo"]
[Mon Apr 20 08:03:14.895274 2026] [:error] [pid 60072:tid 60074] [client 51.103.45.195:18610] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "aeVtQvuj5dzu2v3Qr6GwNgAAAcA"]
[Mon Apr 20 08:03:15.653676 2026] [:error] [pid 64334:tid 64417] [client 51.103.45.195:18504] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "aeVtQ8Nh9IxxDqsrPyO2bgAAAI4"]
[Mon Apr 20 08:03:16.318247 2026] [:error] [pid 64332:tid 64352] [client 51.103.45.195:18662] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aeVtRMAQ57uMKAVSYEknbQAAAAo"]
[Mon Apr 20 08:03:16.967075 2026] [:error] [pid 64333:tid 64390] [client 51.103.45.195:18705] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aeVtRHZav9wH8wxMd_uGpwAAAE4"]
[Mon Apr 20 08:03:17.626281 2026] [:error] [pid 64332:tid 64342] [client 51.103.45.195:18519] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aeVtRcAQ57uMKAVSYEkncgAAAAA"]
[Mon Apr 20 08:03:18.448065 2026] [:error] [pid 64332:tid 64355] [client 51.103.45.195:18585] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aeVtRsAQ57uMKAVSYEkndgAAAA0"]
[Mon Apr 20 08:03:19.024582 2026] [:error] [pid 64332:tid 64361] [client 51.103.45.195:18646] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aeVtR8AQ57uMKAVSYEkneAAAABM"]
[Mon Apr 20 08:03:19.658382 2026] [:error] [pid 64333:tid 64379] [client 51.103.45.195:18528] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aeVtR3Zav9wH8wxMd_uGsQAAAEM"]
[Mon Apr 20 08:03:20.730430 2026] [:error] [pid 48101:tid 48106] [client 51.103.45.195:18805] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aeVtSPIgenNbs2bVQGskzwAAAYI"]
[Mon Apr 20 08:03:21.506926 2026] [:error] [pid 64333:tid 64378] [client 51.103.45.195:18698] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aeVtSXZav9wH8wxMd_uGvQAAAEI"]
[Mon Apr 20 08:03:22.345872 2026] [:error] [pid 64333:tid 64388] [client 51.103.45.195:18747] [client 51.103.45.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeVtSnZav9wH8wxMd_uGwwAAAEw"]
[Mon Apr 20 08:03:23.387499 2026] [:error] [pid 64332:tid 64362] [client 51.103.45.195:18702] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aeVtS8AQ57uMKAVSYEknfwAAABQ"]
[Mon Apr 20 08:03:24.790920 2026] [:error] [pid 64334:tid 64405] [client 51.103.45.195:18815] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aeVtTMNh9IxxDqsrPyO2eAAAAII"]
[Mon Apr 20 08:03:25.685420 2026] [:error] [pid 47731:tid 47752] [client 51.103.45.195:18510] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aeVtTVOwpc-h7Nzn-iO8IQAAARM"]
[Mon Apr 20 08:03:26.471933 2026] [:error] [pid 60072:tid 60095] [client 51.103.45.195:18802] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeVtTvuj5dzu2v3Qr6GwOgAAAdU"]
[Mon Apr 20 08:03:27.208655 2026] [:error] [pid 64332:tid 64348] [client 51.103.45.195:18607] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeVtT8AQ57uMKAVSYEkniQAAAAY"]
[Mon Apr 20 08:03:28.040286 2026] [:error] [pid 64332:tid 64349] [client 51.103.45.195:18688] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeVtUMAQ57uMKAVSYEknjAAAAAc"]
[Mon Apr 20 08:03:28.598102 2026] [:error] [pid 64333:tid 64399] [client 51.103.45.195:18681] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeVtUHZav9wH8wxMd_uG1AAAAFc"]
[Mon Apr 20 08:03:29.220608 2026] [:error] [pid 64440:tid 64460] [client 51.103.45.195:18790] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeVtUdkVUvTgp8p7mrP8kgAAANE"]
[Mon Apr 20 08:03:29.893635 2026] [:error] [pid 64333:tid 64397] [client 51.103.45.195:18769] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeVtUXZav9wH8wxMd_uG2gAAAFU"]
[Mon Apr 20 08:03:30.714645 2026] [:error] [pid 47731:tid 47733] [client 51.103.45.195:18684] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeVtUlOwpc-h7Nzn-iO8JwAAAQA"]
[Mon Apr 20 08:03:31.904717 2026] [:error] [pid 64332:tid 64360] [client 51.103.45.195:18531] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeVtU8AQ57uMKAVSYEknkgAAABI"]
[Mon Apr 20 08:03:33.561109 2026] [:error] [pid 64440:tid 64467] [client 51.103.45.195:18746] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/prv8.php"] [unique_id "aeVtVdkVUvTgp8p7mrP8lgAAANg"]
[Mon Apr 20 08:03:35.726403 2026] [:error] [pid 64332:tid 64342] [client 51.103.45.195:18706] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/prv8.php"] [unique_id "aeVtV8AQ57uMKAVSYEknmwAAAAA"]
[Mon Apr 20 08:03:37.806805 2026] [:error] [pid 64332:tid 64355] [client 51.103.45.195:18812] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/prv8.php"] [unique_id "aeVtWcAQ57uMKAVSYEknnwAAAA0"]
[Mon Apr 20 08:03:40.439512 2026] [:error] [pid 64332:tid 64352] [client 51.103.45.195:18536] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/prv8.php"] [unique_id "aeVtXMAQ57uMKAVSYEknowAAAAo"]
[Mon Apr 20 08:03:42.697984 2026] [:error] [pid 48101:tid 48124] [client 51.103.45.195:18522] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aeVtXvIgenNbs2bVQGsk1wAAAZQ"]
[Mon Apr 20 08:03:43.694725 2026] [:error] [pid 60072:tid 60077] [client 51.103.45.195:18809] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aeVtX_uj5dzu2v3Qr6GwRgAAAcM"]
[Mon Apr 20 08:03:44.461865 2026] [:error] [pid 64333:tid 64385] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Mon Apr 20 08:03:44.745103 2026] [:error] [pid 64333:tid 64392] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Mon Apr 20 08:03:44.986616 2026] [:error] [pid 64333:tid 64377] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Mon Apr 20 08:03:45.224988 2026] [:error] [pid 64333:tid 64396] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Mon Apr 20 08:03:45.741852 2026] [:error] [pid 64333:tid 64398] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Mon Apr 20 08:03:46.000466 2026] [:error] [pid 64333:tid 64400] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Mon Apr 20 08:03:46.262032 2026] [:error] [pid 64333:tid 64376] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Mon Apr 20 08:03:46.501308 2026] [:error] [pid 64333:tid 64383] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Mon Apr 20 08:03:47.046133 2026] [:error] [pid 64333:tid 64394] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Mon Apr 20 08:03:47.308674 2026] [:error] [pid 64333:tid 64393] [client 51.103.45.195:18573] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Mon Apr 20 08:03:47.545164 2026] [:error] [pid 64333:tid 64390] [client 51.103.45.195:18573] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeVtY3Zav9wH8wxMd_uG9QAAAE4"]
[Mon Apr 20 08:03:48.464659 2026] [:error] [pid 64334:tid 64404] [client 51.103.45.195:18808] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeVtZMNh9IxxDqsrPyO2kwAAAIE"]
[Mon Apr 20 08:03:49.333838 2026] [:error] [pid 64333:tid 64381] [client 51.103.45.195:18703] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeVtZXZav9wH8wxMd_uG_wAAAEU"]
[Mon Apr 20 08:03:49.827549 2026] [:error] [pid 64440:tid 64462] [client 51.103.45.195:18715] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aeVtZdkVUvTgp8p7mrP8mQAAANM"]
[Mon Apr 20 08:03:50.389834 2026] [:error] [pid 64333:tid 64400] [client 51.103.45.195:18707] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aeVtZnZav9wH8wxMd_uHAwAAAFg"]
[Mon Apr 20 08:03:50.898597 2026] [:error] [pid 64333:tid 64383] [client 51.103.45.195:18444] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aeVtZnZav9wH8wxMd_uHBQAAAEc"]
[Mon Apr 20 08:03:51.425937 2026] [:error] [pid 64333:tid 64399] [client 51.103.45.195:18575] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aeVtZ3Zav9wH8wxMd_uHBgAAAFc"]
[Mon Apr 20 08:03:52.036487 2026] [:error] [pid 64333:tid 64385] [client 51.103.45.195:18814] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aeVtaHZav9wH8wxMd_uHCAAAAEk"]
[Mon Apr 20 08:03:52.642033 2026] [:error] [pid 64333:tid 64396] [client 51.103.45.195:18458] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "aeVtaHZav9wH8wxMd_uHCQAAAFQ"]
[Mon Apr 20 08:03:53.366703 2026] [:error] [pid 64334:tid 64404] [client 51.103.45.195:18775] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "aeVtacNh9IxxDqsrPyO2mAAAAIE"]
[Mon Apr 20 08:03:54.052011 2026] [:error] [pid 64440:tid 64460] [client 51.103.45.195:18634] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "aeVtatkVUvTgp8p7mrP8mgAAANE"]
[Mon Apr 20 08:03:54.661774 2026] [:error] [pid 64440:tid 64454] [client 51.103.45.195:18624] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "aeVtatkVUvTgp8p7mrP8mwAAAMs"]
[Mon Apr 20 08:03:55.210338 2026] [:error] [pid 64332:tid 64364] [client 51.103.45.195:18774] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "aeVta8AQ57uMKAVSYEkntAAAABY"]
[Mon Apr 20 08:03:55.827683 2026] [:error] [pid 64332:tid 64359] [client 51.103.45.195:18811] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "aeVta8AQ57uMKAVSYEkntgAAABE"]
[Mon Apr 20 08:03:56.308253 2026] [:error] [pid 64332:tid 64350] [client 51.103.45.195:18686] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "aeVtbMAQ57uMKAVSYEkntwAAAAg"]
[Mon Apr 20 08:03:56.880314 2026] [:error] [pid 64332:tid 64347] [client 51.103.45.195:18782] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "aeVtbMAQ57uMKAVSYEknuwAAAAU"]
[Mon Apr 20 08:03:57.864103 2026] [:error] [pid 47731:tid 47756] [client 51.103.45.195:18691] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeVtbVOwpc-h7Nzn-iO8OAAAARc"]
[Mon Apr 20 08:03:59.075595 2026] [:error] [pid 48101:tid 48106] [client 51.103.45.195:18436] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeVtb_IgenNbs2bVQGsk2QAAAYI"]
[Mon Apr 20 08:04:01.086373 2026] [:error] [pid 47731:tid 47755] [client 51.103.45.195:18741] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeVtcVOwpc-h7Nzn-iO8PwAAARY"]
[Mon Apr 20 08:04:09.736522 2026] [:error] [pid 64332:tid 64355] [client 51.103.45.195:18622] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "aeVtecAQ57uMKAVSYEknxAAAAA0"]
[Mon Apr 20 08:04:13.860061 2026] [:error] [pid 64333:tid 64378] [client 51.103.45.195:18765] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "aeVtfXZav9wH8wxMd_uHIQAAAEI"]
[Mon Apr 20 08:04:21.667183 2026] [:error] [pid 47779:tid 47783] [client 51.103.45.195:18750] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "aeVthYahGl1n9UkmcNj7FQAAAUI"]
[Mon Apr 20 08:04:24.245256 2026] [:error] [pid 64332:tid 64347] [client 51.103.45.195:18701] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "aeVtiMAQ57uMKAVSYEkn0wAAAAU"]
[Mon Apr 20 08:04:26.659620 2026] [:error] [pid 64333:tid 64377] [client 51.103.45.195:18794] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "aeVtinZav9wH8wxMd_uHOwAAAEE"]
[Mon Apr 20 08:04:29.726820 2026] [:error] [pid 64332:tid 64342] [client 51.103.45.195:18712] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "aeVtjcAQ57uMKAVSYEkn4AAAAAA"]
[Mon Apr 20 08:04:31.872156 2026] [:error] [pid 47731:tid 47736] [client 51.103.45.195:18813] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "aeVtj1Owpc-h7Nzn-iO8sgAAAQM"]
[Mon Apr 20 08:04:33.410664 2026] [:error] [pid 48101:tid 48121] [client 51.103.45.195:18693] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ew.php"] [unique_id "aeVtkfIgenNbs2bVQGsk3gAAAZE"]
[Mon Apr 20 08:04:34.108721 2026] [:error] [pid 64440:tid 64456] [client 51.103.45.195:18697] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "aeVtktkVUvTgp8p7mrP8twAAAM0"]
[Mon Apr 20 08:04:35.270164 2026] [:error] [pid 47731:tid 47750] [client 51.103.45.195:18755] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "aeVtk1Owpc-h7Nzn-iO8uAAAARE"]
[Mon Apr 20 08:04:36.005895 2026] [:error] [pid 64333:tid 64376] [client 51.103.45.195:18689] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "aeVtlHZav9wH8wxMd_uHPQAAAEA"]
[Mon Apr 20 08:04:37.122500 2026] [:error] [pid 64332:tid 64363] [client 51.103.45.195:18783] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file21.php"] [unique_id "aeVtlcAQ57uMKAVSYEkn8gAAABU"]
[Mon Apr 20 08:04:38.626642 2026] [:error] [pid 64333:tid 64383] [client 51.103.45.195:18804] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "aeVtlnZav9wH8wxMd_uHQwAAAEc"]
[Mon Apr 20 08:04:39.729858 2026] [:error] [pid 64333:tid 64387] [client 51.103.45.195:18763] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "aeVtl3Zav9wH8wxMd_uHSAAAAEs"]
[Mon Apr 20 08:04:40.504937 2026] [:error] [pid 48101:tid 48118] [client 51.103.45.195:18795] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "aeVtmPIgenNbs2bVQGsk4QAAAY4"]
[Mon Apr 20 08:04:41.206814 2026] [:error] [pid 47731:tid 47745] [client 51.103.45.195:18700] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class19.php"] [unique_id "aeVtmVOwpc-h7Nzn-iO8wQAAAQw"]
[Mon Apr 20 08:04:42.256143 2026] [:error] [pid 64333:tid 64392] [client 51.103.45.195:18496] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class20.php"] [unique_id "aeVtmnZav9wH8wxMd_uHSgAAAFA"]
[Mon Apr 20 08:04:44.324419 2026] [:error] [pid 60072:tid 60089] [client 51.103.45.195:18762] [client 51.103.45.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class20.php"] [unique_id "aeVtnPuj5dzu2v3Qr6GwuQAAAc8"]
[Mon Apr 20 08:04:47.050642 2026] [:error] [pid 64332:tid 64343] [client 51.103.45.195:18803] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Mon Apr 20 08:04:47.291309 2026] [:error] [pid 64332:tid 64366] [client 51.103.45.195:18803] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Mon Apr 20 08:04:47.530554 2026] [:error] [pid 64332:tid 64353] [client 51.103.45.195:18803] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Mon Apr 20 08:04:48.709742 2026] [:error] [pid 64332:tid 64364] [client 51.103.45.195:18803] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Mon Apr 20 08:04:48.955894 2026] [:error] [pid 64332:tid 64351] [client 51.103.45.195:18803] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Mon Apr 20 08:04:49.226621 2026] [:error] [pid 64332:tid 64344] [client 51.103.45.195:18803] File does not exist: /usr/local/apache/htdocs/suspended-page/x1da.php
[Mon Apr 20 08:04:49.466599 2026] [:error] [pid 64332:tid 64342] [client 51.103.45.195:18803] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Mon Apr 20 08:04:49.707284 2026] [:error] [pid 64332:tid 64363] [client 51.103.45.195:18803] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 21 00:44:14.687391 2026] [:error] [pid 11441:tid 11454] [client 51.120.70.13:57895] [client 51.120.70.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeZX3sixByFUvmh319DRKgAAAMs"]
[Tue Apr 21 00:44:16.152013 2026] [:error] [pid 11441:tid 11455] [client 51.120.70.13:50316] [client 51.120.70.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeZX4MixByFUvmh319DRLAAAAMw"]
[Tue Apr 21 00:44:16.870299 2026] [:error] [pid 11350:tid 11376] [client 51.120.70.13:50345] [client 51.120.70.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeZX4P4EoMBgOJuJnT0O7AAAABE"]
[Tue Apr 21 00:44:18.483263 2026] [:error] [pid 11494:tid 11512] [client 51.120.70.13:50336] [client 51.120.70.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeZX4sgko5iFiE8YoyQlkAAAAZA"]
[Tue Apr 21 14:49:49.256469 2026] [:error] [pid 35415:tid 35428] [client 50.17.106.38:33582] [client 50.17.106.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aeceDUiqDinI4_22zzhFigAAAME"]
[Tue Apr 21 14:49:50.552211 2026] [:error] [pid 4822:tid 4846] [client 50.17.106.38:55768] [client 50.17.106.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aeceDiAteFQFwS_23JmL-wAAAVQ"]
[Tue Apr 21 14:49:51.646956 2026] [:error] [pid 5377:tid 5405] [client 50.17.106.38:55828] [client 50.17.106.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "aeceD7BKychFlrHBdvvBEwAAAdM"]
[Tue Apr 21 14:49:52.669681 2026] [:error] [pid 4822:tid 4846] [client 50.17.106.38:55896] [client 50.17.106.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "aeceECAteFQFwS_23JmMCQAAAVQ"]
[Tue Apr 21 15:36:05.270437 2026] [:error] [pid 35321:tid 35384] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 21 15:36:05.560171 2026] [:error] [pid 35321:tid 35393] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Apr 21 15:36:05.867645 2026] [:error] [pid 35321:tid 35389] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 21 15:36:06.172488 2026] [:error] [pid 35321:tid 35393] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Apr 21 15:36:06.475114 2026] [:error] [pid 35321:tid 35388] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Tue Apr 21 15:36:06.772838 2026] [:error] [pid 35321:tid 35408] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Apr 21 15:36:07.053679 2026] [:error] [pid 35321:tid 35408] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 21 15:36:07.342499 2026] [:error] [pid 35321:tid 35388] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Apr 21 15:36:07.640270 2026] [:error] [pid 35321:tid 35388] [client 185.82.72.103:57181] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 15:36:07.916636 2026] [:error] [pid 35321:tid 35399] [client 185.82.72.103:57181] [client 185.82.72.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aeco5zeHLhVUuu8cVXykGgAAAE8"]
[Tue Apr 21 15:36:08.479034 2026] [:error] [pid 4777:tid 4798] [client 185.82.72.103:26585] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 21 15:36:08.744205 2026] [:error] [pid 4777:tid 4811] [client 185.82.72.103:26585] [client 185.82.72.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aeco6KxXur6bykKyLZSFIAAAARc"]
[Tue Apr 21 15:36:09.289921 2026] [:error] [pid 53832:tid 53854] [client 45.86.200.238:31931] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Tue Apr 21 15:36:09.558344 2026] [:error] [pid 53832:tid 53857] [client 45.86.200.238:31931] [client 45.86.200.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit-tags.php"] [unique_id "aeco6dzkuxsE_OhM9UISRgAAAlY"]
[Tue Apr 21 15:36:10.114430 2026] [:error] [pid 35321:tid 35406] [client 45.86.200.240:40301] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Tue Apr 21 15:36:10.433290 2026] [:error] [pid 35321:tid 35389] [client 45.86.200.240:40301] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Tue Apr 21 15:36:10.728176 2026] [:error] [pid 35321:tid 35384] [client 45.86.200.240:40301] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 21 15:36:11.007804 2026] [:error] [pid 35321:tid 35384] [client 45.86.200.240:40301] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Apr 21 15:36:11.284622 2026] [:error] [pid 35321:tid 35399] [client 45.86.200.240:40301] [client 45.86.200.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aeco6zeHLhVUuu8cVXykYAAAAE8"]
[Tue Apr 21 15:36:11.829087 2026] [:error] [pid 54080:tid 54092] [client 45.86.200.244:44223] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Apr 21 15:36:12.103496 2026] [:error] [pid 54080:tid 54100] [client 45.86.200.244:44223] [client 45.86.200.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aeco7IzEbQHHxtmWbaZRewAAAtI"]
[Tue Apr 21 15:36:12.652121 2026] [:error] [pid 4823:tid 4869] [client 45.86.200.249:37253] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 21 15:36:12.984691 2026] [:error] [pid 4823:tid 4862] [client 45.86.200.249:37253] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Apr 21 15:36:13.296252 2026] [:error] [pid 4823:tid 4865] [client 45.86.200.249:37253] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 15:36:13.603770 2026] [:error] [pid 4823:tid 4874] [client 45.86.200.249:37253] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Apr 21 15:36:13.924677 2026] [:error] [pid 4823:tid 4864] [client 45.86.200.249:37253] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 21 15:36:14.199100 2026] [:error] [pid 4823:tid 4855] [client 45.86.200.249:37253] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Tue Apr 21 15:36:14.489779 2026] [:error] [pid 4823:tid 4862] [client 45.86.200.249:37253] [client 45.86.200.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aeco7vc8mke3PfHqsxG3nAAAAYk"]
[Tue Apr 21 15:36:15.027048 2026] [:error] [pid 35415:tid 35446] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 21 15:36:15.321601 2026] [:error] [pid 35415:tid 35437] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Apr 21 15:36:15.591965 2026] [:error] [pid 35415:tid 35436] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Apr 21 15:36:15.864526 2026] [:error] [pid 35415:tid 35433] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Tue Apr 21 15:36:16.164264 2026] [:error] [pid 35415:tid 35438] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Tue Apr 21 15:36:16.438677 2026] [:error] [pid 35415:tid 35432] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Tue Apr 21 15:36:16.734760 2026] [:error] [pid 35415:tid 35447] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 21 15:36:17.032874 2026] [:error] [pid 35415:tid 35436] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Tue Apr 21 15:36:17.324742 2026] [:error] [pid 35415:tid 35433] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Tue Apr 21 15:36:17.626990 2026] [:error] [pid 35415:tid 35438] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 21 15:36:17.991586 2026] [:error] [pid 35415:tid 35432] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Apr 21 15:36:31.039123 2026] [:error] [pid 35415:tid 35432] [client 45.86.200.241:59675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Tue Apr 21 15:36:37.469142 2026] [:error] [pid 53731:tid 53742] [client 45.86.200.222:26681] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 21 15:36:45.986502 2026] [:error] [pid 5377:tid 5399] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 21 15:36:46.267375 2026] [:error] [pid 5377:tid 5391] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Apr 21 15:36:46.539713 2026] [:error] [pid 5377:tid 5404] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 21 15:36:46.821162 2026] [:error] [pid 5377:tid 5410] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Apr 21 15:36:47.117136 2026] [:error] [pid 5377:tid 5396] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Tue Apr 21 15:36:47.410837 2026] [:error] [pid 5377:tid 5392] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Apr 21 15:36:47.687749 2026] [:error] [pid 5377:tid 5393] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 21 15:36:47.958790 2026] [:error] [pid 5377:tid 5390] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Apr 21 15:36:48.279567 2026] [:error] [pid 5377:tid 5405] [client 185.82.72.102:47861] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 15:36:48.554092 2026] [:error] [pid 5377:tid 5401] [client 185.82.72.102:47861] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aecpELBKychFlrHBdvvjfAAAAc8"]
[Tue Apr 21 15:36:49.096357 2026] [:error] [pid 35321:tid 35386] [client 185.82.72.206:50981] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 21 15:36:49.495160 2026] [:error] [pid 35321:tid 35386] [client 185.82.72.206:50981] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aecpETeHLhVUuu8cVXynawAAAEI"]
[Tue Apr 21 15:36:50.037888 2026] [:error] [pid 4777:tid 4792] [client 45.86.200.225:46757] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Tue Apr 21 15:36:50.144348 2026] [:error] [pid 53731:tid 53754] [client 45.86.200.222:26681] [client 45.86.200.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/Avada/includes/"] [unique_id "aecpEl2I9THUR-bRVGzaDQAAAhI"]
[Tue Apr 21 15:36:50.317525 2026] [:error] [pid 4777:tid 4790] [client 45.86.200.225:46757] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Tue Apr 21 15:36:50.592152 2026] [:error] [pid 4777:tid 4791] [client 45.86.200.225:46757] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Tue Apr 21 15:36:50.878845 2026] [:error] [pid 4777:tid 4789] [client 45.86.200.225:46757] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 21 15:36:51.158101 2026] [:error] [pid 4777:tid 4802] [client 45.86.200.225:46757] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Apr 21 15:36:51.433694 2026] [:error] [pid 4777:tid 4793] [client 45.86.200.225:46757] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aecpE6xXur6bykKyLZSGbAAAAQU"]
[Tue Apr 21 15:36:51.980019 2026] [:error] [pid 4823:tid 4860] [client 45.86.200.228:54795] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Apr 21 15:36:52.256959 2026] [:error] [pid 4823:tid 4868] [client 45.86.200.228:54795] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 21 15:36:52.546874 2026] [:error] [pid 4823:tid 4877] [client 45.86.200.228:54795] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Apr 21 15:36:52.820176 2026] [:error] [pid 4823:tid 4861] [client 45.86.200.228:54795] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 15:36:53.092033 2026] [:error] [pid 4823:tid 4853] [client 45.86.200.228:54795] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Apr 21 15:36:53.374815 2026] [:error] [pid 4823:tid 4860] [client 45.86.200.228:54795] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 21 15:36:53.646819 2026] [:error] [pid 4823:tid 4871] [client 45.86.200.228:54795] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Tue Apr 21 15:36:53.925718 2026] [:error] [pid 4823:tid 4865] [client 45.86.200.228:54795] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aecpFfc8mke3PfHqsxG4-QAAAYw"]
[Tue Apr 21 15:36:54.462350 2026] [:error] [pid 5377:tid 5396] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 21 15:36:54.733082 2026] [:error] [pid 5377:tid 5402] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Apr 21 15:36:55.005866 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Apr 21 15:36:55.253520 2026] [:error] [pid 4823:tid 4867] [client 45.86.200.243:59943] [client 45.86.200.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2025/"] [unique_id "aecpF_c8mke3PfHqsxG5DQAAAY4"]
[Tue Apr 21 15:36:55.285377 2026] [:error] [pid 5377:tid 5409] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Tue Apr 21 15:36:55.574417 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Tue Apr 21 15:36:55.863496 2026] [:error] [pid 5377:tid 5390] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Tue Apr 21 15:36:56.136218 2026] [:error] [pid 5377:tid 5405] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 21 15:36:56.420927 2026] [:error] [pid 5377:tid 5409] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Tue Apr 21 15:36:56.694849 2026] [:error] [pid 5377:tid 5401] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Tue Apr 21 15:36:56.980329 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 21 15:36:57.254922 2026] [:error] [pid 5377:tid 5393] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Apr 21 15:36:57.550483 2026] [:error] [pid 5377:tid 5394] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Tue Apr 21 15:36:57.819859 2026] [:error] [pid 5377:tid 5391] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Apr 21 15:36:58.109010 2026] [:error] [pid 5377:tid 5400] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Tue Apr 21 15:36:58.382148 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Tue Apr 21 15:36:58.666617 2026] [:error] [pid 5377:tid 5390] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Tue Apr 21 15:36:58.940175 2026] [:error] [pid 5377:tid 5405] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Apr 21 15:36:59.222582 2026] [:error] [pid 5377:tid 5394] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Tue Apr 21 15:36:59.354439 2026] [:error] [pid 53832:tid 53848] [client 45.86.200.247:46997] [client 45.86.200.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/"] [unique_id "aecpG9zkuxsE_OhM9UIUvQAAAk0"]
[Tue Apr 21 15:36:59.500850 2026] [:error] [pid 5377:tid 5391] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Tue Apr 21 15:36:59.776881 2026] [:error] [pid 5377:tid 5401] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue Apr 21 15:36:59.889804 2026] [:error] [pid 35321:tid 35401] [client 45.86.200.237:39855] [client 45.86.200.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/"] [unique_id "aecpGzeHLhVUuu8cVXyolgAAAFE"]
[Tue Apr 21 15:37:00.051526 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Tue Apr 21 15:37:00.326165 2026] [:error] [pid 5377:tid 5408] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue Apr 21 15:37:00.618448 2026] [:error] [pid 5377:tid 5393] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Tue Apr 21 15:37:00.921752 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Apr 21 15:37:01.197350 2026] [:error] [pid 5377:tid 5388] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Tue Apr 21 15:37:01.480709 2026] [:error] [pid 5377:tid 5409] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Tue Apr 21 15:37:01.755216 2026] [:error] [pid 5377:tid 5389] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Tue Apr 21 15:37:02.035311 2026] [:error] [pid 5377:tid 5400] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Apr 21 15:37:02.321250 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Tue Apr 21 15:37:02.621552 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Apr 21 15:37:02.903348 2026] [:error] [pid 5377:tid 5397] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Apr 21 15:37:03.186892 2026] [:error] [pid 5377:tid 5408] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Tue Apr 21 15:37:03.519642 2026] [:error] [pid 5377:tid 5396] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Tue Apr 21 15:37:03.798281 2026] [:error] [pid 5377:tid 5393] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Apr 21 15:37:04.072996 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Apr 21 15:37:05.964524 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Apr 21 15:37:06.251773 2026] [:error] [pid 5377:tid 5388] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Tue Apr 21 15:37:06.530949 2026] [:error] [pid 5377:tid 5399] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Tue Apr 21 15:37:06.812939 2026] [:error] [pid 5377:tid 5391] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 21 15:37:07.093791 2026] [:error] [pid 5377:tid 5389] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Apr 21 15:37:07.369400 2026] [:error] [pid 5377:tid 5402] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Apr 21 15:37:07.657736 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Tue Apr 21 15:37:07.953543 2026] [:error] [pid 5377:tid 5397] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Tue Apr 21 15:37:08.227947 2026] [:error] [pid 5377:tid 5396] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Apr 21 15:37:08.508514 2026] [:error] [pid 5377:tid 5393] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Apr 21 15:37:08.793093 2026] [:error] [pid 5377:tid 5406] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 21 15:37:09.120803 2026] [:error] [pid 5377:tid 5388] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Tue Apr 21 15:37:09.414576 2026] [:error] [pid 5377:tid 5391] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 21 15:37:09.701083 2026] [:error] [pid 5377:tid 5403] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 21 15:37:09.979854 2026] [:error] [pid 5377:tid 5401] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Tue Apr 21 15:37:10.280454 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Tue Apr 21 15:37:10.573800 2026] [:error] [pid 5377:tid 5396] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Apr 21 15:37:10.843787 2026] [:error] [pid 5377:tid 5387] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Tue Apr 21 15:37:11.127444 2026] [:error] [pid 5377:tid 5395] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Apr 21 15:37:11.411590 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 21 15:37:11.691514 2026] [:error] [pid 5377:tid 5388] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Tue Apr 21 15:37:11.961056 2026] [:error] [pid 5377:tid 5390] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Apr 21 15:37:12.262420 2026] [:error] [pid 5377:tid 5403] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Tue Apr 21 15:37:12.545428 2026] [:error] [pid 5377:tid 5389] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue Apr 21 15:37:12.833611 2026] [:error] [pid 5377:tid 5402] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Tue Apr 21 15:37:13.125991 2026] [:error] [pid 5377:tid 5396] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Tue Apr 21 15:37:13.409671 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Tue Apr 21 15:37:13.691912 2026] [:error] [pid 5377:tid 5393] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Apr 21 15:37:13.977253 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 21 15:37:14.248164 2026] [:error] [pid 5377:tid 5399] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Apr 21 15:37:14.528195 2026] [:error] [pid 5377:tid 5389] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Apr 21 15:37:14.799701 2026] [:error] [pid 5377:tid 5401] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Tue Apr 21 15:37:15.078455 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Tue Apr 21 15:37:15.362945 2026] [:error] [pid 5377:tid 5405] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Tue Apr 21 15:37:15.650153 2026] [:error] [pid 5377:tid 5394] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Apr 21 15:37:15.926749 2026] [:error] [pid 5377:tid 5388] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 21 15:37:16.213249 2026] [:error] [pid 5377:tid 5400] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 21 15:37:16.491424 2026] [:error] [pid 5377:tid 5396] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Tue Apr 21 15:37:16.771794 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Tue Apr 21 15:37:17.052114 2026] [:error] [pid 5377:tid 5407] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Tue Apr 21 15:37:17.332698 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Tue Apr 21 15:37:17.615915 2026] [:error] [pid 5377:tid 5390] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Tue Apr 21 15:37:18.169529 2026] [:error] [pid 5377:tid 5409] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/bs.php
[Tue Apr 21 15:37:18.448221 2026] [:error] [pid 5377:tid 5407] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php
[Tue Apr 21 15:37:18.732139 2026] [:error] [pid 5377:tid 5406] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Tue Apr 21 15:37:19.020646 2026] [:error] [pid 5377:tid 5391] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Tue Apr 21 15:37:19.301016 2026] [:error] [pid 5377:tid 5399] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/tools.php
[Tue Apr 21 15:37:19.577953 2026] [:error] [pid 5377:tid 5396] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue Apr 21 15:37:19.853178 2026] [:error] [pid 5377:tid 5407] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Apr 21 15:37:20.125412 2026] [:error] [pid 5377:tid 5395] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Tue Apr 21 15:37:20.404449 2026] [:error] [pid 5377:tid 5400] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/st.php
[Tue Apr 21 15:37:20.684078 2026] [:error] [pid 5377:tid 5401] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/GA13.php
[Tue Apr 21 15:37:21.251329 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Apr 21 15:37:21.534161 2026] [:error] [pid 5377:tid 5393] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/locks.php
[Tue Apr 21 15:37:21.894175 2026] [:error] [pid 35320:tid 35341] [client 45.86.200.236:50011] [client 45.86.200.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aecpMYJW6fdXWO6agMEcKQAAAAs"]
[Tue Apr 21 15:37:22.078628 2026] [:error] [pid 5377:tid 5403] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Tue Apr 21 15:37:22.349872 2026] [:error] [pid 5377:tid 5389] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads.php
[Tue Apr 21 15:37:22.621170 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Tue Apr 21 15:37:22.916659 2026] [:error] [pid 5377:tid 5405] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Tue Apr 21 15:37:23.187060 2026] [:error] [pid 5377:tid 5387] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Tue Apr 21 15:37:23.464623 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue Apr 21 15:37:23.744515 2026] [:error] [pid 5377:tid 5388] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Tue Apr 21 15:37:24.031395 2026] [:error] [pid 5377:tid 5392] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa.php
[Tue Apr 21 15:37:24.315108 2026] [:error] [pid 5377:tid 5402] [client 45.86.200.244:34269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-zx.php
[Tue Apr 21 15:37:26.045439 2026] [:error] [pid 4777:tid 4804] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Apr 21 15:37:26.319029 2026] [:error] [pid 4777:tid 4801] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/fiyhxaae.php
[Tue Apr 21 15:37:26.597104 2026] [:error] [pid 4777:tid 4792] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Tue Apr 21 15:37:26.870778 2026] [:error] [pid 4777:tid 4804] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Tue Apr 21 15:37:27.152700 2026] [:error] [pid 4777:tid 4796] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-temp.php
[Tue Apr 21 15:37:27.426555 2026] [:error] [pid 4777:tid 4808] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Apr 21 15:37:27.848249 2026] [:error] [pid 4777:tid 4789] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Tue Apr 21 15:37:28.125391 2026] [:error] [pid 4777:tid 4807] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 15:37:28.402024 2026] [:error] [pid 4777:tid 4809] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Tue Apr 21 15:37:28.676120 2026] [:error] [pid 4777:tid 4796] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Tue Apr 21 15:37:29.267944 2026] [:error] [pid 4777:tid 4795] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/finami.php
[Tue Apr 21 15:37:29.557987 2026] [:error] [pid 4777:tid 4810] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/htto.php
[Tue Apr 21 15:37:29.837134 2026] [:error] [pid 4777:tid 4804] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Tue Apr 21 15:37:30.123666 2026] [:error] [pid 4777:tid 4797] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Tue Apr 21 15:37:30.410082 2026] [:error] [pid 4777:tid 4793] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Apr 21 15:37:30.693118 2026] [:error] [pid 4777:tid 4788] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Tue Apr 21 15:37:30.969373 2026] [:error] [pid 4777:tid 4789] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/8xyz.php
[Tue Apr 21 15:37:31.539876 2026] [:error] [pid 4777:tid 4798] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Apr 21 15:37:31.830727 2026] [:error] [pid 4777:tid 4797] [client 185.82.72.109:57867] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Tue Apr 21 15:37:32.105139 2026] [:error] [pid 4777:tid 4793] [client 185.82.72.109:57867] [client 185.82.72.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/execute.php"] [unique_id "aecpPKxXur6bykKyLZSHkgAAAQU"]
[Tue Apr 21 15:37:33.244188 2026] [:error] [pid 35321:tid 35405] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Tue Apr 21 15:37:33.527334 2026] [:error] [pid 35321:tid 35400] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/0xD.php
[Tue Apr 21 15:37:33.851133 2026] [:error] [pid 35321:tid 35400] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-upload.php
[Tue Apr 21 15:37:34.135830 2026] [:error] [pid 35321:tid 35399] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Tue Apr 21 15:37:34.423683 2026] [:error] [pid 35321:tid 35385] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aa.php
[Tue Apr 21 15:37:34.725068 2026] [:error] [pid 35321:tid 35385] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Tue Apr 21 15:37:35.004428 2026] [:error] [pid 35321:tid 35386] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Tue Apr 21 15:37:35.284788 2026] [:error] [pid 35321:tid 35393] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Apr 21 15:37:35.567418 2026] [:error] [pid 35321:tid 35393] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/src_api.php
[Tue Apr 21 15:37:36.525679 2026] [:error] [pid 35321:tid 35393] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/aves.php
[Tue Apr 21 15:37:37.125416 2026] [:error] [pid 35321:tid 35404] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Tue Apr 21 15:37:37.412165 2026] [:error] [pid 35321:tid 35402] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 21 15:37:37.695729 2026] [:error] [pid 35321:tid 35400] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Tue Apr 21 15:37:37.980810 2026] [:error] [pid 35321:tid 35387] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Tue Apr 21 15:37:38.560456 2026] [:error] [pid 35321:tid 35393] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Tue Apr 21 15:37:38.849655 2026] [:error] [pid 35321:tid 35399] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fclass.php
[Tue Apr 21 15:37:39.147610 2026] [:error] [pid 35321:tid 35396] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ccv.php
[Tue Apr 21 15:37:39.434336 2026] [:error] [pid 35321:tid 35396] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/xoot.php
[Tue Apr 21 15:37:39.734026 2026] [:error] [pid 35321:tid 35404] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/w-a.php
[Tue Apr 21 15:37:40.018592 2026] [:error] [pid 35321:tid 35397] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/toine.php
[Tue Apr 21 15:37:40.302800 2026] [:error] [pid 35321:tid 35397] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/fault.php
[Tue Apr 21 15:37:40.612488 2026] [:error] [pid 35321:tid 35398] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/x2x.php
[Tue Apr 21 15:37:40.910462 2026] [:error] [pid 35321:tid 35399] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/h02ugyh.php
[Tue Apr 21 15:37:41.196390 2026] [:error] [pid 35321:tid 35404] [client 45.86.200.225:54291] File does not exist: /usr/local/apache/htdocs/suspended-page/ftp.php
[Tue Apr 21 15:37:41.764497 2026] [:error] [pid 35321:tid 35405] [client 45.86.200.225:54291] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aecpRTeHLhVUuu8cVXys8gAAAFU"]
[Tue Apr 21 15:37:42.305481 2026] [:error] [pid 53731:tid 53738] [client 45.86.200.230:30241] [client 45.86.200.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aecpRl2I9THUR-bRVGzbcQAAAgM"]
[Tue Apr 21 15:37:43.146726 2026] [:error] [pid 4823:tid 4857] [client 185.82.72.102:37189] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aecpR_c8mke3PfHqsxG6ZwAAAYQ"]
[Tue Apr 21 15:37:43.701360 2026] [:error] [pid 35322:tid 35372] [client 45.86.200.244:33799] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aecpR6PoAfV40BTfVKzC8wAAAI8"]
[Tue Apr 21 15:37:51.717843 2026] [:error] [pid 35320:tid 35347] [client 45.86.200.229:45495] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aecpT4JW6fdXWO6agMEc5QAAABE"]
[Tue Apr 21 15:37:53.347852 2026] [:error] [pid 35320:tid 35335] [client 185.82.72.106:65075] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aecpUYJW6fdXWO6agMEdAwAAAAU"]
[Tue Apr 21 15:37:53.878680 2026] [:error] [pid 53832:tid 53850] [client 45.86.200.238:51853] [client 45.86.200.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aecpUdzkuxsE_OhM9UIYBwAAAk8"]
[Tue Apr 21 15:37:55.362888 2026] [:error] [pid 4823:tid 4876] [client 45.86.200.242:30413] [client 45.86.200.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aecpU_c8mke3PfHqsxG7CgAAAZc"]
[Tue Apr 21 15:37:57.017734 2026] [:error] [pid 35321:tid 35395] [client 45.86.200.234:50943] [client 45.86.200.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecpVTeHLhVUuu8cVXyuHAAAAEs"]
[Tue Apr 21 15:37:57.565520 2026] [:error] [pid 53731:tid 53748] [client 185.82.72.102:46503] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aecpVV2I9THUR-bRVGzb4AAAAg0"]
[Tue Apr 21 15:37:58.116376 2026] [:error] [pid 5377:tid 5388] [client 45.86.200.235:56659] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aecpVrBKychFlrHBdvvmLQAAAcI"]
[Tue Apr 21 15:37:58.650726 2026] [:error] [pid 5377:tid 5391] [client 45.86.200.232:43747] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aecpVrBKychFlrHBdvvmNQAAAcU"]
[Tue Apr 21 15:38:01.541945 2026] [:error] [pid 35320:tid 35351] [client 45.86.200.234:64429] [client 45.86.200.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aecpWYJW6fdXWO6agMEdTgAAABU"]
[Tue Apr 21 15:38:02.379471 2026] [:error] [pid 35322:tid 35368] [client 45.86.200.222:25605] [client 45.86.200.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.222, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aecpWqPoAfV40BTfVKzDuQAAAIs"]
[Tue Apr 21 15:38:03.241773 2026] [:error] [pid 35322:tid 35363] [client 45.86.200.222:25605] [client 45.86.200.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/class-config.php"] [unique_id "aecpW6PoAfV40BTfVKzDygAAAIY"]
[Tue Apr 21 15:38:05.907318 2026] [:error] [pid 35320:tid 35339] [client 45.86.200.248:30631] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aecpXYJW6fdXWO6agMEdZAAAAAk"]
[Tue Apr 21 15:38:07.579941 2026] [:error] [pid 35321:tid 35405] [client 45.86.200.250:33349] [client 45.86.200.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bak.php"] [unique_id "aecpXzeHLhVUuu8cVXyuuwAAAFU"]
[Tue Apr 21 15:38:08.112375 2026] [:error] [pid 53731:tid 53746] [client 45.86.200.239:45437] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aecpYF2I9THUR-bRVGzcVgAAAgs"]
[Tue Apr 21 15:38:09.217415 2026] [:error] [pid 35321:tid 35390] [client 45.86.200.236:42965] [client 45.86.200.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aecpYTeHLhVUuu8cVXyu1AAAAEY"]
[Tue Apr 21 15:38:28.698782 2026] [:error] [pid 53832:tid 53842] [client 45.86.200.222:44849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 21 16:42:08.374296 2026] [:error] [pid 53731:tid 53745] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Tue Apr 21 16:42:08.655626 2026] [:error] [pid 53731:tid 53738] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 21 16:42:08.897048 2026] [:error] [pid 53731:tid 53758] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Tue Apr 21 16:42:09.136715 2026] [:error] [pid 53731:tid 53753] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Tue Apr 21 16:42:09.392813 2026] [:error] [pid 53731:tid 53746] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Tue Apr 21 16:42:09.663813 2026] [:error] [pid 53731:tid 53736] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Tue Apr 21 16:42:10.367493 2026] [:error] [pid 53731:tid 53760] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 16:42:10.637639 2026] [:error] [pid 53731:tid 53739] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Tue Apr 21 16:42:10.877141 2026] [:error] [pid 53731:tid 53748] [client 20.216.164.137:56517] File does not exist: /usr/local/apache/htdocs/suspended-page/bkyac.php
[Tue Apr 21 16:42:11.113203 2026] [:error] [pid 53731:tid 53743] [client 20.216.164.137:56517] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec4Y12I9THUR-bRVGzougAAAgg"]
[Tue Apr 21 16:42:13.091438 2026] [:error] [pid 53832:tid 53837] [client 20.216.164.137:58126] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec4ZdzkuxsE_OhM9UI_0gAAAkI"]
[Tue Apr 21 16:42:15.577768 2026] [:error] [pid 35320:tid 35352] [client 20.216.164.137:56532] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec4Z4JW6fdXWO6agMFExQAAABY"]
[Tue Apr 21 16:42:17.526581 2026] [:error] [pid 4823:tid 4871] [client 20.216.164.137:33579] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec4afc8mke3PfHqsxHbqwAAAZI"]
[Tue Apr 21 16:42:20.445554 2026] [:error] [pid 35320:tid 35345] [client 20.216.164.137:7647] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec4bIJW6fdXWO6agMFE1AAAAA8"]
[Tue Apr 21 16:42:21.991871 2026] [:error] [pid 35415:tid 35443] [client 20.216.164.137:43053] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec4bUiqDinI4_22zzhf5AAAANA"]
[Tue Apr 21 16:42:24.513716 2026] [:error] [pid 4823:tid 4861] [client 20.216.164.137:43024] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec4cPc8mke3PfHqsxHbtQAAAYg"]
[Tue Apr 21 16:42:25.235808 2026] [:error] [pid 54080:tid 54100] [client 20.216.164.137:43044] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec4cYzEbQHHxtmWbaZ5dgAAAtI"]
[Tue Apr 21 16:42:37.279244 2026] [:error] [pid 54080:tid 54089] [client 20.216.164.137:7306] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec4fYzEbQHHxtmWbaZ5kAAAAsc"]
[Tue Apr 21 16:42:50.353875 2026] [:error] [pid 54080:tid 54096] [client 20.216.164.137:49273] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec4iozEbQHHxtmWbaZ5wgAAAs4"]
[Tue Apr 21 16:42:56.843691 2026] [:error] [pid 35320:tid 35341] [client 20.216.164.137:51100] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec4kIJW6fdXWO6agMFFLQAAAAs"]
[Tue Apr 21 16:43:02.044158 2026] [:error] [pid 4777:tid 4798] [client 20.216.164.137:35394] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec4lqxXur6bykKyLZSQvAAAAQo"]
[Tue Apr 21 16:43:04.174760 2026] [:error] [pid 35321:tid 35404] [client 20.216.164.137:38412] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec4mDeHLhVUuu8cVXzizwAAAFQ"]
[Tue Apr 21 16:43:06.408058 2026] [:error] [pid 35322:tid 35371] [client 20.216.164.137:56970] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec4mqPoAfV40BTfVKzLngAAAI4"]
[Tue Apr 21 16:43:10.634230 2026] [:error] [pid 35320:tid 35350] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 21 16:43:10.873050 2026] [:error] [pid 35320:tid 35339] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/ctex1.php
[Tue Apr 21 16:43:11.111368 2026] [:error] [pid 35320:tid 35338] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Tue Apr 21 16:43:11.349740 2026] [:error] [pid 35320:tid 35347] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Tue Apr 21 16:43:11.600762 2026] [:error] [pid 35320:tid 35344] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Apr 21 16:43:11.840569 2026] [:error] [pid 35320:tid 35352] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Tue Apr 21 16:43:12.079507 2026] [:error] [pid 35320:tid 35330] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Tue Apr 21 16:43:12.331018 2026] [:error] [pid 35320:tid 35343] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Tue Apr 21 16:43:12.571065 2026] [:error] [pid 35320:tid 35335] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 21 16:43:12.832611 2026] [:error] [pid 35320:tid 35331] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Apr 21 16:43:13.179763 2026] [:error] [pid 35320:tid 35331] [client 20.216.164.137:53858] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Tue Apr 21 16:43:13.817070 2026] [:error] [pid 35320:tid 35344] [client 20.216.164.137:53858] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aec4oYJW6fdXWO6agMFFWAAAAA4"]
[Tue Apr 21 16:43:17.048466 2026] [:error] [pid 54080:tid 54091] [client 20.216.164.137:59684] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aec4pYzEbQHHxtmWbaZ6DQAAAsk"]
[Tue Apr 21 16:43:18.947689 2026] [:error] [pid 54080:tid 54095] [client 20.216.164.137:36931] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aec4pozEbQHHxtmWbaZ6HAAAAs0"]
[Tue Apr 21 16:43:20.918481 2026] [:error] [pid 35320:tid 35334] [client 20.216.164.137:44164] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aec4qIJW6fdXWO6agMFFaAAAAAQ"]
[Tue Apr 21 16:43:22.216014 2026] [:error] [pid 53978:tid 53982] [client 20.216.164.137:53842] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec4qp1ivsR4hcOSQbbDQAAAAoI"]
[Tue Apr 21 16:43:24.132018 2026] [:error] [pid 35321:tid 35392] [client 20.216.164.137:36944] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec4rDeHLhVUuu8cVXzjIQAAAEg"]
[Tue Apr 21 16:43:25.329797 2026] [:error] [pid 53978:tid 54001] [client 20.216.164.137:51505] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec4rZ1ivsR4hcOSQbbDQwAAApU"]
[Tue Apr 21 16:43:26.454196 2026] [:error] [pid 54080:tid 54086] [client 20.216.164.137:53850] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec4rozEbQHHxtmWbaZ6UgAAAsQ"]
[Tue Apr 21 16:43:29.765751 2026] [:error] [pid 4823:tid 4856] [client 20.216.164.137:36939] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec4sfc8mke3PfHqsxHcAQAAAYM"]
[Tue Apr 21 16:43:33.569459 2026] [:error] [pid 35321:tid 35400] [client 20.216.164.137:44162] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec4tTeHLhVUuu8cVXzjeAAAAFA"]
[Tue Apr 21 16:43:35.406185 2026] [:error] [pid 53731:tid 53754] [client 20.216.164.137:34230] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec4t12I9THUR-bRVGzpCQAAAhI"]
[Tue Apr 21 16:43:41.292814 2026] [:error] [pid 53731:tid 53756] [client 20.216.164.137:43093] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec4vV2I9THUR-bRVGzpPAAAAhQ"]
[Tue Apr 21 16:43:49.556512 2026] [:error] [pid 53731:tid 53738] [client 20.216.164.137:29630] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec4xV2I9THUR-bRVGzpdAAAAgM"]
[Tue Apr 21 16:43:54.661932 2026] [:error] [pid 35321:tid 35388] [client 20.216.164.137:50355] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec4yjeHLhVUuu8cVXzjwgAAAEQ"]
[Tue Apr 21 16:43:59.514615 2026] [:error] [pid 53978:tid 54003] [client 20.216.164.137:7290] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec4z51ivsR4hcOSQbbDvAAAApc"]
[Tue Apr 21 16:44:01.968133 2026] [:error] [pid 53978:tid 54004] [client 20.216.164.137:34672] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec40Z1ivsR4hcOSQbbDwAAAApg"]
[Tue Apr 21 16:44:03.222285 2026] [:error] [pid 53832:tid 53851] [client 20.216.164.137:54616] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec409zkuxsE_OhM9UJAOwAAAlA"]
[Tue Apr 21 16:44:06.256420 2026] [:error] [pid 4777:tid 4792] [client 20.216.164.137:54618] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec41qxXur6bykKyLZSRGAAAAQQ"]
[Tue Apr 21 16:44:09.540638 2026] [:error] [pid 53978:tid 54004] [client 20.216.164.137:48044] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "aec42Z1ivsR4hcOSQbbD0AAAApg"]
[Tue Apr 21 16:44:11.640074 2026] [:error] [pid 53978:tid 54002] [client 20.216.164.137:48063] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "aec4251ivsR4hcOSQbbD2gAAApY"]
[Tue Apr 21 16:44:16.573880 2026] [:error] [pid 53978:tid 53983] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Tue Apr 21 16:44:16.840285 2026] [:error] [pid 53978:tid 53993] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 16:44:17.101159 2026] [:error] [pid 53978:tid 53995] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 21 16:44:17.377631 2026] [:error] [pid 53978:tid 53991] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/amwxl.php
[Tue Apr 21 16:44:17.639095 2026] [:error] [pid 53978:tid 53985] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Tue Apr 21 16:44:18.082641 2026] [:error] [pid 53978:tid 53985] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php
[Tue Apr 21 16:44:18.357769 2026] [:error] [pid 53978:tid 53995] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Tue Apr 21 16:44:18.637251 2026] [:error] [pid 53978:tid 54001] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 16:44:18.929817 2026] [:error] [pid 53978:tid 53992] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Tue Apr 21 16:44:20.930509 2026] [:error] [pid 53978:tid 53992] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Tue Apr 21 16:44:21.203069 2026] [:error] [pid 53978:tid 54001] [client 20.216.164.137:60080] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Apr 21 16:44:21.460693 2026] [:error] [pid 53978:tid 53989] [client 20.216.164.137:60080] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aec45Z1ivsR4hcOSQbbEEwAAAok"]
[Tue Apr 21 16:44:24.437126 2026] [:error] [pid 35320:tid 35346] [client 20.216.164.137:40453] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aec46IJW6fdXWO6agMFGEgAAABA"]
[Tue Apr 21 16:44:25.254542 2026] [:error] [pid 54080:tid 54085] [client 20.216.164.137:33170] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aec46YzEbQHHxtmWbaZ61wAAAsM"]
[Tue Apr 21 16:44:26.461471 2026] [:error] [pid 53731:tid 53753] [client 20.216.164.137:38884] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aec46l2I9THUR-bRVGzqNgAAAhE"]
[Tue Apr 21 16:44:28.140268 2026] [:error] [pid 53832:tid 53847] [client 20.216.164.137:50401] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec47NzkuxsE_OhM9UJAQwAAAkw"]
[Tue Apr 21 16:44:30.604013 2026] [:error] [pid 53731:tid 53745] [client 20.216.164.137:45657] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec47l2I9THUR-bRVGzqQwAAAgo"]
[Tue Apr 21 16:44:33.984575 2026] [:error] [pid 53978:tid 53999] [client 20.216.164.137:29235] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec48Z1ivsR4hcOSQbbEQgAAApM"]
[Tue Apr 21 16:44:36.455327 2026] [:error] [pid 53978:tid 54000] [client 20.216.164.137:29212] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec49J1ivsR4hcOSQbbEWwAAApQ"]
[Tue Apr 21 16:44:40.417092 2026] [:error] [pid 53731:tid 53739] [client 20.216.164.137:47462] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aec4-F2I9THUR-bRVGzqVwAAAgQ"]
[Tue Apr 21 16:44:42.259069 2026] [:error] [pid 53731:tid 53750] [client 20.216.164.137:33608] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aec4-l2I9THUR-bRVGzqaQAAAg8"]
[Tue Apr 21 16:44:42.828315 2026] [:error] [pid 35321:tid 35402] [client 20.216.164.137:58984] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aec4-jeHLhVUuu8cVXzkEAAAAFI"]
[Tue Apr 21 16:44:46.621298 2026] [:error] [pid 4777:tid 4805] [client 20.216.164.137:37314] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aec4_qxXur6bykKyLZSRJwAAARE"]
[Tue Apr 21 16:44:48.902479 2026] [:error] [pid 35321:tid 35395] [client 20.216.164.137:45675] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec5ADeHLhVUuu8cVXzkIAAAAEs"]
[Tue Apr 21 16:44:49.780907 2026] [:error] [pid 35320:tid 35347] [client 20.216.164.137:55830] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec5AYJW6fdXWO6agMFGJQAAABE"]
[Tue Apr 21 16:44:51.268642 2026] [:error] [pid 35320:tid 35335] [client 20.216.164.137:58946] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec5A4JW6fdXWO6agMFGKgAAAAU"]
[Tue Apr 21 16:44:54.043631 2026] [:error] [pid 53832:tid 53837] [client 20.216.164.137:7586] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec5BtzkuxsE_OhM9UJAVwAAAkI"]
[Tue Apr 21 16:44:55.863552 2026] [:error] [pid 35320:tid 35349] [client 20.216.164.137:29679] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aec5B4JW6fdXWO6agMFGPAAAABM"]
[Tue Apr 21 16:44:57.330071 2026] [:error] [pid 54080:tid 54097] [client 20.216.164.137:47425] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aec5CYzEbQHHxtmWbaZ69wAAAs8"]
[Tue Apr 21 16:44:59.891282 2026] [:error] [pid 53832:tid 53848] [client 20.216.164.137:33246] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aec5C9zkuxsE_OhM9UJAYwAAAk0"]
[Tue Apr 21 16:45:02.235001 2026] [:error] [pid 53731:tid 53750] [client 20.216.164.137:47426] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aec5Dl2I9THUR-bRVGzqeQAAAg8"]
[Tue Apr 21 16:45:03.580341 2026] [:error] [pid 53978:tid 53987] [client 20.216.164.137:58979] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "aec5D51ivsR4hcOSQbbEdgAAAoc"]
[Tue Apr 21 16:45:05.895432 2026] [:error] [pid 4777:tid 4809] [client 20.216.164.137:57643] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "aec5EaxXur6bykKyLZSRLwAAARU"]
[Tue Apr 21 16:45:06.830196 2026] [:error] [pid 35321:tid 35402] [client 20.216.164.137:47436] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "aec5EjeHLhVUuu8cVXzkLQAAAFI"]
[Tue Apr 21 16:45:09.241959 2026] [:error] [pid 53731:tid 53758] [client 20.216.164.137:57639] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless.php"] [unique_id "aec5FV2I9THUR-bRVGzqnAAAAhY"]
[Tue Apr 21 16:45:10.991905 2026] [:error] [pid 54080:tid 54100] [client 20.216.164.137:36451] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "aec5FozEbQHHxtmWbaZ7BgAAAtI"]
[Tue Apr 21 16:45:14.036356 2026] [:error] [pid 35321:tid 35396] [client 20.216.164.137:58177] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "aec5GjeHLhVUuu8cVXzkMAAAAEw"]
[Tue Apr 21 16:45:18.204934 2026] [:error] [pid 53731:tid 53758] [client 20.216.164.137:47477] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "aec5Hl2I9THUR-bRVGzqpQAAAhY"]
[Tue Apr 21 16:45:20.004797 2026] [:error] [pid 35321:tid 35384] [client 74.248.20.244:43244] [client 74.248.20.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aec5IDeHLhVUuu8cVXzkQwAAAEA"]
[Tue Apr 21 16:45:20.834499 2026] [:error] [pid 4823:tid 4854] [client 20.216.164.137:55852] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/albin.php"] [unique_id "aec5IPc8mke3PfHqsxHcTgAAAYE"]
[Tue Apr 21 16:45:23.474560 2026] [:error] [pid 53978:tid 53982] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Tue Apr 21 16:45:24.002019 2026] [:error] [pid 53978:tid 54002] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Tue Apr 21 16:45:24.297553 2026] [:error] [pid 53978:tid 53997] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Tue Apr 21 16:45:24.560672 2026] [:error] [pid 53978:tid 53992] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue Apr 21 16:45:24.822020 2026] [:error] [pid 53978:tid 53986] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Tue Apr 21 16:45:25.083269 2026] [:error] [pid 53978:tid 54000] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Tue Apr 21 16:45:25.294019 2026] [:error] [pid 53978:tid 54002] [client 74.248.20.244:43187] [client 74.248.20.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aec5JZ1ivsR4hcOSQbbE4AAAApY"]
[Tue Apr 21 16:45:25.528569 2026] [:error] [pid 53978:tid 53995] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Tue Apr 21 16:45:25.800368 2026] [:error] [pid 53978:tid 53990] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Apr 21 16:45:26.073830 2026] [:error] [pid 53978:tid 54001] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Apr 21 16:45:27.101622 2026] [:error] [pid 53978:tid 53993] [client 20.216.164.137:35870] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Tue Apr 21 16:45:27.359580 2026] [:error] [pid 53978:tid 53981] [client 20.216.164.137:35870] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec5J51ivsR4hcOSQbbE8AAAAoE"]
[Tue Apr 21 16:45:27.865130 2026] [:error] [pid 4777:tid 4804] [client 74.248.20.244:43179] [client 74.248.20.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aec5J6xXur6bykKyLZSRQgAAARA"]
[Tue Apr 21 16:45:29.258448 2026] [:error] [pid 54080:tid 54084] [client 20.216.164.137:55881] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec5KYzEbQHHxtmWbaZ7DAAAAsI"]
[Tue Apr 21 16:45:29.935189 2026] [:error] [pid 53731:tid 53752] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Tue Apr 21 16:45:30.224655 2026] [:error] [pid 53731:tid 53740] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 21 16:45:30.488641 2026] [:error] [pid 53731:tid 53758] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Tue Apr 21 16:45:30.766887 2026] [:error] [pid 53731:tid 53742] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Tue Apr 21 16:45:31.051613 2026] [:error] [pid 53731:tid 53746] [client 74.248.20.244:39297] [client 74.248.20.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aec5K12I9THUR-bRVGzqtwAAAgs"]
[Tue Apr 21 16:45:31.084744 2026] [:error] [pid 53731:tid 53748] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Tue Apr 21 16:45:31.354847 2026] [:error] [pid 53731:tid 53738] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Tue Apr 21 16:45:31.923254 2026] [:error] [pid 53731:tid 53740] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 16:45:32.212746 2026] [:error] [pid 53731:tid 53759] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Tue Apr 21 16:45:32.477815 2026] [:error] [pid 53731:tid 53758] [client 20.251.37.211:50432] File does not exist: /usr/local/apache/htdocs/suspended-page/bkyac.php
[Tue Apr 21 16:45:32.749862 2026] [:error] [pid 53731:tid 53756] [client 20.251.37.211:50432] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec5LF2I9THUR-bRVGzqxgAAAhQ"]
[Tue Apr 21 16:45:33.982569 2026] [:error] [pid 35321:tid 35390] [client 20.216.164.137:48097] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec5LTeHLhVUuu8cVXzkVQAAAEY"]
[Tue Apr 21 16:45:36.966908 2026] [:error] [pid 35415:tid 35434] [client 20.216.164.137:36451] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec5MEiqDinI4_22zzhgKQAAAMc"]
[Tue Apr 21 16:45:38.517594 2026] [:error] [pid 35320:tid 35334] [client 20.216.164.137:7445] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec5MoJW6fdXWO6agMFGaAAAAAQ"]
[Tue Apr 21 16:45:39.407441 2026] [:error] [pid 35322:tid 35374] [client 20.251.37.211:38370] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec5M6PoAfV40BTfVKzL_gAAAJE"]
[Tue Apr 21 16:45:41.022252 2026] [:error] [pid 53832:tid 53840] [client 20.216.164.137:54651] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec5NdzkuxsE_OhM9UJAeQAAAkU"]
[Tue Apr 21 16:45:43.357290 2026] [:error] [pid 54080:tid 54102] [client 20.216.164.137:29617] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec5N4zEbQHHxtmWbaZ7FgAAAtQ"]
[Tue Apr 21 16:45:44.233748 2026] [:error] [pid 53731:tid 53760] [client 20.251.37.211:51228] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec5OF2I9THUR-bRVGzqzAAAAhg"]
[Tue Apr 21 16:45:46.944584 2026] [:error] [pid 53731:tid 53735] [client 20.251.37.211:44840] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec5Ol2I9THUR-bRVGzq0QAAAgA"]
[Tue Apr 21 16:45:48.309403 2026] [:error] [pid 53731:tid 53749] [client 20.216.164.137:53878] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec5PF2I9THUR-bRVGzq3wAAAg4"]
[Tue Apr 21 16:45:49.143845 2026] [:error] [pid 53731:tid 53757] [client 20.251.37.211:58634] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec5PV2I9THUR-bRVGzq5gAAAhU"]
[Tue Apr 21 16:45:50.212139 2026] [:error] [pid 53731:tid 53757] [client 20.216.164.137:28386] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acc.php"] [unique_id "aec5Pl2I9THUR-bRVGzq8AAAAhU"]
[Tue Apr 21 16:45:51.321340 2026] [:error] [pid 35322:tid 35376] [client 20.251.37.211:8955] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec5P6PoAfV40BTfVKzMBAAAAJM"]
[Tue Apr 21 16:45:52.061928 2026] [:error] [pid 4777:tid 4791] [client 20.216.164.137:57668] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acc.php"] [unique_id "aec5QKxXur6bykKyLZSRSwAAAQM"]
[Tue Apr 21 16:45:53.518664 2026] [:error] [pid 35320:tid 35333] [client 20.251.37.211:59753] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec5QYJW6fdXWO6agMFGdAAAAAM"]
[Tue Apr 21 16:45:55.259490 2026] [:error] [pid 53731:tid 53747] [client 20.251.37.211:50928] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec5Q12I9THUR-bRVGzq-gAAAgw"]
[Tue Apr 21 16:45:55.389036 2026] [:error] [pid 53731:tid 53737] [client 20.216.164.137:30912] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acc.php"] [unique_id "aec5Q12I9THUR-bRVGzq_QAAAgI"]
[Tue Apr 21 16:45:57.753465 2026] [:error] [pid 4823:tid 4870] [client 20.251.37.211:52799] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec5Rfc8mke3PfHqsxHcaQAAAZE"]
[Tue Apr 21 16:46:00.350946 2026] [:error] [pid 35320:tid 35344] [client 20.251.37.211:47485] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec5SIJW6fdXWO6agMFGewAAAA4"]
[Tue Apr 21 16:46:01.776253 2026] [:error] [pid 4823:tid 4872] [client 20.251.37.211:44380] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec5Sfc8mke3PfHqsxHcdQAAAZM"]
[Tue Apr 21 16:46:02.570742 2026] [:error] [pid 35415:tid 35437] [client 20.216.164.137:30914] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acc.php"] [unique_id "aec5SkiqDinI4_22zzhgMgAAAMo"]
[Tue Apr 21 16:46:05.336279 2026] [:error] [pid 53731:tid 53745] [client 20.251.37.211:47456] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec5TV2I9THUR-bRVGzrEgAAAgo"]
[Tue Apr 21 16:46:06.415003 2026] [:error] [pid 53832:tid 53857] [client 20.216.164.137:31790] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "aec5TtzkuxsE_OhM9UJAjgAAAlY"]
[Tue Apr 21 16:46:08.105733 2026] [:error] [pid 53731:tid 53746] [client 20.216.164.137:55177] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "aec5UF2I9THUR-bRVGzrFAAAAgs"]
[Tue Apr 21 16:46:09.462653 2026] [:error] [pid 53731:tid 53753] [client 20.251.37.211:59759] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec5UV2I9THUR-bRVGzrGAAAAhE"]
[Tue Apr 21 16:46:11.461824 2026] [:error] [pid 53731:tid 53748] [client 20.216.164.137:28398] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "aec5U12I9THUR-bRVGzrIgAAAg0"]
[Tue Apr 21 16:46:12.568876 2026] [:error] [pid 35320:tid 35353] [client 20.251.37.211:52737] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec5VIJW6fdXWO6agMFGiAAAABc"]
[Tue Apr 21 16:46:13.661038 2026] [:error] [pid 53978:tid 53981] [client 20.216.164.137:31780] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "aec5VZ1ivsR4hcOSQbbFSgAAAoE"]
[Tue Apr 21 16:46:15.676359 2026] [:error] [pid 54080:tid 54085] [client 20.251.37.211:53286] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec5V4zEbQHHxtmWbaZ7MAAAAsM"]
[Tue Apr 21 16:46:17.533124 2026] [:error] [pid 35321:tid 35391] [client 20.216.164.137:7921] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "aec5WTeHLhVUuu8cVXzkmgAAAEc"]
[Tue Apr 21 16:46:17.806925 2026] [:error] [pid 35321:tid 35395] [client 20.251.37.211:59713] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec5WTeHLhVUuu8cVXzknQAAAEs"]
[Tue Apr 21 16:46:20.297003 2026] [:error] [pid 53978:tid 53992] [client 20.251.37.211:47092] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec5XJ1ivsR4hcOSQbbFWwAAAow"]
[Tue Apr 21 16:46:20.706966 2026] [:error] [pid 4777:tid 4807] [client 20.216.164.137:53942] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "aec5XKxXur6bykKyLZSRWAAAARM"]
[Tue Apr 21 16:46:22.014921 2026] [:error] [pid 35321:tid 35395] [client 20.216.164.137:61634] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "aec5XjeHLhVUuu8cVXzkqgAAAEs"]
[Tue Apr 21 16:46:22.850970 2026] [:error] [pid 53731:tid 53738] [client 20.251.37.211:42156] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec5Xl2I9THUR-bRVGzrRAAAAgM"]
[Tue Apr 21 16:46:23.933250 2026] [:error] [pid 53731:tid 53736] [client 20.251.37.211:58008] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec5X12I9THUR-bRVGzrSQAAAgE"]
[Tue Apr 21 16:46:24.706273 2026] [:error] [pid 35320:tid 35349] [client 20.216.164.137:38518] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "aec5YIJW6fdXWO6agMFGlwAAABM"]
[Tue Apr 21 16:46:24.776780 2026] [:error] [pid 53978:tid 54000] [client 20.251.37.211:65485] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec5YJ1ivsR4hcOSQbbFYAAAApQ"]
[Tue Apr 21 16:46:26.857924 2026] [:error] [pid 4823:tid 4854] [client 20.251.37.211:48908] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aec5Yvc8mke3PfHqsxHchQAAAYE"]
[Tue Apr 21 16:46:26.885991 2026] [:error] [pid 53832:tid 53851] [client 20.216.164.137:61669] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/packsin1.php"] [unique_id "aec5YtzkuxsE_OhM9UJAogAAAlA"]
[Tue Apr 21 16:46:28.487586 2026] [:error] [pid 35415:tid 35445] [client 20.251.37.211:48922] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aec5ZEiqDinI4_22zzhgOQAAANI"]
[Tue Apr 21 16:46:30.095470 2026] [:error] [pid 53731:tid 53755] [client 20.251.37.211:8984] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aec5Zl2I9THUR-bRVGzrUQAAAhM"]
[Tue Apr 21 16:46:30.778953 2026] [:error] [pid 4777:tid 4800] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Tue Apr 21 16:46:31.040742 2026] [:error] [pid 4777:tid 4793] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Tue Apr 21 16:46:31.319293 2026] [:error] [pid 4777:tid 4789] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Tue Apr 21 16:46:31.580370 2026] [:error] [pid 4777:tid 4805] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Tue Apr 21 16:46:31.846041 2026] [:error] [pid 4777:tid 4809] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Apr 21 16:46:32.118333 2026] [:error] [pid 4777:tid 4788] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Tue Apr 21 16:46:32.380767 2026] [:error] [pid 4777:tid 4790] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Apr 21 16:46:32.503376 2026] [:error] [pid 53731:tid 53756] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/ctex1.php
[Tue Apr 21 16:46:32.680711 2026] [:error] [pid 4777:tid 4812] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Tue Apr 21 16:46:32.775607 2026] [:error] [pid 53731:tid 53752] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Tue Apr 21 16:46:32.942550 2026] [:error] [pid 4777:tid 4795] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Tue Apr 21 16:46:33.038667 2026] [:error] [pid 53731:tid 53760] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Tue Apr 21 16:46:33.301843 2026] [:error] [pid 53731:tid 53739] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Apr 21 16:46:33.564636 2026] [:error] [pid 53731:tid 53757] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Tue Apr 21 16:46:33.586048 2026] [:error] [pid 4777:tid 4806] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Tue Apr 21 16:46:33.840582 2026] [:error] [pid 53731:tid 53759] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Tue Apr 21 16:46:33.864264 2026] [:error] [pid 4777:tid 4811] [client 20.216.164.137:28393] File does not exist: /usr/local/apache/htdocs/suspended-page/prosellers8.php
[Tue Apr 21 16:46:34.107578 2026] [:error] [pid 53731:tid 53745] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Tue Apr 21 16:46:34.121830 2026] [:error] [pid 4777:tid 4799] [client 20.216.164.137:28393] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec5aqxXur6bykKyLZSRaQAAAQs"]
[Tue Apr 21 16:46:34.393886 2026] [:error] [pid 53731:tid 53737] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 21 16:46:34.657310 2026] [:error] [pid 53731:tid 53746] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Apr 21 16:46:34.925169 2026] [:error] [pid 53731:tid 53741] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Tue Apr 21 16:46:35.197677 2026] [:error] [pid 53731:tid 53747] [client 20.251.37.211:57982] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Tue Apr 21 16:46:35.472298 2026] [:error] [pid 53731:tid 53750] [client 20.251.37.211:57982] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec5a12I9THUR-bRVGzrZQAAAg8"]
[Tue Apr 21 16:46:38.078323 2026] [:error] [pid 54080:tid 54097] [client 20.216.164.137:28354] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec5bozEbQHHxtmWbaZ7QAAAAs8"]
[Tue Apr 21 16:46:40.000829 2026] [:error] [pid 53978:tid 53983] [client 20.251.37.211:46045] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec5b51ivsR4hcOSQbbFiAAAAoM"]
[Tue Apr 21 16:46:41.128139 2026] [:error] [pid 53731:tid 53740] [client 20.216.164.137:38522] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec5cV2I9THUR-bRVGzrcQAAAgU"]
[Tue Apr 21 16:46:41.286865 2026] [:error] [pid 53731:tid 53752] [client 20.251.37.211:42676] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec5cV2I9THUR-bRVGzrcwAAAhA"]
[Tue Apr 21 16:46:43.308998 2026] [:error] [pid 35320:tid 35338] [client 20.251.37.211:8986] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec5c4JW6fdXWO6agMFGsAAAAAg"]
[Tue Apr 21 16:46:45.181412 2026] [:error] [pid 35321:tid 35386] [client 20.216.164.137:30975] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec5dTeHLhVUuu8cVXzk3gAAAEI"]
[Tue Apr 21 16:46:48.183882 2026] [:error] [pid 4777:tid 4791] [client 20.216.164.137:7714] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec5eKxXur6bykKyLZSRcQAAAQM"]
[Tue Apr 21 16:46:49.203946 2026] [:error] [pid 53731:tid 53738] [client 20.251.37.211:53825] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec5eV2I9THUR-bRVGzrhAAAAgM"]
[Tue Apr 21 16:46:50.328098 2026] [:error] [pid 53731:tid 53749] [client 20.216.164.137:29266] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec5el2I9THUR-bRVGzrhwAAAg4"]
[Tue Apr 21 16:46:52.625160 2026] [:error] [pid 53978:tid 53989] [client 20.216.164.137:7658] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec5fJ1ivsR4hcOSQbbFowAAAok"]
[Tue Apr 21 16:46:54.347183 2026] [:error] [pid 53978:tid 54001] [client 20.216.164.137:49712] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec5fp1ivsR4hcOSQbbFqgAAApU"]
[Tue Apr 21 16:46:54.388498 2026] [:error] [pid 53978:tid 53999] [client 20.251.37.211:57939] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec5fp1ivsR4hcOSQbbFqwAAApM"]
[Tue Apr 21 16:46:59.766845 2026] [:error] [pid 53731:tid 53754] [client 20.216.164.137:49184] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fsjzs.php"] [unique_id "aec5g12I9THUR-bRVGzrjAAAAhI"]
[Tue Apr 21 16:47:03.221186 2026] [:error] [pid 53832:tid 53849] [client 20.216.164.137:42691] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fsjzs.php"] [unique_id "aec5h9zkuxsE_OhM9UJArQAAAk4"]
[Tue Apr 21 16:47:03.787326 2026] [:error] [pid 4777:tid 4808] [client 20.251.37.211:45580] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec5h6xXur6bykKyLZSRfQAAARQ"]
[Tue Apr 21 16:47:06.997458 2026] [:error] [pid 53832:tid 53854] [client 20.216.164.137:35372] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fsjzs.php"] [unique_id "aec5itzkuxsE_OhM9UJAtQAAAlM"]
[Tue Apr 21 16:47:07.206179 2026] [:error] [pid 53832:tid 53845] [client 20.251.37.211:50113] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec5i9zkuxsE_OhM9UJAtwAAAko"]
[Tue Apr 21 16:47:08.620125 2026] [:error] [pid 54080:tid 54083] [client 20.216.164.137:40533] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fsjzs.php"] [unique_id "aec5jIzEbQHHxtmWbaZ7WQAAAsE"]
[Tue Apr 21 16:47:10.475549 2026] [:error] [pid 53978:tid 53992] [client 20.251.37.211:52094] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec5jp1ivsR4hcOSQbbFvwAAAow"]
[Tue Apr 21 16:47:10.891514 2026] [:error] [pid 35321:tid 35408] [client 20.216.164.137:61021] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cwclass.php"] [unique_id "aec5jjeHLhVUuu8cVXzlBgAAAFg"]
[Tue Apr 21 16:47:13.699365 2026] [:error] [pid 4823:tid 4854] [client 20.216.164.137:43027] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cwclass.php"] [unique_id "aec5kfc8mke3PfHqsxHcmwAAAYE"]
[Tue Apr 21 16:47:14.802965 2026] [:error] [pid 35321:tid 35388] [client 20.251.37.211:46639] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec5kjeHLhVUuu8cVXzlEQAAAEQ"]
[Tue Apr 21 16:47:16.468331 2026] [:error] [pid 54080:tid 54085] [client 20.216.164.137:60999] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cwclass.php"] [unique_id "aec5lIzEbQHHxtmWbaZ7YQAAAsM"]
[Tue Apr 21 16:47:18.695494 2026] [:error] [pid 53832:tid 53858] [client 20.216.164.137:8074] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cwclass.php"] [unique_id "aec5ltzkuxsE_OhM9UJAywAAAlc"]
[Tue Apr 21 16:47:18.748953 2026] [:error] [pid 35320:tid 35347] [client 20.251.37.211:36471] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec5loJW6fdXWO6agMFG2wAAABE"]
[Tue Apr 21 16:47:20.767296 2026] [:error] [pid 53978:tid 53986] [client 20.216.164.137:46278] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit-tags.php"] [unique_id "aec5mJ1ivsR4hcOSQbbF2QAAAoY"]
[Tue Apr 21 16:47:21.784578 2026] [:error] [pid 53832:tid 53835] [client 20.251.37.211:8325] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec5mdzkuxsE_OhM9UJAzAAAAkA"]
[Tue Apr 21 16:47:22.694845 2026] [:error] [pid 53832:tid 53842] [client 20.216.164.137:43008] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit-tags.php"] [unique_id "aec5mtzkuxsE_OhM9UJAzQAAAkc"]
[Tue Apr 21 16:47:24.643822 2026] [:error] [pid 54080:tid 54082] [client 20.216.164.137:8101] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit-tags.php"] [unique_id "aec5nIzEbQHHxtmWbaZ7bAAAAsA"]
[Tue Apr 21 16:47:26.793277 2026] [:error] [pid 35322:tid 35363] [client 20.216.164.137:49198] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit-tags.php"] [unique_id "aec5nqPoAfV40BTfVKzMIQAAAIY"]
[Tue Apr 21 16:47:27.712735 2026] [:error] [pid 53978:tid 53999] [client 20.251.37.211:56023] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec5n51ivsR4hcOSQbbF4AAAApM"]
[Tue Apr 21 16:47:28.644527 2026] [:error] [pid 53731:tid 53740] [client 20.251.37.211:35940] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec5oF2I9THUR-bRVGzrtQAAAgU"]
[Tue Apr 21 16:47:29.772696 2026] [:error] [pid 53832:tid 53854] [client 20.216.164.137:42725] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "aec5odzkuxsE_OhM9UJA2AAAAlM"]
[Tue Apr 21 16:47:30.987504 2026] [:error] [pid 35320:tid 35331] [client 20.251.37.211:51814] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "aec5ooJW6fdXWO6agMFG9QAAAAE"]
[Tue Apr 21 16:47:32.287185 2026] [:error] [pid 35320:tid 35354] [client 20.216.164.137:48651] [client 20.216.164.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "aec5pIJW6fdXWO6agMFG_gAAABg"]
[Tue Apr 21 16:47:34.396979 2026] [:error] [pid 4823:tid 4857] [client 20.216.164.137:59700] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 21 16:47:34.690713 2026] [:error] [pid 4823:tid 4877] [client 20.216.164.137:59700] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Tue Apr 21 16:47:34.953367 2026] [:error] [pid 4823:tid 4875] [client 20.216.164.137:59700] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Apr 21 16:47:35.215161 2026] [:error] [pid 4823:tid 4860] [client 20.216.164.137:59700] File does not exist: /usr/local/apache/htdocs/suspended-page/ai.php
[Tue Apr 21 16:47:35.476587 2026] [:error] [pid 4823:tid 4859] [client 20.216.164.137:59700] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Apr 21 16:47:36.500917 2026] [:error] [pid 35415:tid 35434] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Tue Apr 21 16:47:36.767165 2026] [:error] [pid 35415:tid 35428] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 16:47:37.030983 2026] [:error] [pid 35415:tid 35442] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 21 16:47:37.294805 2026] [:error] [pid 35415:tid 35440] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/amwxl.php
[Tue Apr 21 16:47:38.958801 2026] [:error] [pid 35415:tid 35440] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Tue Apr 21 16:47:39.240610 2026] [:error] [pid 35415:tid 35443] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php
[Tue Apr 21 16:47:39.527250 2026] [:error] [pid 35415:tid 35447] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Tue Apr 21 16:47:39.791175 2026] [:error] [pid 35415:tid 35433] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 16:47:40.067561 2026] [:error] [pid 35415:tid 35445] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Tue Apr 21 16:47:40.334249 2026] [:error] [pid 35415:tid 35439] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Tue Apr 21 16:47:40.596996 2026] [:error] [pid 35415:tid 35446] [client 20.251.37.211:51447] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Apr 21 16:47:40.856170 2026] [:error] [pid 35415:tid 35438] [client 20.251.37.211:51447] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aec5rEiqDinI4_22zzhgVwAAAMs"]
[Tue Apr 21 16:47:44.966676 2026] [:error] [pid 53731:tid 53754] [client 20.251.37.211:9069] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aec5sF2I9THUR-bRVGzr0AAAAhI"]
[Tue Apr 21 16:47:47.862177 2026] [:error] [pid 53832:tid 53856] [client 20.251.37.211:8369] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aec5s9zkuxsE_OhM9UJA5gAAAlU"]
[Tue Apr 21 16:47:48.870068 2026] [:error] [pid 53978:tid 54000] [client 20.251.37.211:35911] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aec5tJ1ivsR4hcOSQbbGAAAAApQ"]
[Tue Apr 21 16:47:50.747754 2026] [:error] [pid 53731:tid 53748] [client 20.251.37.211:54335] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec5tl2I9THUR-bRVGzr1QAAAg0"]
[Tue Apr 21 16:47:53.120826 2026] [:error] [pid 35321:tid 35405] [client 20.251.37.211:63977] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec5uTeHLhVUuu8cVXzlhwAAAFU"]
[Tue Apr 21 16:47:55.736387 2026] [:error] [pid 53978:tid 53985] [client 20.251.37.211:55031] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec5u51ivsR4hcOSQbbGDAAAAoU"]
[Tue Apr 21 16:47:58.433534 2026] [:error] [pid 53978:tid 53989] [client 20.251.37.211:43669] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec5vp1ivsR4hcOSQbbGFwAAAok"]
[Tue Apr 21 16:48:04.188201 2026] [:error] [pid 53731:tid 53742] [client 20.251.37.211:35935] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aec5xF2I9THUR-bRVGzr5QAAAgc"]
[Tue Apr 21 16:48:09.449646 2026] [:error] [pid 35320:tid 35352] [client 20.251.37.211:44012] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aec5yYJW6fdXWO6agMFHFwAAABY"]
[Tue Apr 21 16:48:12.936801 2026] [:error] [pid 53731:tid 53747] [client 20.251.37.211:65463] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "aec5zF2I9THUR-bRVGzr-QAAAgw"]
[Tue Apr 21 16:48:15.694441 2026] [:error] [pid 53731:tid 53759] [client 20.251.37.211:35925] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec5z12I9THUR-bRVGzsBgAAAhc"]
[Tue Apr 21 16:48:18.080065 2026] [:error] [pid 54080:tid 54082] [client 20.251.37.211:43977] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec50ozEbQHHxtmWbaZ7kQAAAsA"]
[Tue Apr 21 16:48:21.650041 2026] [:error] [pid 53731:tid 53741] [client 20.251.37.211:36431] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec51V2I9THUR-bRVGzsFAAAAgY"]
[Tue Apr 21 16:48:26.278874 2026] [:error] [pid 53978:tid 53989] [client 20.251.37.211:48045] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec52p1ivsR4hcOSQbbGTQAAAok"]
[Tue Apr 21 16:48:34.180126 2026] [:error] [pid 53731:tid 53757] [client 20.251.37.211:42654] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aec54l2I9THUR-bRVGzsQQAAAhU"]
[Tue Apr 21 16:48:36.339732 2026] [:error] [pid 35320:tid 35350] [client 20.251.37.211:36929] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aec55IJW6fdXWO6agMFHJgAAABQ"]
[Tue Apr 21 16:48:39.227430 2026] [:error] [pid 53731:tid 53746] [client 20.251.37.211:50477] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "aec5512I9THUR-bRVGzsUgAAAgs"]
[Tue Apr 21 16:48:45.018345 2026] [:error] [pid 53731:tid 53754] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 21 16:48:45.287447 2026] [:error] [pid 53731:tid 53735] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Tue Apr 21 16:48:45.549463 2026] [:error] [pid 53731:tid 53756] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Tue Apr 21 16:48:46.110032 2026] [:error] [pid 53731:tid 53752] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Tue Apr 21 16:48:46.374930 2026] [:error] [pid 53731:tid 53746] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Tue Apr 21 16:48:46.639437 2026] [:error] [pid 53731:tid 53737] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue Apr 21 16:48:46.906720 2026] [:error] [pid 53731:tid 53739] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Tue Apr 21 16:48:47.174554 2026] [:error] [pid 53731:tid 53736] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Tue Apr 21 16:48:47.445787 2026] [:error] [pid 53731:tid 53749] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Tue Apr 21 16:48:47.712377 2026] [:error] [pid 53731:tid 53737] [client 20.251.37.211:48530] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Apr 21 16:48:47.985570 2026] [:error] [pid 53731:tid 53754] [client 20.251.37.211:48530] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aec5712I9THUR-bRVGzsdgAAAhI"]
[Tue Apr 21 16:48:51.152316 2026] [:error] [pid 53978:tid 53999] [client 20.251.37.211:50452] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aec5851ivsR4hcOSQbbGiAAAApM"]
[Tue Apr 21 16:48:57.257823 2026] [:error] [pid 53731:tid 53759] [client 20.251.37.211:63540] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aec5-V2I9THUR-bRVGzsswAAAhc"]
[Tue Apr 21 16:49:04.944951 2026] [:error] [pid 4823:tid 4869] [client 20.251.37.211:64953] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aec6APc8mke3PfHqsxHc0QAAAZA"]
[Tue Apr 21 16:49:11.069319 2026] [:error] [pid 53731:tid 53746] [client 20.251.37.211:8854] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aec6B12I9THUR-bRVGzs8wAAAgs"]
[Tue Apr 21 16:49:16.201319 2026] [:error] [pid 53731:tid 53737] [client 20.251.37.211:36489] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aec6DF2I9THUR-bRVGztEwAAAgI"]
[Tue Apr 21 16:49:16.925955 2026] [:error] [pid 53731:tid 53755] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Tue Apr 21 16:49:17.720427 2026] [:error] [pid 53731:tid 53753] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 21 16:49:17.960794 2026] [:error] [pid 53731:tid 53754] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Tue Apr 21 16:49:18.198208 2026] [:error] [pid 53731:tid 53758] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Tue Apr 21 16:49:18.589488 2026] [:error] [pid 53731:tid 53752] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Tue Apr 21 16:49:18.828191 2026] [:error] [pid 53731:tid 53745] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Tue Apr 21 16:49:19.315977 2026] [:error] [pid 53731:tid 53737] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 16:49:19.551323 2026] [:error] [pid 53731:tid 53743] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Tue Apr 21 16:49:19.794980 2026] [:error] [pid 53731:tid 53753] [client 172.213.24.111:54682] File does not exist: /usr/local/apache/htdocs/suspended-page/bkyac.php
[Tue Apr 21 16:49:20.052214 2026] [:error] [pid 53731:tid 53760] [client 172.213.24.111:54682] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec6EF2I9THUR-bRVGztNwAAAhg"]
[Tue Apr 21 16:49:20.575927 2026] [:error] [pid 53978:tid 53990] [client 20.251.37.211:50453] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec6EJ1ivsR4hcOSQbbHFQAAAoo"]
[Tue Apr 21 16:49:23.000934 2026] [:error] [pid 53978:tid 53983] [client 20.251.37.211:46542] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec6Ep1ivsR4hcOSQbbHOQAAAoM"]
[Tue Apr 21 16:49:24.174959 2026] [:error] [pid 54080:tid 54083] [client 20.251.37.211:53349] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec6FIzEbQHHxtmWbaZ7vgAAAsE"]
[Tue Apr 21 16:49:25.281926 2026] [:error] [pid 4777:tid 4807] [client 172.213.24.111:40137] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec6FaxXur6bykKyLZSRyAAAARM"]
[Tue Apr 21 16:49:26.834410 2026] [:error] [pid 53978:tid 53988] [client 172.213.24.111:49077] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec6Fp1ivsR4hcOSQbbHWAAAAog"]
[Tue Apr 21 16:49:28.852861 2026] [:error] [pid 53978:tid 53990] [client 20.251.37.211:53338] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec6GJ1ivsR4hcOSQbbHbAAAAoo"]
[Tue Apr 21 16:49:29.397497 2026] [:error] [pid 35321:tid 35384] [client 172.213.24.111:45570] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aec6GTeHLhVUuu8cVXzmnQAAAEA"]
[Tue Apr 21 16:49:31.745172 2026] [:error] [pid 53731:tid 53754] [client 172.213.24.111:56725] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec6G12I9THUR-bRVGztbQAAAhI"]
[Tue Apr 21 16:49:32.101855 2026] [:error] [pid 35321:tid 35398] [client 20.251.37.211:55289] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec6HDeHLhVUuu8cVXzmpAAAAE4"]
[Tue Apr 21 16:49:32.744466 2026] [:error] [pid 35320:tid 35344] [client 172.213.24.111:47899] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec6HIJW6fdXWO6agMFHkwAAAA4"]
[Tue Apr 21 16:49:34.697071 2026] [:error] [pid 53731:tid 53748] [client 172.213.24.111:56333] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec6Hl2I9THUR-bRVGztewAAAg0"]
[Tue Apr 21 16:49:37.742435 2026] [:error] [pid 35320:tid 35350] [client 20.251.37.211:50545] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec6IYJW6fdXWO6agMFHlgAAABQ"]
[Tue Apr 21 16:49:37.765095 2026] [:error] [pid 53731:tid 53737] [client 172.213.24.111:47902] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec6IV2I9THUR-bRVGztggAAAgI"]
[Tue Apr 21 16:49:40.252117 2026] [:error] [pid 53731:tid 53754] [client 172.213.24.111:47888] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec6JF2I9THUR-bRVGztiwAAAhI"]
[Tue Apr 21 16:49:41.597819 2026] [:error] [pid 53731:tid 53755] [client 20.251.37.211:35989] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec6JV2I9THUR-bRVGztmgAAAhM"]
[Tue Apr 21 16:49:42.097711 2026] [:error] [pid 35415:tid 35434] [client 172.213.24.111:40139] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec6JkiqDinI4_22zzhgcgAAAMc"]
[Tue Apr 21 16:49:43.747055 2026] [:error] [pid 53731:tid 53739] [client 172.213.24.111:40155] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec6J12I9THUR-bRVGztqAAAAgQ"]
[Tue Apr 21 16:49:46.451386 2026] [:error] [pid 35321:tid 35401] [client 172.213.24.111:41067] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aec6KjeHLhVUuu8cVXzmrwAAAFE"]
[Tue Apr 21 16:49:47.410215 2026] [:error] [pid 35320:tid 35344] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Tue Apr 21 16:49:47.674403 2026] [:error] [pid 35320:tid 35350] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Tue Apr 21 16:49:47.938167 2026] [:error] [pid 35320:tid 35354] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Tue Apr 21 16:49:48.249043 2026] [:error] [pid 35320:tid 35345] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Tue Apr 21 16:49:48.553325 2026] [:error] [pid 35320:tid 35339] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Tue Apr 21 16:49:48.820954 2026] [:error] [pid 35320:tid 35338] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Tue Apr 21 16:49:49.102742 2026] [:error] [pid 35320:tid 35341] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Tue Apr 21 16:49:49.443128 2026] [:error] [pid 35321:tid 35396] [client 172.213.24.111:56705] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec6LTeHLhVUuu8cVXzmtgAAAEw"]
[Tue Apr 21 16:49:51.002189 2026] [:error] [pid 35320:tid 35334] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Apr 21 16:49:51.265937 2026] [:error] [pid 35320:tid 35336] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Tue Apr 21 16:49:51.561580 2026] [:error] [pid 35320:tid 35343] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Apr 21 16:49:51.825597 2026] [:error] [pid 35320:tid 35331] [client 20.251.37.211:55359] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Tue Apr 21 16:49:52.110583 2026] [:error] [pid 35320:tid 35340] [client 20.251.37.211:55359] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aec6MIJW6fdXWO6agMFHsAAAAAo"]
[Tue Apr 21 16:49:56.990434 2026] [:error] [pid 35321:tid 35386] [client 172.213.24.111:56729] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec6NDeHLhVUuu8cVXzmxQAAAEI"]
[Tue Apr 21 16:50:00.122652 2026] [:error] [pid 53731:tid 53735] [client 20.251.37.211:51562] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aec6OF2I9THUR-bRVGzt9AAAAgA"]
[Tue Apr 21 16:50:01.616014 2026] [:error] [pid 35321:tid 35408] [client 172.213.24.111:47905] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec6OTeHLhVUuu8cVXzmzwAAAFg"]
[Tue Apr 21 16:50:03.897416 2026] [:error] [pid 4777:tid 4806] [client 172.213.24.111:40186] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec6O6xXur6bykKyLZSR0gAAARI"]
[Tue Apr 21 16:50:05.231794 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:54689] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec6PYzEbQHHxtmWbaZ75AAAAtQ"]
[Tue Apr 21 16:50:07.900539 2026] [:error] [pid 54080:tid 54089] [client 172.213.24.111:49062] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec6P4zEbQHHxtmWbaZ77gAAAsc"]
[Tue Apr 21 16:50:09.757712 2026] [:error] [pid 35321:tid 35407] [client 172.213.24.111:49081] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aec6QTeHLhVUuu8cVXzm6AAAAFc"]
[Tue Apr 21 16:50:10.248030 2026] [:error] [pid 53832:tid 53851] [client 20.251.37.211:9137] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aec6QtzkuxsE_OhM9UJBNwAAAlA"]
[Tue Apr 21 16:50:11.298901 2026] [:error] [pid 4777:tid 4790] [client 172.213.24.111:8114] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aec6Q6xXur6bykKyLZSR1AAAAQI"]
[Tue Apr 21 16:50:14.110082 2026] [:error] [pid 53978:tid 54001] [client 20.251.37.211:9125] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aec6Rp1ivsR4hcOSQbbILgAAApU"]
[Tue Apr 21 16:50:15.888524 2026] [:error] [pid 53978:tid 53995] [client 172.213.24.111:45605] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aec6R51ivsR4hcOSQbbINwAAAo8"]
[Tue Apr 21 16:50:17.692535 2026] [:error] [pid 53978:tid 53994] [client 172.213.24.111:56723] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aec6SZ1ivsR4hcOSQbbIRAAAAo4"]
[Tue Apr 21 16:50:19.829317 2026] [:error] [pid 53731:tid 53742] [client 20.251.37.211:9107] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aec6S12I9THUR-bRVGzuFAAAAgc"]
[Tue Apr 21 16:50:21.080402 2026] [:error] [pid 53978:tid 53985] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/ctex1.php
[Tue Apr 21 16:50:21.318892 2026] [:error] [pid 53978:tid 53997] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Tue Apr 21 16:50:21.558003 2026] [:error] [pid 53978:tid 53998] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Tue Apr 21 16:50:21.827572 2026] [:error] [pid 53978:tid 53989] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Apr 21 16:50:22.073229 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Tue Apr 21 16:50:22.316501 2026] [:error] [pid 53978:tid 54000] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Tue Apr 21 16:50:22.575681 2026] [:error] [pid 53978:tid 53985] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Tue Apr 21 16:50:22.829555 2026] [:error] [pid 53978:tid 53988] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 21 16:50:23.082792 2026] [:error] [pid 53978:tid 53998] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Apr 21 16:50:23.322728 2026] [:error] [pid 53978:tid 53991] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Tue Apr 21 16:50:23.583599 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:56345] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Tue Apr 21 16:50:23.815782 2026] [:error] [pid 53731:tid 53735] [client 20.251.37.211:8908] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aec6T12I9THUR-bRVGzuLQAAAgA"]
[Tue Apr 21 16:50:23.835161 2026] [:error] [pid 53978:tid 54000] [client 172.213.24.111:56345] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec6T51ivsR4hcOSQbbIYAAAApQ"]
[Tue Apr 21 16:50:24.998991 2026] [:error] [pid 54080:tid 54098] [client 20.251.37.211:59786] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aec6UIzEbQHHxtmWbaZ8BwAAAtA"]
[Tue Apr 21 16:50:25.910300 2026] [:error] [pid 53832:tid 53850] [client 172.213.24.111:51289] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec6UdzkuxsE_OhM9UJBPAAAAk8"]
[Tue Apr 21 16:50:26.361162 2026] [:error] [pid 53832:tid 53853] [client 20.251.37.211:41581] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aec6UtzkuxsE_OhM9UJBPQAAAlI"]
[Tue Apr 21 16:50:27.496519 2026] [:error] [pid 35321:tid 35389] [client 20.251.37.211:8941] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aec6UzeHLhVUuu8cVXznAgAAAEU"]
[Tue Apr 21 16:50:28.221440 2026] [:error] [pid 53731:tid 53749] [client 172.213.24.111:44839] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec6VF2I9THUR-bRVGzuQAAAAg4"]
[Tue Apr 21 16:50:29.479544 2026] [:error] [pid 53731:tid 53738] [client 20.251.37.211:8389] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aec6VV2I9THUR-bRVGzuTQAAAgM"]
[Tue Apr 21 16:50:30.925147 2026] [:error] [pid 35321:tid 35387] [client 20.251.37.211:59738] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec6VjeHLhVUuu8cVXznFgAAAEM"]
[Tue Apr 21 16:50:31.025964 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:7249] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aec6V51ivsR4hcOSQbbIZgAAApY"]
[Tue Apr 21 16:50:31.702247 2026] [:error] [pid 53978:tid 53984] [client 20.251.37.211:39878] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec6V51ivsR4hcOSQbbIaQAAAoQ"]
[Tue Apr 21 16:50:33.125103 2026] [:error] [pid 53832:tid 53841] [client 20.251.37.211:49341] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec6WdzkuxsE_OhM9UJBRwAAAkY"]
[Tue Apr 21 16:50:33.392525 2026] [:error] [pid 35320:tid 35354] [client 172.213.24.111:54376] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec6WYJW6fdXWO6agMFH5AAAABg"]
[Tue Apr 21 16:50:34.599943 2026] [:error] [pid 53731:tid 53738] [client 20.251.37.211:59730] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec6Wl2I9THUR-bRVGzuXwAAAgM"]
[Tue Apr 21 16:50:37.323623 2026] [:error] [pid 53832:tid 53838] [client 172.213.24.111:47046] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec6XdzkuxsE_OhM9UJBUQAAAkM"]
[Tue Apr 21 16:50:38.924964 2026] [:error] [pid 53731:tid 53749] [client 172.213.24.111:57664] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec6Xl2I9THUR-bRVGzubAAAAg4"]
[Tue Apr 21 16:50:41.079848 2026] [:error] [pid 35320:tid 35330] [client 172.213.24.111:53939] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aec6YYJW6fdXWO6agMFH_gAAAAA"]
[Tue Apr 21 16:50:43.474157 2026] [:error] [pid 35321:tid 35393] [client 172.213.24.111:65144] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec6YzeHLhVUuu8cVXznUAAAAEk"]
[Tue Apr 21 16:50:45.713485 2026] [:error] [pid 53978:tid 53988] [client 172.213.24.111:49130] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec6ZZ1ivsR4hcOSQbbIhwAAAog"]
[Tue Apr 21 16:50:46.395091 2026] [:error] [pid 35321:tid 35407] [client 20.251.37.211:41505] [client 20.251.37.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec6ZjeHLhVUuu8cVXznXAAAAFc"]
[Tue Apr 21 16:50:49.435502 2026] [:error] [pid 53978:tid 53989] [client 172.213.24.111:51991] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec6aZ1ivsR4hcOSQbbIkQAAAok"]
[Tue Apr 21 16:50:52.973579 2026] [:error] [pid 53832:tid 53835] [client 20.251.37.211:53310] File does not exist: /usr/local/apache/htdocs/suspended-page/fsjzs.php
[Tue Apr 21 16:50:53.263618 2026] [:error] [pid 53832:tid 53858] [client 172.213.24.111:43880] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec6bdzkuxsE_OhM9UJBawAAAlc"]
[Tue Apr 21 16:50:53.775567 2026] [:error] [pid 53832:tid 53840] [client 20.251.37.211:53310] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Tue Apr 21 16:50:54.345104 2026] [:error] [pid 53832:tid 53854] [client 20.251.37.211:53310] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Tue Apr 21 16:50:55.182093 2026] [:error] [pid 53832:tid 53847] [client 20.251.37.211:53310] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 21 16:50:55.509081 2026] [:error] [pid 53832:tid 53843] [client 20.251.37.211:53310] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Tue Apr 21 16:50:55.788550 2026] [:error] [pid 53832:tid 53835] [client 20.251.37.211:53310] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Apr 21 16:50:56.051527 2026] [:error] [pid 53832:tid 53858] [client 20.251.37.211:53310] File does not exist: /usr/local/apache/htdocs/suspended-page/ai.php
[Tue Apr 21 16:50:56.518005 2026] [:error] [pid 53832:tid 53836] [client 20.251.37.211:53310] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Apr 21 16:50:58.441522 2026] [:error] [pid 35320:tid 35340] [client 172.213.24.111:59885] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec6coJW6fdXWO6agMFIHgAAAAo"]
[Tue Apr 21 16:51:00.197110 2026] [:error] [pid 53978:tid 53980] [client 172.213.24.111:46554] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec6dJ1ivsR4hcOSQbbIrAAAAoA"]
[Tue Apr 21 16:51:01.748519 2026] [:error] [pid 53978:tid 53989] [client 172.213.24.111:45213] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec6dZ1ivsR4hcOSQbbIswAAAok"]
[Tue Apr 21 16:51:03.258505 2026] [:error] [pid 53978:tid 53982] [client 172.213.24.111:58129] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bfil.php"] [unique_id "aec6d51ivsR4hcOSQbbIvwAAAoI"]
[Tue Apr 21 16:51:04.368160 2026] [:error] [pid 35320:tid 35340] [client 172.213.24.111:50406] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "aec6eIJW6fdXWO6agMFIIgAAAAo"]
[Tue Apr 21 16:51:06.093453 2026] [:error] [pid 53731:tid 53748] [client 172.213.24.111:45283] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "aec6el2I9THUR-bRVGzurgAAAg0"]
[Tue Apr 21 16:51:07.951675 2026] [:error] [pid 4823:tid 4861] [client 172.213.24.111:46591] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "aec6e_c8mke3PfHqsxHdFQAAAYg"]
[Tue Apr 21 16:51:09.179606 2026] [:error] [pid 53731:tid 53736] [client 172.213.24.111:42512] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abrand.php"] [unique_id "aec6fV2I9THUR-bRVGzuvwAAAgE"]
[Tue Apr 21 16:51:10.538249 2026] [:error] [pid 53978:tid 53998] [client 172.213.24.111:45260] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aec6fp1ivsR4hcOSQbbI2QAAApI"]
[Tue Apr 21 16:51:12.443498 2026] [:error] [pid 35321:tid 35404] [client 172.213.24.111:41138] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aec6gDeHLhVUuu8cVXznmgAAAFQ"]
[Tue Apr 21 16:51:17.754816 2026] [:error] [pid 53731:tid 53740] [client 172.213.24.111:38635] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aec6hV2I9THUR-bRVGzuywAAAgU"]
[Tue Apr 21 16:51:23.106175 2026] [:error] [pid 53832:tid 53856] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 16:51:23.359203 2026] [:error] [pid 53832:tid 53838] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 21 16:51:23.612209 2026] [:error] [pid 53832:tid 53854] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/amwxl.php
[Tue Apr 21 16:51:23.872653 2026] [:error] [pid 53832:tid 53841] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Tue Apr 21 16:51:24.128657 2026] [:error] [pid 53832:tid 53844] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php
[Tue Apr 21 16:51:24.375954 2026] [:error] [pid 53832:tid 53852] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Tue Apr 21 16:51:24.620922 2026] [:error] [pid 53832:tid 53847] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 16:51:24.883493 2026] [:error] [pid 53832:tid 53848] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Tue Apr 21 16:51:25.120737 2026] [:error] [pid 53832:tid 53843] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Tue Apr 21 16:51:25.371016 2026] [:error] [pid 53832:tid 53855] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Apr 21 16:51:25.622831 2026] [:error] [pid 53832:tid 53858] [client 172.213.24.111:55282] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Tue Apr 21 16:51:26.878573 2026] [:error] [pid 53832:tid 53851] [client 172.213.24.111:55282] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "aec6jtzkuxsE_OhM9UJBlwAAAlA"]
[Tue Apr 21 16:52:14.683027 2026] [:error] [pid 53978:tid 53998] [client 172.213.24.111:40673] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec6vp1ivsR4hcOSQbbJegAAApI"]
[Tue Apr 21 16:52:19.827803 2026] [:error] [pid 53978:tid 54004] [client 172.213.24.111:40689] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec6w51ivsR4hcOSQbbJhAAAApg"]
[Tue Apr 21 16:52:22.556382 2026] [:error] [pid 35321:tid 35401] [client 172.213.24.111:40666] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec6xjeHLhVUuu8cVXzokwAAAFE"]
[Tue Apr 21 16:52:23.828445 2026] [:error] [pid 53731:tid 53753] [client 172.213.24.111:57681] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aec6x12I9THUR-bRVGzwFAAAAhE"]
[Tue Apr 21 16:52:25.851710 2026] [:error] [pid 53978:tid 53991] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Tue Apr 21 16:52:26.088500 2026] [:error] [pid 53978:tid 53999] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 21 16:52:26.324895 2026] [:error] [pid 53978:tid 53984] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Tue Apr 21 16:52:26.563562 2026] [:error] [pid 53978:tid 53992] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Tue Apr 21 16:52:27.570734 2026] [:error] [pid 53978:tid 53999] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Tue Apr 21 16:52:27.837717 2026] [:error] [pid 53978:tid 53989] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Tue Apr 21 16:52:28.093266 2026] [:error] [pid 53978:tid 53984] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue Apr 21 16:52:28.445127 2026] [:error] [pid 53978:tid 53994] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Tue Apr 21 16:52:28.683794 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Tue Apr 21 16:52:28.935704 2026] [:error] [pid 53978:tid 53998] [client 172.213.24.111:57700] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Tue Apr 21 16:52:29.195882 2026] [:error] [pid 53978:tid 54003] [client 172.213.24.111:57700] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "aec6zZ1ivsR4hcOSQbbJtQAAApc"]
[Tue Apr 21 16:52:32.056506 2026] [:error] [pid 35321:tid 35401] [client 172.213.24.111:60333] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "aec60DeHLhVUuu8cVXzopAAAAFE"]
[Tue Apr 21 16:52:33.970000 2026] [:error] [pid 35321:tid 35407] [client 172.213.24.111:45974] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "aec60TeHLhVUuu8cVXzoqgAAAFc"]
[Tue Apr 21 16:52:35.741666 2026] [:error] [pid 53978:tid 53987] [client 172.213.24.111:50380] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "aec6051ivsR4hcOSQbbJwAAAAoc"]
[Tue Apr 21 16:52:37.535652 2026] [:error] [pid 54080:tid 54091] [client 172.213.24.111:57095] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aec61YzEbQHHxtmWbaZ8lAAAAsk"]
[Tue Apr 21 16:52:40.259529 2026] [:error] [pid 53832:tid 53855] [client 172.213.24.111:60956] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aec62NzkuxsE_OhM9UJB2QAAAlQ"]
[Tue Apr 21 16:52:43.153356 2026] [:error] [pid 53832:tid 53835] [client 172.213.24.111:57939] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aec629zkuxsE_OhM9UJB4wAAAkA"]
[Tue Apr 21 16:52:49.218486 2026] [:error] [pid 35321:tid 35397] [client 172.213.24.111:60292] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aec64TeHLhVUuu8cVXzowwAAAE0"]
[Tue Apr 21 16:52:54.643453 2026] [:error] [pid 35321:tid 35407] [client 172.213.24.111:54919] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aec65jeHLhVUuu8cVXzoyAAAAFc"]
[Tue Apr 21 16:52:56.177633 2026] [:error] [pid 35322:tid 35364] [client 172.213.24.111:46046] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aec66KPoAfV40BTfVKzMVgAAAIc"]
[Tue Apr 21 16:52:56.847862 2026] [:error] [pid 35415:tid 35451] [client 172.213.24.111:43925] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aec66EiqDinI4_22zzhgxgAAANg"]
[Tue Apr 21 16:52:58.184970 2026] [:error] [pid 35415:tid 35438] [client 172.213.24.111:51673] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aec66kiqDinI4_22zzhgyQAAAMs"]
[Tue Apr 21 16:52:59.520882 2026] [:error] [pid 53978:tid 53993] [client 172.213.24.111:46070] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec6651ivsR4hcOSQbbKDwAAAo0"]
[Tue Apr 21 16:53:02.829433 2026] [:error] [pid 35321:tid 35384] [client 172.213.24.111:52438] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec67jeHLhVUuu8cVXzo1gAAAEA"]
[Tue Apr 21 16:53:08.843966 2026] [:error] [pid 53731:tid 53758] [client 172.213.24.111:52433] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aec69F2I9THUR-bRVGzwmAAAAhY"]
[Tue Apr 21 16:53:23.672717 2026] [:error] [pid 53978:tid 53992] [client 172.213.24.111:40757] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec7A51ivsR4hcOSQbbKTAAAAow"]
[Tue Apr 21 16:53:26.409452 2026] [:error] [pid 54080:tid 54096] [client 172.213.24.111:41829] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "aec7BozEbQHHxtmWbaZ8uQAAAs4"]
[Tue Apr 21 16:53:28.293489 2026] [:error] [pid 35322:tid 35378] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/casp1.php
[Tue Apr 21 16:53:28.553884 2026] [:error] [pid 35322:tid 35379] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Tue Apr 21 16:53:28.791147 2026] [:error] [pid 35322:tid 35360] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Tue Apr 21 16:53:29.442559 2026] [:error] [pid 35322:tid 35380] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Tue Apr 21 16:53:29.681549 2026] [:error] [pid 35322:tid 35370] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Tue Apr 21 16:53:30.349440 2026] [:error] [pid 35322:tid 35372] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Tue Apr 21 16:53:30.590333 2026] [:error] [pid 35322:tid 35359] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Tue Apr 21 16:53:30.844998 2026] [:error] [pid 35322:tid 35371] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Tue Apr 21 16:53:31.373335 2026] [:error] [pid 35322:tid 35375] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Apr 21 16:53:31.626349 2026] [:error] [pid 35322:tid 35364] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Tue Apr 21 16:53:31.893186 2026] [:error] [pid 35322:tid 35368] [client 172.213.24.111:7423] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Apr 21 16:53:32.126956 2026] [:error] [pid 35322:tid 35366] [client 172.213.24.111:7423] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aec7DKPoAfV40BTfVKzMbAAAAIk"]
[Tue Apr 21 16:53:33.215873 2026] [:error] [pid 35321:tid 35395] [client 172.213.24.111:49106] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aec7DTeHLhVUuu8cVXzpFwAAAEs"]
[Tue Apr 21 16:53:34.098195 2026] [:error] [pid 53731:tid 53758] [client 172.213.24.111:58773] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aec7Dl2I9THUR-bRVGzw6wAAAhY"]
[Tue Apr 21 16:53:35.146912 2026] [:error] [pid 53832:tid 53837] [client 172.213.24.111:43196] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aec7D9zkuxsE_OhM9UJB-QAAAkI"]
[Tue Apr 21 16:53:36.182880 2026] [:error] [pid 53731:tid 53737] [client 172.213.24.111:43152] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aec7EF2I9THUR-bRVGzw8wAAAgI"]
[Tue Apr 21 16:53:38.202499 2026] [:error] [pid 53731:tid 53750] [client 172.213.24.111:53154] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aec7El2I9THUR-bRVGzxBQAAAg8"]
[Tue Apr 21 16:53:39.633476 2026] [:error] [pid 54080:tid 54093] [client 172.213.24.111:36758] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aec7E4zEbQHHxtmWbaZ8xwAAAss"]
[Tue Apr 21 16:53:42.291108 2026] [:error] [pid 35321:tid 35386] [client 172.213.24.111:49660] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aec7FjeHLhVUuu8cVXzpKAAAAEI"]
[Tue Apr 21 16:53:44.743882 2026] [:error] [pid 53978:tid 53987] [client 172.213.24.111:50022] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aec7GJ1ivsR4hcOSQbbKhgAAAoc"]
[Tue Apr 21 16:53:51.398031 2026] [:error] [pid 53978:tid 53985] [client 172.213.24.111:49132] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aec7H51ivsR4hcOSQbbKlgAAAoU"]
[Tue Apr 21 16:53:54.576746 2026] [:error] [pid 4777:tid 4812] [client 172.213.24.111:47849] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aec7IqxXur6bykKyLZSSYwAAARg"]
[Tue Apr 21 16:53:56.480302 2026] [:error] [pid 35321:tid 35393] [client 172.213.24.111:7305] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aec7JDeHLhVUuu8cVXzpQAAAAEk"]
[Tue Apr 21 16:53:58.622417 2026] [:error] [pid 35320:tid 35347] [client 172.213.24.111:7355] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aec7JoJW6fdXWO6agMFIvwAAABE"]
[Tue Apr 21 16:54:00.805976 2026] [:error] [pid 54080:tid 54105] [client 172.213.24.111:36736] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aec7KIzEbQHHxtmWbaZ81wAAAtc"]
[Tue Apr 21 16:54:01.864155 2026] [:error] [pid 54080:tid 54086] [client 172.213.24.111:48385] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aec7KYzEbQHHxtmWbaZ83QAAAsQ"]
[Tue Apr 21 16:54:02.948663 2026] [:error] [pid 54080:tid 54101] [client 172.213.24.111:49150] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aec7KozEbQHHxtmWbaZ84QAAAtM"]
[Tue Apr 21 16:54:05.768124 2026] [:error] [pid 53978:tid 53996] [client 172.213.24.111:55002] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec7LZ1ivsR4hcOSQbbKsQAAApA"]
[Tue Apr 21 16:54:07.462835 2026] [:error] [pid 53978:tid 53985] [client 172.213.24.111:7329] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec7L51ivsR4hcOSQbbKvwAAAoU"]
[Tue Apr 21 16:54:08.472758 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:7315] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec7MJ1ivsR4hcOSQbbKwwAAApY"]
[Tue Apr 21 16:54:09.301581 2026] [:error] [pid 4823:tid 4869] [client 172.213.24.111:50014] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aec7Mfc8mke3PfHqsxHdXwAAAZA"]
[Tue Apr 21 16:54:10.257611 2026] [:error] [pid 35321:tid 35384] [client 172.213.24.111:58529] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec7MjeHLhVUuu8cVXzpWQAAAEA"]
[Tue Apr 21 16:54:11.419818 2026] [:error] [pid 4823:tid 4855] [client 172.213.24.111:43520] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec7M_c8mke3PfHqsxHdZgAAAYI"]
[Tue Apr 21 16:54:15.327895 2026] [:error] [pid 53731:tid 53740] [client 172.213.24.111:47821] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec7N12I9THUR-bRVGzxZgAAAgU"]
[Tue Apr 21 16:54:15.878576 2026] [:error] [pid 53731:tid 53759] [client 172.213.24.111:48431] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aec7N12I9THUR-bRVGzxagAAAhc"]
[Tue Apr 21 16:54:17.557418 2026] [:error] [pid 53731:tid 53748] [client 172.213.24.111:7323] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fsjzs.php"] [unique_id "aec7OV2I9THUR-bRVGzxbQAAAg0"]
[Tue Apr 21 16:54:21.675659 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:64577] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fsjzs.php"] [unique_id "aec7PZ1ivsR4hcOSQbbK4AAAApY"]
[Tue Apr 21 16:54:27.459176 2026] [:error] [pid 4823:tid 4876] [client 172.213.24.111:43561] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fsjzs.php"] [unique_id "aec7Q_c8mke3PfHqsxHdeQAAAZc"]
[Tue Apr 21 16:54:31.090668 2026] [:error] [pid 53978:tid 53996] [client 172.213.24.111:8122] File does not exist: /usr/local/apache/htdocs/suspended-page/fsjzs.php
[Tue Apr 21 16:54:31.328166 2026] [:error] [pid 53978:tid 53986] [client 172.213.24.111:8122] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Tue Apr 21 16:54:31.566534 2026] [:error] [pid 53978:tid 53998] [client 172.213.24.111:8122] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Tue Apr 21 16:54:31.833908 2026] [:error] [pid 53978:tid 53982] [client 172.213.24.111:8122] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 21 16:54:32.069809 2026] [:error] [pid 53978:tid 54001] [client 172.213.24.111:8122] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Tue Apr 21 16:54:32.306100 2026] [:error] [pid 53978:tid 54003] [client 172.213.24.111:8122] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Apr 21 16:54:32.546196 2026] [:error] [pid 53978:tid 53994] [client 172.213.24.111:8122] File does not exist: /usr/local/apache/htdocs/suspended-page/ai.php
[Tue Apr 21 16:54:32.785867 2026] [:error] [pid 53978:tid 53983] [client 172.213.24.111:8122] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Apr 21 17:12:06.990346 2026] [:error] [pid 35320:tid 35341] [client 54.238.71.130:39382] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aec_ZoJW6fdXWO6agMFOIAAAAAs"]
[Tue Apr 21 17:12:07.704564 2026] [:error] [pid 35415:tid 35447] [client 54.238.71.130:39506] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aec_Z0iqDinI4_22zzhiAAAAANQ"]
[Tue Apr 21 17:12:08.266302 2026] [:error] [pid 53731:tid 53756] [client 54.238.71.130:39552] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "aec_aF2I9THUR-bRVGz_LAAAAhQ"]
[Tue Apr 21 17:12:08.824833 2026] [:error] [pid 53731:tid 53743] [client 54.238.71.130:37578] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "aec_aF2I9THUR-bRVGz_NgAAAgg"]
[Tue Apr 21 17:12:09.383876 2026] [:error] [pid 53731:tid 53754] [client 54.238.71.130:37644] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "aec_aV2I9THUR-bRVGz_PgAAAhI"]
[Tue Apr 21 17:12:09.941044 2026] [:error] [pid 53832:tid 53845] [client 54.238.71.130:37698] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "aec_adzkuxsE_OhM9UJFLAAAAko"]
[Tue Apr 21 17:12:10.500526 2026] [:error] [pid 35415:tid 35430] [client 54.238.71.130:37732] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "aec_akiqDinI4_22zzhiAQAAAMM"]
[Tue Apr 21 17:12:11.065044 2026] [:error] [pid 35321:tid 35384] [client 54.238.71.130:37770] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.remote"] [unique_id "aec_azeHLhVUuu8cVXzyDAAAAEA"]
[Tue Apr 21 17:12:11.624755 2026] [:error] [pid 53978:tid 53982] [client 54.238.71.130:37812] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.bak"] [unique_id "aec_a51ivsR4hcOSQbbTqwAAAoI"]
[Tue Apr 21 17:12:12.208408 2026] [:error] [pid 53978:tid 53986] [client 54.238.71.130:37868] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.backup"] [unique_id "aec_bJ1ivsR4hcOSQbbTrwAAAoY"]
[Tue Apr 21 17:12:12.765735 2026] [:error] [pid 53731:tid 53750] [client 54.238.71.130:37906] [client 54.238.71.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.save"] [unique_id "aec_bF2I9THUR-bRVGz_VwAAAg8"]
[Tue Apr 21 18:52:43.438169 2026] [:error] [pid 53978:tid 53986] [client 142.93.133.83:51575] [client 142.93.133.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.133.83, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aedW-51ivsR4hcOSQbb7BAAAAoY"]
[Tue Apr 21 18:52:43.442639 2026] [:error] [pid 53978:tid 53986] [client 142.93.133.83:51575] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 21 20:11:24.319685 2026] [:error] [pid 53832:tid 53848] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/gold.php
[Tue Apr 21 20:11:24.593872 2026] [:error] [pid 53832:tid 53836] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Tue Apr 21 20:11:24.875265 2026] [:error] [pid 53832:tid 53847] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Tue Apr 21 20:11:25.151213 2026] [:error] [pid 53832:tid 53851] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/.sghb.php
[Tue Apr 21 20:11:25.568642 2026] [:error] [pid 53832:tid 53840] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/z3ki.php
[Tue Apr 21 20:11:25.847392 2026] [:error] [pid 53832:tid 53846] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/zr-828.php
[Tue Apr 21 20:11:26.124552 2026] [:error] [pid 53832:tid 53852] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/uwa.php
[Tue Apr 21 20:11:26.406097 2026] [:error] [pid 53832:tid 53835] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/ckk.php
[Tue Apr 21 20:11:26.686830 2026] [:error] [pid 53832:tid 53839] [client 98.71.67.66:8063] File does not exist: /usr/local/apache/htdocs/suspended-page/pucci.php
[Tue Apr 21 20:11:27.323390 2026] [:error] [pid 53832:tid 53845] [client 98.71.67.66:8063] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "aedpb9zkuxsE_OhM9UJkjwAAAko"]
[Tue Apr 21 20:11:28.361046 2026] [:error] [pid 35320:tid 35353] [client 98.71.67.66:52792] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "aedpcIJW6fdXWO6agMGnzQAAABc"]
[Tue Apr 21 20:11:29.093490 2026] [:error] [pid 35320:tid 35354] [client 98.71.67.66:8062] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "aedpcYJW6fdXWO6agMGn0wAAABg"]
[Tue Apr 21 20:11:29.679013 2026] [:error] [pid 35320:tid 35342] [client 98.71.67.66:8041] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "aedpcYJW6fdXWO6agMGn1wAAAAw"]
[Tue Apr 21 20:11:30.814441 2026] [:error] [pid 35320:tid 35333] [client 98.71.67.66:24519] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aedpcoJW6fdXWO6agMGn3gAAAAM"]
[Tue Apr 21 20:11:31.734607 2026] [:error] [pid 35320:tid 35336] [client 98.71.67.66:8018] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aedpc4JW6fdXWO6agMGn4gAAAAY"]
[Tue Apr 21 20:11:32.276877 2026] [:error] [pid 53978:tid 53998] [client 98.71.67.66:52797] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aedpdJ1ivsR4hcOSQbYT1gAAApI"]
[Tue Apr 21 20:11:33.151958 2026] [:error] [pid 35320:tid 35349] [client 98.71.67.66:25601] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aedpdYJW6fdXWO6agMGn6QAAABM"]
[Tue Apr 21 20:11:34.091084 2026] [:error] [pid 53978:tid 53994] [client 98.71.67.66:7436] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "aedpdp1ivsR4hcOSQbYT2gAAAo4"]
[Tue Apr 21 20:11:34.796946 2026] [:error] [pid 54080:tid 54085] [client 98.71.67.66:8052] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "aedpdozEbQHHxtmWbaatswAAAsM"]
[Tue Apr 21 20:11:35.738609 2026] [:error] [pid 54080:tid 54084] [client 98.71.67.66:15943] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "aedpd4zEbQHHxtmWbaatuAAAAsI"]
[Tue Apr 21 20:11:36.549851 2026] [:error] [pid 53731:tid 53753] [client 98.71.67.66:24525] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "aedpeF2I9THUR-bRVGxS9gAAAhE"]
[Tue Apr 21 20:11:37.149155 2026] [:error] [pid 54080:tid 54096] [client 98.71.67.66:48426] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.admin.php"] [unique_id "aedpeYzEbQHHxtmWbaatvgAAAs4"]
[Tue Apr 21 20:11:37.857599 2026] [:error] [pid 35320:tid 35347] [client 98.71.67.66:25611] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.admin.php"] [unique_id "aedpeYJW6fdXWO6agMGn8wAAABE"]
[Tue Apr 21 20:11:38.735492 2026] [:error] [pid 53731:tid 53739] [client 98.71.67.66:48408] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.admin.php"] [unique_id "aedpel2I9THUR-bRVGxTAAAAAgQ"]
[Tue Apr 21 20:11:39.472717 2026] [:error] [pid 53731:tid 53738] [client 98.71.67.66:8010] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.admin.php"] [unique_id "aedpe12I9THUR-bRVGxTAgAAAgM"]
[Tue Apr 21 20:11:40.189006 2026] [:error] [pid 35321:tid 35399] [client 98.71.67.66:8058] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sw.php"] [unique_id "aedpfDeHLhVUuu8cVXx31AAAAE8"]
[Tue Apr 21 20:11:41.264024 2026] [:error] [pid 35320:tid 35352] [client 98.71.67.66:52772] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sw.php"] [unique_id "aedpfYJW6fdXWO6agMGn-gAAABY"]
[Tue Apr 21 20:11:42.125047 2026] [:error] [pid 53731:tid 53744] [client 98.71.67.66:52784] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sw.php"] [unique_id "aedpfl2I9THUR-bRVGxTDwAAAgk"]
[Tue Apr 21 20:11:42.782003 2026] [:error] [pid 53978:tid 53988] [client 98.71.67.66:7486] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sw.php"] [unique_id "aedpfp1ivsR4hcOSQbYT6gAAAog"]
[Tue Apr 21 20:11:43.501985 2026] [:error] [pid 4823:tid 4867] [client 98.71.67.66:48386] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/vuln.php"] [unique_id "aedpf_c8mke3PfHqsxH5gAAAAY4"]
[Tue Apr 21 20:11:44.296796 2026] [:error] [pid 53832:tid 53852] [client 98.71.67.66:52031] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/vuln.php"] [unique_id "aedpgNzkuxsE_OhM9UJkmAAAAlE"]
[Tue Apr 21 20:11:45.209187 2026] [:error] [pid 53978:tid 53984] [client 98.71.67.66:15980] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/vuln.php"] [unique_id "aedpgZ1ivsR4hcOSQbYT7wAAAoQ"]
[Tue Apr 21 20:11:46.501398 2026] [:error] [pid 53978:tid 53995] [client 98.71.67.66:56559] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/vuln.php"] [unique_id "aedpgp1ivsR4hcOSQbYUFQAAAo8"]
[Tue Apr 21 20:11:47.698842 2026] [:error] [pid 35321:tid 35394] [client 98.71.67.66:7456] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "aedpgzeHLhVUuu8cVXx35AAAAEo"]
[Tue Apr 21 20:11:48.505874 2026] [:error] [pid 35321:tid 35391] [client 98.71.67.66:56536] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "aedphDeHLhVUuu8cVXx36gAAAEc"]
[Tue Apr 21 20:11:49.463328 2026] [:error] [pid 4777:tid 4811] [client 98.71.67.66:48429] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "aedphaxXur6bykKyLZSmcQAAARc"]
[Tue Apr 21 20:11:50.755944 2026] [:error] [pid 53978:tid 53995] [client 98.71.67.66:24539] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "aedphp1ivsR4hcOSQbYUJAAAAo8"]
[Tue Apr 21 20:11:51.870626 2026] [:error] [pid 53832:tid 53855] [client 98.71.67.66:48445] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sxdfrt.php"] [unique_id "aedph9zkuxsE_OhM9UJknAAAAlQ"]
[Tue Apr 21 20:11:52.647071 2026] [:error] [pid 35321:tid 35399] [client 98.71.67.66:15941] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sxdfrt.php"] [unique_id "aedpiDeHLhVUuu8cVXx37wAAAE8"]
[Tue Apr 21 20:11:53.428573 2026] [:error] [pid 35321:tid 35397] [client 98.71.67.66:15966] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sxdfrt.php"] [unique_id "aedpiTeHLhVUuu8cVXx38QAAAE0"]
[Tue Apr 21 20:11:54.480013 2026] [:error] [pid 35321:tid 35384] [client 98.71.67.66:48400] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sxdfrt.php"] [unique_id "aedpijeHLhVUuu8cVXx39AAAAEA"]
[Tue Apr 21 20:11:55.515470 2026] [:error] [pid 53731:tid 53759] [client 98.71.67.66:56562] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aedpi12I9THUR-bRVGxTHwAAAhc"]
[Tue Apr 21 20:11:56.381448 2026] [:error] [pid 35322:tid 35360] [client 98.71.67.66:52781] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aedpjKPoAfV40BTfVKzZjAAAAIM"]
[Tue Apr 21 20:11:57.213201 2026] [:error] [pid 35321:tid 35404] [client 98.71.67.66:24523] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aedpjTeHLhVUuu8cVXx3-QAAAFQ"]
[Tue Apr 21 20:11:58.224701 2026] [:error] [pid 54080:tid 54094] [client 98.71.67.66:48410] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aedpjozEbQHHxtmWbaatzQAAAsw"]
[Tue Apr 21 20:11:59.425228 2026] [:error] [pid 35415:tid 35443] [client 98.71.67.66:52796] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aedpj0iqDinI4_22zzhwiwAAANA"]
[Tue Apr 21 20:12:01.012973 2026] [:error] [pid 35320:tid 35339] [client 98.71.67.66:24551] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aedpkYJW6fdXWO6agMGoMQAAAAk"]
[Tue Apr 21 20:12:02.412681 2026] [:error] [pid 35320:tid 35351] [client 98.71.67.66:48430] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aedpkoJW6fdXWO6agMGoOgAAABU"]
[Tue Apr 21 20:12:03.114723 2026] [:error] [pid 35321:tid 35396] [client 98.71.67.66:7435] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aedpkzeHLhVUuu8cVXx4CgAAAEw"]
[Tue Apr 21 20:12:04.370313 2026] [:error] [pid 35320:tid 35330] [client 98.71.67.66:7887] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class-bda.php"] [unique_id "aedplIJW6fdXWO6agMGoQwAAAAA"]
[Tue Apr 21 20:12:05.162437 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:56544] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class-bda.php"] [unique_id "aedplTeHLhVUuu8cVXx4EQAAAEE"]
[Tue Apr 21 20:12:05.901029 2026] [:error] [pid 35320:tid 35339] [client 98.71.67.66:48415] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class-bda.php"] [unique_id "aedplYJW6fdXWO6agMGoSAAAAAk"]
[Tue Apr 21 20:12:06.979162 2026] [:error] [pid 35321:tid 35388] [client 98.71.67.66:8036] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class-bda.php"] [unique_id "aedpljeHLhVUuu8cVXx4GwAAAEQ"]
[Tue Apr 21 20:12:08.686886 2026] [:error] [pid 53832:tid 53856] [client 98.71.67.66:51988] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bhm.php"] [unique_id "aedpmNzkuxsE_OhM9UJkqwAAAlU"]
[Tue Apr 21 20:12:09.523311 2026] [:error] [pid 35321:tid 35404] [client 98.71.67.66:25611] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bhm.php"] [unique_id "aedpmTeHLhVUuu8cVXx4LAAAAFQ"]
[Tue Apr 21 20:12:10.478050 2026] [:error] [pid 53731:tid 53750] [client 98.71.67.66:8032] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bhm.php"] [unique_id "aedpml2I9THUR-bRVGxTPQAAAg8"]
[Tue Apr 21 20:12:12.151823 2026] [:error] [pid 35321:tid 35394] [client 98.71.67.66:23842] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bhm.php"] [unique_id "aedpnDeHLhVUuu8cVXx4LwAAAEo"]
[Tue Apr 21 20:12:13.181593 2026] [:error] [pid 35320:tid 35341] [client 98.71.67.66:10248] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "aedpnYJW6fdXWO6agMGoUwAAAAs"]
[Tue Apr 21 20:12:15.154067 2026] [:error] [pid 53731:tid 53739] [client 98.71.67.66:8080] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "aedpn12I9THUR-bRVGxTSQAAAgQ"]
[Tue Apr 21 20:12:16.178625 2026] [:error] [pid 53731:tid 53748] [client 98.71.67.66:34755] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "aedpoF2I9THUR-bRVGxTTwAAAg0"]
[Tue Apr 21 20:12:16.831567 2026] [:error] [pid 53731:tid 53749] [client 98.71.67.66:34795] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "aedpoF2I9THUR-bRVGxTVAAAAg4"]
[Tue Apr 21 20:12:17.883224 2026] [:error] [pid 35321:tid 35396] [client 98.71.67.66:35429] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "aedpoTeHLhVUuu8cVXx4TQAAAEw"]
[Tue Apr 21 20:12:18.640793 2026] [:error] [pid 35321:tid 35395] [client 98.71.67.66:8077] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "aedpojeHLhVUuu8cVXx4UQAAAEs"]
[Tue Apr 21 20:12:19.724424 2026] [:error] [pid 35320:tid 35349] [client 98.71.67.66:34813] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "aedpo4JW6fdXWO6agMGoZAAAABM"]
[Tue Apr 21 20:12:20.415826 2026] [:error] [pid 54080:tid 54104] [client 98.71.67.66:7842] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "aedppIzEbQHHxtmWbaat4gAAAtY"]
[Tue Apr 21 20:12:21.223101 2026] [:error] [pid 35320:tid 35354] [client 98.71.67.66:35438] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-xme.php"] [unique_id "aedppYJW6fdXWO6agMGocgAAABg"]
[Tue Apr 21 20:12:21.988815 2026] [:error] [pid 35320:tid 35338] [client 98.71.67.66:50446] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-xme.php"] [unique_id "aedppYJW6fdXWO6agMGoeQAAAAg"]
[Tue Apr 21 20:12:23.003393 2026] [:error] [pid 4823:tid 4858] [client 98.71.67.66:53341] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-xme.php"] [unique_id "aedpp_c8mke3PfHqsxH5mAAAAYU"]
[Tue Apr 21 20:12:24.060712 2026] [:error] [pid 35321:tid 35391] [client 98.71.67.66:50435] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-xme.php"] [unique_id "aedpqDeHLhVUuu8cVXx4VwAAAEc"]
[Tue Apr 21 20:12:25.064161 2026] [:error] [pid 35321:tid 35404] [client 98.71.67.66:7835] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminer.php"] [unique_id "aedpqTeHLhVUuu8cVXx4XQAAAFQ"]
[Tue Apr 21 20:12:25.736778 2026] [:error] [pid 35321:tid 35408] [client 98.71.67.66:7861] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminer.php"] [unique_id "aedpqTeHLhVUuu8cVXx4ZwAAAFg"]
[Tue Apr 21 20:12:26.821602 2026] [:error] [pid 53731:tid 53740] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Tue Apr 21 20:12:27.076143 2026] [:error] [pid 53731:tid 53739] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/ktfow.php
[Tue Apr 21 20:12:27.336077 2026] [:error] [pid 53731:tid 53744] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Tue Apr 21 20:12:27.594546 2026] [:error] [pid 53731:tid 53735] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/Xx.php
[Tue Apr 21 20:12:27.849804 2026] [:error] [pid 53731:tid 53743] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/xmini.php
[Tue Apr 21 20:12:28.106914 2026] [:error] [pid 53731:tid 53759] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/2468.php
[Tue Apr 21 20:12:28.644386 2026] [:error] [pid 53731:tid 53746] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Tue Apr 21 20:12:29.091836 2026] [:error] [pid 53731:tid 53755] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/amdin.php
[Tue Apr 21 20:12:29.503734 2026] [:error] [pid 53731:tid 53747] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/huya.php
[Tue Apr 21 20:12:29.759284 2026] [:error] [pid 53731:tid 53749] [client 98.71.67.66:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/puc.php
[Tue Apr 21 20:12:30.021419 2026] [:error] [pid 53731:tid 53740] [client 98.71.67.66:50457] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "aedprl2I9THUR-bRVGxTfwAAAgU"]
[Tue Apr 21 20:12:31.047769 2026] [:error] [pid 53832:tid 53858] [client 98.71.67.66:35444] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "aedpr9zkuxsE_OhM9UJkyAAAAlc"]
[Tue Apr 21 20:12:33.217303 2026] [:error] [pid 35321:tid 35394] [client 98.71.67.66:7818] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "aedpsTeHLhVUuu8cVXx4oAAAAEo"]
[Tue Apr 21 20:12:34.293765 2026] [:error] [pid 53978:tid 53980] [client 98.71.67.66:16425] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "aedpsp1ivsR4hcOSQbYUVgAAAoA"]
[Tue Apr 21 20:12:35.013093 2026] [:error] [pid 35321:tid 35386] [client 98.71.67.66:50440] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ewp.php"] [unique_id "aedpszeHLhVUuu8cVXx4sQAAAEI"]
[Tue Apr 21 20:12:36.584398 2026] [:error] [pid 35321:tid 35399] [client 98.71.67.66:16410] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ewp.php"] [unique_id "aedptDeHLhVUuu8cVXx4vAAAAE8"]
[Tue Apr 21 20:12:37.649067 2026] [:error] [pid 53978:tid 54004] [client 98.71.67.66:53365] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ewp.php"] [unique_id "aedptZ1ivsR4hcOSQbYUWQAAApg"]
[Tue Apr 21 20:12:38.540574 2026] [:error] [pid 35321:tid 35393] [client 98.71.67.66:7669] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ewp.php"] [unique_id "aedptjeHLhVUuu8cVXx4xwAAAEk"]
[Tue Apr 21 20:12:39.662550 2026] [:error] [pid 35321:tid 35386] [client 98.71.67.66:34778] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "aedptzeHLhVUuu8cVXx40AAAAEI"]
[Tue Apr 21 20:12:40.700183 2026] [:error] [pid 4777:tid 4809] [client 98.71.67.66:7825] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "aedpuKxXur6bykKyLZSmggAAARU"]
[Tue Apr 21 20:12:41.724985 2026] [:error] [pid 35321:tid 35403] [client 98.71.67.66:50456] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "aedpuTeHLhVUuu8cVXx43wAAAFM"]
[Tue Apr 21 20:12:42.724892 2026] [:error] [pid 35320:tid 35348] [client 98.71.67.66:7826] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "aedpuoJW6fdXWO6agMGonwAAABI"]
[Tue Apr 21 20:12:43.997249 2026] [:error] [pid 35320:tid 35335] [client 98.71.67.66:7668] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aedpu4JW6fdXWO6agMGooQAAAAU"]
[Tue Apr 21 20:12:45.628758 2026] [:error] [pid 53978:tid 53986] [client 98.71.67.66:50487] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aedpvZ1ivsR4hcOSQbYUZAAAAoY"]
[Tue Apr 21 20:12:46.822991 2026] [:error] [pid 35321:tid 35388] [client 98.71.67.66:7643] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aedpvjeHLhVUuu8cVXx4_AAAAEQ"]
[Tue Apr 21 20:12:47.909958 2026] [:error] [pid 53731:tid 53760] [client 98.71.67.66:34767] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aedpv12I9THUR-bRVGxTnQAAAhg"]
[Tue Apr 21 20:12:48.905408 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:50473] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aedpwDeHLhVUuu8cVXx5DAAAAEE"]
[Tue Apr 21 20:12:49.876601 2026] [:error] [pid 35320:tid 35330] [client 98.71.67.66:16395] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aedpwYJW6fdXWO6agMGorwAAAAA"]
[Tue Apr 21 20:12:51.387543 2026] [:error] [pid 35320:tid 35348] [client 98.71.67.66:50463] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aedpw4JW6fdXWO6agMGosgAAABI"]
[Tue Apr 21 20:12:52.362382 2026] [:error] [pid 54080:tid 54083] [client 98.71.67.66:53338] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aedpxIzEbQHHxtmWbaat9gAAAsE"]
[Tue Apr 21 20:12:53.370492 2026] [:error] [pid 53978:tid 53995] [client 98.71.67.66:16404] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aedpxZ1ivsR4hcOSQbYUawAAAo8"]
[Tue Apr 21 20:12:54.189963 2026] [:error] [pid 4823:tid 4853] [client 98.71.67.66:10747] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aedpxvc8mke3PfHqsxH5sAAAAYA"]
[Tue Apr 21 20:12:54.923834 2026] [:error] [pid 35321:tid 35390] [client 98.71.67.66:53363] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aedpxjeHLhVUuu8cVXx5OgAAAEY"]
[Tue Apr 21 20:12:55.553057 2026] [:error] [pid 35320:tid 35353] [client 98.71.67.66:7809] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "aedpx4JW6fdXWO6agMGouAAAABc"]
[Tue Apr 21 20:12:56.310700 2026] [:error] [pid 54080:tid 54097] [client 98.71.67.66:16419] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aedpyIzEbQHHxtmWbaat_gAAAs8"]
[Tue Apr 21 20:12:56.996903 2026] [:error] [pid 54080:tid 54090] [client 98.71.67.66:34794] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aedpyIzEbQHHxtmWbaauAAAAAsg"]
[Tue Apr 21 20:12:57.789268 2026] [:error] [pid 54080:tid 54103] [client 98.71.67.66:16421] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aedpyYzEbQHHxtmWbaauAwAAAtU"]
[Tue Apr 21 20:12:58.839384 2026] [:error] [pid 54080:tid 54105] [client 98.71.67.66:7822] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "aedpyozEbQHHxtmWbaauBwAAAtc"]
[Tue Apr 21 20:12:59.523210 2026] [:error] [pid 54080:tid 54102] [client 98.71.67.66:10710] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aedpy4zEbQHHxtmWbaauDAAAAtQ"]
[Tue Apr 21 20:13:00.751274 2026] [:error] [pid 35321:tid 35406] [client 98.71.67.66:50485] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aedpzDeHLhVUuu8cVXx5YgAAAFY"]
[Tue Apr 21 20:13:01.378039 2026] [:error] [pid 35320:tid 35331] [client 98.71.67.66:7808] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aedpzYJW6fdXWO6agMGovAAAAAE"]
[Tue Apr 21 20:13:02.329979 2026] [:error] [pid 53731:tid 53749] [client 98.71.67.66:28032] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "aedpzl2I9THUR-bRVGxTyQAAAg4"]
[Tue Apr 21 20:13:03.034524 2026] [:error] [pid 35321:tid 35405] [client 98.71.67.66:7627] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "aedpzzeHLhVUuu8cVXx5bAAAAFU"]
[Tue Apr 21 20:13:04.216881 2026] [:error] [pid 35320:tid 35338] [client 98.71.67.66:50453] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "aedp0IJW6fdXWO6agMGoxAAAAAg"]
[Tue Apr 21 20:13:05.056611 2026] [:error] [pid 35321:tid 35400] [client 98.71.67.66:34781] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "aedp0TeHLhVUuu8cVXx5eAAAAFA"]
[Tue Apr 21 20:13:05.892320 2026] [:error] [pid 53978:tid 53992] [client 98.71.67.66:34811] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "aedp0Z1ivsR4hcOSQbYUdwAAAow"]
[Tue Apr 21 20:13:06.951854 2026] [:error] [pid 53731:tid 53736] [client 98.71.67.66:10702] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "aedp0l2I9THUR-bRVGxT0wAAAgE"]
[Tue Apr 21 20:13:08.092484 2026] [:error] [pid 53731:tid 53745] [client 98.71.67.66:52082] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "aedp1F2I9THUR-bRVGxT1QAAAgo"]
[Tue Apr 21 20:13:09.101749 2026] [:error] [pid 35321:tid 35392] [client 98.71.67.66:28049] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "aedp1TeHLhVUuu8cVXx5nQAAAEg"]
[Tue Apr 21 20:13:09.957527 2026] [:error] [pid 35321:tid 35407] [client 98.71.67.66:7668] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "aedp1TeHLhVUuu8cVXx5qQAAAFc"]
[Tue Apr 21 20:13:10.932819 2026] [:error] [pid 35320:tid 35333] [client 98.71.67.66:50472] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "aedp1oJW6fdXWO6agMGo2wAAAAM"]
[Tue Apr 21 20:13:11.814872 2026] [:error] [pid 53978:tid 53984] [client 98.71.67.66:28080] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "aedp151ivsR4hcOSQbYUgQAAAoQ"]
[Tue Apr 21 20:13:12.701207 2026] [:error] [pid 35320:tid 35350] [client 98.71.67.66:10725] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "aedp2IJW6fdXWO6agMGo4wAAABQ"]
[Tue Apr 21 20:13:13.736425 2026] [:error] [pid 35320:tid 35334] [client 98.71.67.66:35424] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "aedp2YJW6fdXWO6agMGo7AAAAAQ"]
[Tue Apr 21 20:13:14.498755 2026] [:error] [pid 53832:tid 53840] [client 98.71.67.66:52065] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/"] [unique_id "aedp2tzkuxsE_OhM9UJk2QAAAkU"]
[Tue Apr 21 20:13:15.700540 2026] [:error] [pid 35321:tid 35387] [client 98.71.67.66:53360] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/"] [unique_id "aedp2zeHLhVUuu8cVXx5wAAAAEM"]
[Tue Apr 21 20:13:16.439328 2026] [:error] [pid 35321:tid 35384] [client 98.71.67.66:7617] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/"] [unique_id "aedp3DeHLhVUuu8cVXx5yQAAAEA"]
[Tue Apr 21 20:13:17.296670 2026] [:error] [pid 35321:tid 35405] [client 98.71.67.66:52084] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/"] [unique_id "aedp3TeHLhVUuu8cVXx5zgAAAFU"]
[Tue Apr 21 20:13:18.720885 2026] [:error] [pid 35321:tid 35401] [client 98.71.67.66:10742] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aedp3jeHLhVUuu8cVXx52gAAAFE"]
[Tue Apr 21 20:13:19.714787 2026] [:error] [pid 54080:tid 54090] [client 98.71.67.66:7629] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aedp34zEbQHHxtmWbaauJwAAAsg"]
[Tue Apr 21 20:13:21.012011 2026] [:error] [pid 35321:tid 35394] [client 98.71.67.66:28041] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aedp4TeHLhVUuu8cVXx57AAAAEo"]
[Tue Apr 21 20:13:22.106455 2026] [:error] [pid 53731:tid 53753] [client 98.71.67.66:7677] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aedp4l2I9THUR-bRVGxT5wAAAhE"]
[Tue Apr 21 20:13:23.309341 2026] [:error] [pid 53731:tid 53739] [client 98.71.67.66:50458] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "aedp412I9THUR-bRVGxT6AAAAgQ"]
[Tue Apr 21 20:13:24.459896 2026] [:error] [pid 35321:tid 35397] [client 98.71.67.66:50455] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "aedp5DeHLhVUuu8cVXx59QAAAE0"]
[Tue Apr 21 20:13:25.262801 2026] [:error] [pid 35321:tid 35384] [client 98.71.67.66:52042] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "aedp5TeHLhVUuu8cVXx5-wAAAEA"]
[Tue Apr 21 20:13:26.242529 2026] [:error] [pid 35320:tid 35352] [client 98.71.67.66:34779] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "aedp5oJW6fdXWO6agMGpAAAAABY"]
[Tue Apr 21 20:13:27.243787 2026] [:error] [pid 35321:tid 35394] [client 98.71.67.66:53350] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "aedp5zeHLhVUuu8cVXx6AAAAAEo"]
[Tue Apr 21 20:13:28.881285 2026] [:error] [pid 54080:tid 54105] [client 98.71.67.66:7663] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "aedp6IzEbQHHxtmWbaauOQAAAtc"]
[Tue Apr 21 20:13:29.822286 2026] [:error] [pid 53731:tid 53757] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Tue Apr 21 20:13:30.096370 2026] [:error] [pid 53731:tid 53753] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Tue Apr 21 20:13:30.371175 2026] [:error] [pid 53731:tid 53755] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Tue Apr 21 20:13:31.023137 2026] [:error] [pid 53731:tid 53749] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Tue Apr 21 20:13:31.310859 2026] [:error] [pid 53731:tid 53757] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Apr 21 20:13:31.585728 2026] [:error] [pid 53731:tid 53754] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Tue Apr 21 20:13:31.876642 2026] [:error] [pid 53731:tid 53747] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Tue Apr 21 20:13:32.151991 2026] [:error] [pid 53731:tid 53755] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Tue Apr 21 20:13:32.428826 2026] [:error] [pid 53731:tid 53737] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Tue Apr 21 20:13:32.708027 2026] [:error] [pid 53731:tid 53748] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Tue Apr 21 20:13:32.984497 2026] [:error] [pid 53731:tid 53743] [client 98.71.67.66:34783] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Tue Apr 21 20:13:33.256528 2026] [:error] [pid 53731:tid 53756] [client 98.71.67.66:34783] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "aedp7V2I9THUR-bRVGxUGwAAAhQ"]
[Tue Apr 21 20:13:34.014064 2026] [:error] [pid 54080:tid 54087] [client 98.71.67.66:52072] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "aedp7ozEbQHHxtmWbaauPgAAAsU"]
[Tue Apr 21 20:13:34.658949 2026] [:error] [pid 35320:tid 35339] [client 98.71.67.66:28059] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "aedp7oJW6fdXWO6agMGpDwAAAAk"]
[Tue Apr 21 20:13:35.500678 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:52039] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "aedp7zeHLhVUuu8cVXx6GQAAAEE"]
[Tue Apr 21 20:13:36.395920 2026] [:error] [pid 53731:tid 53743] [client 98.71.67.66:7253] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aedp8F2I9THUR-bRVGxUIgAAAgg"]
[Tue Apr 21 20:13:36.988832 2026] [:error] [pid 35320:tid 35349] [client 98.71.67.66:50436] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aedp8IJW6fdXWO6agMGpFAAAABM"]
[Tue Apr 21 20:13:37.860918 2026] [:error] [pid 53731:tid 53752] [client 98.71.67.66:52032] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aedp8V2I9THUR-bRVGxUJgAAAhA"]
[Tue Apr 21 20:13:38.473653 2026] [:error] [pid 35320:tid 35343] [client 98.71.67.66:52074] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "aedp8oJW6fdXWO6agMGpGQAAAA0"]
[Tue Apr 21 20:13:39.154100 2026] [:error] [pid 35320:tid 35339] [client 98.71.67.66:28064] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.well-known/nastar.php"] [unique_id "aedp84JW6fdXWO6agMGpIQAAAAk"]
[Tue Apr 21 20:13:39.910643 2026] [:error] [pid 35320:tid 35330] [client 98.71.67.66:10745] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.well-known/nastar.php"] [unique_id "aedp84JW6fdXWO6agMGpKQAAAAA"]
[Tue Apr 21 20:13:40.513453 2026] [:error] [pid 53978:tid 54000] [client 98.71.67.66:53368] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.well-known/nastar.php"] [unique_id "aedp9J1ivsR4hcOSQbYUnQAAApQ"]
[Tue Apr 21 20:13:41.250592 2026] [:error] [pid 53731:tid 53759] [client 98.71.67.66:53317] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.well-known/nastar.php"] [unique_id "aedp9V2I9THUR-bRVGxULwAAAhc"]
[Tue Apr 21 20:13:41.889860 2026] [:error] [pid 35321:tid 35384] [client 98.71.67.66:35410] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "aedp9TeHLhVUuu8cVXx6KgAAAEA"]
[Tue Apr 21 20:13:42.622206 2026] [:error] [pid 35321:tid 35392] [client 98.71.67.66:7638] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "aedp9jeHLhVUuu8cVXx6LgAAAEg"]
[Tue Apr 21 20:13:43.552368 2026] [:error] [pid 4823:tid 4859] [client 98.71.67.66:52073] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "aedp9_c8mke3PfHqsxH5wwAAAYY"]
[Tue Apr 21 20:13:44.221360 2026] [:error] [pid 35320:tid 35336] [client 98.71.67.66:52054] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "aedp-IJW6fdXWO6agMGpOgAAAAY"]
[Tue Apr 21 20:13:44.871181 2026] [:error] [pid 35320:tid 35337] [client 98.71.67.66:50474] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "aedp-IJW6fdXWO6agMGpPAAAAAc"]
[Tue Apr 21 20:13:45.629821 2026] [:error] [pid 35320:tid 35352] [client 98.71.67.66:34801] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "aedp-YJW6fdXWO6agMGpPwAAABY"]
[Tue Apr 21 20:13:46.212436 2026] [:error] [pid 35320:tid 35351] [client 98.71.67.66:10749] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "aedp-oJW6fdXWO6agMGpQgAAABU"]
[Tue Apr 21 20:13:47.795954 2026] [:error] [pid 35321:tid 35403] [client 98.71.67.66:50433] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "aedp-zeHLhVUuu8cVXx6VgAAAFM"]
[Tue Apr 21 20:13:48.980580 2026] [:error] [pid 53978:tid 53998] [client 98.71.67.66:7632] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "aedp_J1ivsR4hcOSQbYUoAAAApI"]
[Tue Apr 21 20:13:49.966814 2026] [:error] [pid 54080:tid 54090] [client 98.71.67.66:53369] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "aedp_YzEbQHHxtmWbaauSAAAAsg"]
[Tue Apr 21 20:13:50.813017 2026] [:error] [pid 35320:tid 35353] [client 98.71.67.66:34789] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "aedp_oJW6fdXWO6agMGpSgAAABc"]
[Tue Apr 21 20:13:51.860812 2026] [:error] [pid 54080:tid 54094] [client 98.71.67.66:34765] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "aedp_4zEbQHHxtmWbaauUwAAAsw"]
[Tue Apr 21 20:13:52.639027 2026] [:error] [pid 35320:tid 35334] [client 98.71.67.66:10736] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "aedqAIJW6fdXWO6agMGpUQAAAAQ"]
[Tue Apr 21 20:13:53.663195 2026] [:error] [pid 35320:tid 35352] [client 98.71.67.66:7664] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "aedqAYJW6fdXWO6agMGpWQAAABY"]
[Tue Apr 21 20:13:54.428618 2026] [:error] [pid 53978:tid 54003] [client 98.71.67.66:7630] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "aedqAp1ivsR4hcOSQbYUpgAAApc"]
[Tue Apr 21 20:13:55.166187 2026] [:error] [pid 35321:tid 35400] [client 98.71.67.66:7670] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "aedqAzeHLhVUuu8cVXx6fQAAAFA"]
[Tue Apr 21 20:13:56.183845 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:7653] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aedqBDeHLhVUuu8cVXx6iAAAAEE"]
[Tue Apr 21 20:13:57.080321 2026] [:error] [pid 35321:tid 35396] [client 98.71.67.66:35445] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aedqBTeHLhVUuu8cVXx6kQAAAEw"]
[Tue Apr 21 20:13:58.051549 2026] [:error] [pid 35320:tid 35352] [client 98.71.67.66:50486] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aedqBoJW6fdXWO6agMGpZAAAABY"]
[Tue Apr 21 20:13:59.049880 2026] [:error] [pid 35320:tid 35344] [client 98.71.67.66:10729] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aligk.php"] [unique_id "aedqB4JW6fdXWO6agMGpaAAAAA4"]
[Tue Apr 21 20:13:59.783439 2026] [:error] [pid 35321:tid 35391] [client 98.71.67.66:10716] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aedqBzeHLhVUuu8cVXx6pQAAAEc"]
[Tue Apr 21 20:14:00.544169 2026] [:error] [pid 35321:tid 35393] [client 98.71.67.66:34761] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aedqCDeHLhVUuu8cVXx6rgAAAEk"]
[Tue Apr 21 20:14:01.210607 2026] [:error] [pid 54080:tid 54092] [client 98.71.67.66:16396] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aedqCYzEbQHHxtmWbaaucgAAAso"]
[Tue Apr 21 20:14:02.366194 2026] [:error] [pid 4777:tid 4804] [client 98.71.67.66:28062] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byrgo.php"] [unique_id "aedqCqxXur6bykKyLZSmjwAAARA"]
[Tue Apr 21 20:14:03.148620 2026] [:error] [pid 53978:tid 53982] [client 98.71.67.66:10735] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aedqC51ivsR4hcOSQbYUsQAAAoI"]
[Tue Apr 21 20:14:03.831923 2026] [:error] [pid 53978:tid 53990] [client 98.71.67.66:10722] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aedqC51ivsR4hcOSQbYUswAAAoo"]
[Tue Apr 21 20:14:04.874046 2026] [:error] [pid 54080:tid 54100] [client 98.71.67.66:50477] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aedqDIzEbQHHxtmWbaaugQAAAtI"]
[Tue Apr 21 20:14:05.590791 2026] [:error] [pid 53978:tid 53985] [client 98.71.67.66:35403] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwpg.php"] [unique_id "aedqDZ1ivsR4hcOSQbYUtwAAAoU"]
[Tue Apr 21 20:14:06.419464 2026] [:error] [pid 53731:tid 53738] [client 98.71.67.66:53343] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aedqDl2I9THUR-bRVGxUPwAAAgM"]
[Tue Apr 21 20:14:07.386296 2026] [:error] [pid 35320:tid 35353] [client 98.71.67.66:10693] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aedqD4JW6fdXWO6agMGpeQAAABc"]
[Tue Apr 21 20:14:08.128127 2026] [:error] [pid 53731:tid 53736] [client 98.71.67.66:52060] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aedqEF2I9THUR-bRVGxUSAAAAgE"]
[Tue Apr 21 20:14:08.935581 2026] [:error] [pid 53731:tid 53740] [client 98.71.67.66:28036] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "aedqEF2I9THUR-bRVGxUTQAAAgU"]
[Tue Apr 21 20:14:10.187271 2026] [:error] [pid 53731:tid 53735] [client 98.71.67.66:34756] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aedqEl2I9THUR-bRVGxUWwAAAgA"]
[Tue Apr 21 20:14:11.088888 2026] [:error] [pid 35321:tid 35390] [client 98.71.67.66:7662] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aedqEzeHLhVUuu8cVXx6zQAAAEY"]
[Tue Apr 21 20:14:11.899160 2026] [:error] [pid 4777:tid 4794] [client 98.71.67.66:34810] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aedqE6xXur6bykKyLZSmkgAAAQY"]
[Tue Apr 21 20:14:12.612437 2026] [:error] [pid 35320:tid 35341] [client 98.71.67.66:53359] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "aedqFIJW6fdXWO6agMGpfQAAAAs"]
[Tue Apr 21 20:14:13.260130 2026] [:error] [pid 35320:tid 35350] [client 98.71.67.66:7644] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aedqFYJW6fdXWO6agMGpfwAAABQ"]
[Tue Apr 21 20:14:13.994721 2026] [:error] [pid 35321:tid 35391] [client 98.71.67.66:53357] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aedqFTeHLhVUuu8cVXx63gAAAEc"]
[Tue Apr 21 20:14:14.802416 2026] [:error] [pid 35321:tid 35398] [client 98.71.67.66:35407] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aedqFjeHLhVUuu8cVXx66AAAAE4"]
[Tue Apr 21 20:14:15.486955 2026] [:error] [pid 35321:tid 35386] [client 98.71.67.66:50483] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "aedqFzeHLhVUuu8cVXx67QAAAEI"]
[Tue Apr 21 20:14:16.682119 2026] [:error] [pid 35321:tid 35390] [client 98.71.67.66:34808] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aedqGDeHLhVUuu8cVXx68gAAAEY"]
[Tue Apr 21 20:14:17.535833 2026] [:error] [pid 35321:tid 35389] [client 98.71.67.66:52046] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aedqGTeHLhVUuu8cVXx6-gAAAEU"]
[Tue Apr 21 20:14:18.422036 2026] [:error] [pid 4777:tid 4812] [client 98.71.67.66:10698] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aedqGqxXur6bykKyLZSmlgAAARg"]
[Tue Apr 21 20:14:19.382904 2026] [:error] [pid 35321:tid 35406] [client 98.71.67.66:10712] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "aedqGzeHLhVUuu8cVXx7BQAAAFY"]
[Tue Apr 21 20:14:20.188506 2026] [:error] [pid 53978:tid 54001] [client 98.71.67.66:34776] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "aedqHJ1ivsR4hcOSQbYUywAAApU"]
[Tue Apr 21 20:14:20.879092 2026] [:error] [pid 53978:tid 53985] [client 98.71.67.66:16417] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "aedqHJ1ivsR4hcOSQbYUzQAAAoU"]
[Tue Apr 21 20:14:21.545760 2026] [:error] [pid 53731:tid 53753] [client 98.71.67.66:28045] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "aedqHV2I9THUR-bRVGxUYAAAAhE"]
[Tue Apr 21 20:14:22.519728 2026] [:error] [pid 35321:tid 35399] [client 98.71.67.66:10688] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "aedqHjeHLhVUuu8cVXx7EwAAAE8"]
[Tue Apr 21 20:14:23.235492 2026] [:error] [pid 53832:tid 53853] [client 98.71.67.66:52057] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "aedqH9zkuxsE_OhM9UJlAQAAAlI"]
[Tue Apr 21 20:14:24.073092 2026] [:error] [pid 35322:tid 35373] [client 98.71.67.66:50469] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "aedqIKPoAfV40BTfVKzZxAAAAJA"]
[Tue Apr 21 20:14:25.062309 2026] [:error] [pid 54080:tid 54105] [client 98.71.67.66:50432] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "aedqIYzEbQHHxtmWbaauxwAAAtc"]
[Tue Apr 21 20:14:26.029175 2026] [:error] [pid 53832:tid 53841] [client 98.71.67.66:34788] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "aedqItzkuxsE_OhM9UJlAgAAAkY"]
[Tue Apr 21 20:14:26.703870 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:7269] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "aedqIjeHLhVUuu8cVXx7GQAAAEE"]
[Tue Apr 21 20:14:27.463000 2026] [:error] [pid 35321:tid 35386] [client 98.71.67.66:53330] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "aedqIzeHLhVUuu8cVXx7IAAAAEI"]
[Tue Apr 21 20:14:28.393702 2026] [:error] [pid 53731:tid 53744] [client 98.71.67.66:7667] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "aedqJF2I9THUR-bRVGxUYgAAAgk"]
[Tue Apr 21 20:14:29.189077 2026] [:error] [pid 53731:tid 53757] [client 98.71.67.66:50449] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "aedqJV2I9THUR-bRVGxUZQAAAhU"]
[Tue Apr 21 20:14:30.204818 2026] [:error] [pid 35321:tid 35395] [client 98.71.67.66:34799] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "aedqJjeHLhVUuu8cVXx7KAAAAEs"]
[Tue Apr 21 20:14:31.075825 2026] [:error] [pid 35321:tid 35391] [client 98.71.67.66:10690] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "aedqJzeHLhVUuu8cVXx7NAAAAEc"]
[Tue Apr 21 20:14:31.630859 2026] [:error] [pid 35320:tid 35349] [client 98.71.67.66:7618] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "aedqJ4JW6fdXWO6agMGppQAAABM"]
[Tue Apr 21 20:14:32.373510 2026] [:error] [pid 53731:tid 53740] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Apr 21 20:14:32.626878 2026] [:error] [pid 53731:tid 53739] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Tue Apr 21 20:14:32.885759 2026] [:error] [pid 53731:tid 53738] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Tue Apr 21 20:14:33.146943 2026] [:error] [pid 53731:tid 53756] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Tue Apr 21 20:14:33.400676 2026] [:error] [pid 53731:tid 53753] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Tue Apr 21 20:14:33.661172 2026] [:error] [pid 53731:tid 53741] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Tue Apr 21 20:14:33.916269 2026] [:error] [pid 53731:tid 53759] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Tue Apr 21 20:14:34.176987 2026] [:error] [pid 53731:tid 53755] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 21 20:14:34.429663 2026] [:error] [pid 53731:tid 53757] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Apr 21 20:14:35.001783 2026] [:error] [pid 53731:tid 53743] [client 98.71.67.66:8078] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Tue Apr 21 20:14:35.290850 2026] [:error] [pid 53731:tid 53735] [client 98.71.67.66:8078] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aedqK12I9THUR-bRVGxUewAAAgA"]
[Tue Apr 21 20:14:35.958953 2026] [:error] [pid 4823:tid 4872] [client 98.71.67.66:53356] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aedqK_c8mke3PfHqsxH50QAAAZM"]
[Tue Apr 21 20:14:36.776540 2026] [:error] [pid 35415:tid 35439] [client 98.71.67.66:8079] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aedqLEiqDinI4_22zzhwtAAAAMw"]
[Tue Apr 21 20:14:37.558877 2026] [:error] [pid 35415:tid 35432] [client 98.71.67.66:50495] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aedqLUiqDinI4_22zzhwtQAAAMU"]
[Tue Apr 21 20:14:38.343364 2026] [:error] [pid 35415:tid 35446] [client 98.71.67.66:28067] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "aedqLkiqDinI4_22zzhwtgAAANM"]
[Tue Apr 21 20:14:39.061801 2026] [:error] [pid 4777:tid 4792] [client 98.71.67.66:36703] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "aedqL6xXur6bykKyLZSmoQAAAQQ"]
[Tue Apr 21 20:14:39.880858 2026] [:error] [pid 4823:tid 4855] [client 98.71.67.66:34782] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "aedqL_c8mke3PfHqsxH52AAAAYI"]
[Tue Apr 21 20:14:40.444423 2026] [:error] [pid 35320:tid 35337] [client 98.71.67.66:16407] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "aedqMIJW6fdXWO6agMGpsQAAAAc"]
[Tue Apr 21 20:14:41.158340 2026] [:error] [pid 35320:tid 35345] [client 98.71.67.66:52049] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aedqMYJW6fdXWO6agMGptwAAAA8"]
[Tue Apr 21 20:14:41.864399 2026] [:error] [pid 4823:tid 4863] [client 98.71.67.66:50454] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aedqMfc8mke3PfHqsxH52gAAAYo"]
[Tue Apr 21 20:14:42.465903 2026] [:error] [pid 54080:tid 54094] [client 98.71.67.66:52064] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aedqMozEbQHHxtmWbaau9gAAAsw"]
[Tue Apr 21 20:14:43.508767 2026] [:error] [pid 35321:tid 35400] [client 98.71.67.66:35395] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "aedqMzeHLhVUuu8cVXx7UQAAAFA"]
[Tue Apr 21 20:14:44.197602 2026] [:error] [pid 54080:tid 54093] [client 98.71.67.66:52050] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aedqNIzEbQHHxtmWbaau-QAAAss"]
[Tue Apr 21 20:14:45.006158 2026] [:error] [pid 54080:tid 54106] [client 98.71.67.66:34752] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aedqNYzEbQHHxtmWbaau-gAAAtg"]
[Tue Apr 21 20:14:45.668809 2026] [:error] [pid 35321:tid 35397] [client 98.71.67.66:28053] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aedqNTeHLhVUuu8cVXx7YAAAAE0"]
[Tue Apr 21 20:14:46.560912 2026] [:error] [pid 35321:tid 35396] [client 98.71.67.66:28040] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aedqNjeHLhVUuu8cVXx7ZAAAAEw"]
[Tue Apr 21 20:14:47.228056 2026] [:error] [pid 35321:tid 35390] [client 98.71.67.66:52045] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "aedqNzeHLhVUuu8cVXx7agAAAEY"]
[Tue Apr 21 20:14:48.268451 2026] [:error] [pid 35321:tid 35394] [client 98.71.67.66:7637] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "aedqODeHLhVUuu8cVXx7cQAAAEo"]
[Tue Apr 21 20:14:48.973097 2026] [:error] [pid 35415:tid 35430] [client 98.71.67.66:8089] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "aedqOEiqDinI4_22zzhwvAAAAMM"]
[Tue Apr 21 20:14:49.885607 2026] [:error] [pid 35415:tid 35442] [client 98.71.67.66:34797] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "aedqOUiqDinI4_22zzhwvQAAAM8"]
[Tue Apr 21 20:14:50.600165 2026] [:error] [pid 53978:tid 53996] [client 98.71.67.66:28066] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aedqOp1ivsR4hcOSQbYU6wAAApA"]
[Tue Apr 21 20:14:51.621621 2026] [:error] [pid 35321:tid 35395] [client 98.71.67.66:34791] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aedqOzeHLhVUuu8cVXx7eQAAAEs"]
[Tue Apr 21 20:14:52.576598 2026] [:error] [pid 35321:tid 35390] [client 98.71.67.66:50492] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aedqPDeHLhVUuu8cVXx7ewAAAEY"]
[Tue Apr 21 20:14:53.234834 2026] [:error] [pid 35320:tid 35344] [client 98.71.67.66:36672] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aedqPYJW6fdXWO6agMGp1QAAAA4"]
[Tue Apr 21 20:14:53.901639 2026] [:error] [pid 53978:tid 53982] [client 98.71.67.66:7678] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aedqPZ1ivsR4hcOSQbYU7wAAAoI"]
[Tue Apr 21 20:14:55.195822 2026] [:error] [pid 4823:tid 4862] [client 98.71.67.66:28072] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aedqP_c8mke3PfHqsxH53wAAAYk"]
[Tue Apr 21 20:14:56.088492 2026] [:error] [pid 35415:tid 35439] [client 98.71.67.66:36700] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aedqQEiqDinI4_22zzhwvwAAAMw"]
[Tue Apr 21 20:14:56.822516 2026] [:error] [pid 35321:tid 35401] [client 98.71.67.66:8126] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aedqQDeHLhVUuu8cVXx7hQAAAFE"]
[Tue Apr 21 20:14:57.494067 2026] [:error] [pid 35321:tid 35393] [client 98.71.67.66:7814] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "aedqQTeHLhVUuu8cVXx7igAAAEk"]
[Tue Apr 21 20:14:58.213957 2026] [:error] [pid 35320:tid 35335] [client 98.71.67.66:35439] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "aedqQoJW6fdXWO6agMGp4QAAAAU"]
[Tue Apr 21 20:14:58.832541 2026] [:error] [pid 4823:tid 4870] [client 98.71.67.66:50461] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "aedqQvc8mke3PfHqsxH57QAAAZE"]
[Tue Apr 21 20:14:59.562152 2026] [:error] [pid 54080:tid 54104] [client 98.71.67.66:53354] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "aedqQ4zEbQHHxtmWbaavAAAAAtY"]
[Tue Apr 21 20:15:00.494357 2026] [:error] [pid 35321:tid 35387] [client 98.71.67.66:10737] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "aedqRDeHLhVUuu8cVXx7mgAAAEM"]
[Tue Apr 21 20:15:01.359208 2026] [:error] [pid 35320:tid 35342] [client 98.71.67.66:28056] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "aedqRYJW6fdXWO6agMGp6wAAAAw"]
[Tue Apr 21 20:15:02.418475 2026] [:error] [pid 35321:tid 35389] [client 98.71.67.66:7820] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "aedqRjeHLhVUuu8cVXx7pAAAAEU"]
[Tue Apr 21 20:15:03.059112 2026] [:error] [pid 35321:tid 35403] [client 98.71.67.66:8099] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "aedqRzeHLhVUuu8cVXx7qwAAAFM"]
[Tue Apr 21 20:15:03.835890 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:34763] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aedqRzeHLhVUuu8cVXx7sgAAAEE"]
[Tue Apr 21 20:15:04.652785 2026] [:error] [pid 35321:tid 35395] [client 98.71.67.66:7630] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aedqSDeHLhVUuu8cVXx7twAAAEs"]
[Tue Apr 21 20:15:05.425405 2026] [:error] [pid 53731:tid 53736] [client 98.71.67.66:53347] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aedqSV2I9THUR-bRVGxUiwAAAgE"]
[Tue Apr 21 20:15:06.231603 2026] [:error] [pid 53832:tid 53852] [client 98.71.67.66:34796] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aedqStzkuxsE_OhM9UJlFwAAAlE"]
[Tue Apr 21 20:15:07.225182 2026] [:error] [pid 35321:tid 35396] [client 98.71.67.66:28065] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aedqSzeHLhVUuu8cVXx7wQAAAEw"]
[Tue Apr 21 20:15:07.825819 2026] [:error] [pid 35321:tid 35408] [client 98.71.67.66:52078] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aedqSzeHLhVUuu8cVXx7xAAAAFg"]
[Tue Apr 21 20:15:08.618717 2026] [:error] [pid 35320:tid 35348] [client 98.71.67.66:34800] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aedqTIJW6fdXWO6agMGqAAAAABI"]
[Tue Apr 21 20:15:09.519592 2026] [:error] [pid 53978:tid 53994] [client 98.71.67.66:28093] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "aedqTZ1ivsR4hcOSQbYVAQAAAo4"]
[Tue Apr 21 20:15:10.152152 2026] [:error] [pid 35415:tid 35446] [client 98.71.67.66:53328] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "aedqTkiqDinI4_22zzhwwAAAANM"]
[Tue Apr 21 20:15:10.924131 2026] [:error] [pid 35322:tid 35368] [client 98.71.67.66:53324] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "aedqTqPoAfV40BTfVKzZ0gAAAIs"]
[Tue Apr 21 20:15:11.555414 2026] [:error] [pid 54080:tid 54100] [client 98.71.67.66:34771] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "aedqT4zEbQHHxtmWbaavDAAAAtI"]
[Tue Apr 21 20:15:12.306820 2026] [:error] [pid 35321:tid 35401] [client 98.71.67.66:7857] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "aedqUDeHLhVUuu8cVXx70QAAAFE"]
[Tue Apr 21 20:15:12.888727 2026] [:error] [pid 35321:tid 35408] [client 98.71.67.66:10696] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aedqUDeHLhVUuu8cVXx70wAAAFg"]
[Tue Apr 21 20:15:13.540772 2026] [:error] [pid 53832:tid 53838] [client 98.71.67.66:35427] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aedqUdzkuxsE_OhM9UJlGwAAAkM"]
[Tue Apr 21 20:15:14.441832 2026] [:error] [pid 35415:tid 35447] [client 98.71.67.66:52079] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aedqUkiqDinI4_22zzhwwgAAANQ"]
[Tue Apr 21 20:15:15.036746 2026] [:error] [pid 4777:tid 4789] [client 98.71.67.66:34764] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "aedqU6xXur6bykKyLZSm5wAAAQE"]
[Tue Apr 21 20:15:15.815795 2026] [:error] [pid 53832:tid 53850] [client 98.71.67.66:7247] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aedqU9zkuxsE_OhM9UJlHgAAAk8"]
[Tue Apr 21 20:15:16.660416 2026] [:error] [pid 53731:tid 53738] [client 98.71.67.66:50475] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aedqVF2I9THUR-bRVGxUpwAAAgM"]
[Tue Apr 21 20:15:17.528610 2026] [:error] [pid 4823:tid 4868] [client 98.71.67.66:34773] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aedqVfc8mke3PfHqsxH5_gAAAY8"]
[Tue Apr 21 20:15:18.147074 2026] [:error] [pid 53832:tid 53859] [client 98.71.67.66:28076] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aedqVtzkuxsE_OhM9UJlJAAAAlg"]
[Tue Apr 21 20:15:18.789878 2026] [:error] [pid 53978:tid 54002] [client 98.71.67.66:28068] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aedqVp1ivsR4hcOSQbYVBQAAApY"]
[Tue Apr 21 20:15:19.635794 2026] [:error] [pid 53978:tid 53987] [client 98.71.67.66:8071] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aedqV51ivsR4hcOSQbYVCgAAAoc"]
[Tue Apr 21 20:15:20.420838 2026] [:error] [pid 4823:tid 4861] [client 98.71.67.66:50448] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aedqWPc8mke3PfHqsxH5_wAAAYg"]
[Tue Apr 21 20:15:21.226154 2026] [:error] [pid 53978:tid 53995] [client 98.71.67.66:28042] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "aedqWZ1ivsR4hcOSQbYVDwAAAo8"]
[Tue Apr 21 20:15:21.910118 2026] [:error] [pid 4823:tid 4862] [client 98.71.67.66:52091] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aedqWfc8mke3PfHqsxH6AgAAAYk"]
[Tue Apr 21 20:15:22.468710 2026] [:error] [pid 4823:tid 4856] [client 98.71.67.66:53361] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aedqWvc8mke3PfHqsxH6BQAAAYM"]
[Tue Apr 21 20:15:23.595858 2026] [:error] [pid 35321:tid 35398] [client 98.71.67.66:53337] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aedqWzeHLhVUuu8cVXx72gAAAE4"]
[Tue Apr 21 20:15:24.299705 2026] [:error] [pid 53978:tid 53982] [client 98.71.67.66:53336] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aedqXJ1ivsR4hcOSQbYVIgAAAoI"]
[Tue Apr 21 20:15:24.952666 2026] [:error] [pid 53978:tid 53983] [client 98.71.67.66:52077] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "aedqXJ1ivsR4hcOSQbYVJAAAAoM"]
[Tue Apr 21 20:15:25.575984 2026] [:error] [pid 35320:tid 35338] [client 98.71.67.66:10743] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "aedqXYJW6fdXWO6agMGqBgAAAAg"]
[Tue Apr 21 20:15:26.268972 2026] [:error] [pid 35320:tid 35346] [client 98.71.67.66:7673] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "aedqXoJW6fdXWO6agMGqBwAAABA"]
[Tue Apr 21 20:15:27.004778 2026] [:error] [pid 35320:tid 35330] [client 98.71.67.66:7648] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "aedqX4JW6fdXWO6agMGqCAAAAAA"]
[Tue Apr 21 20:15:27.772430 2026] [:error] [pid 53731:tid 53758] [client 98.71.67.66:7841] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aedqX12I9THUR-bRVGxUrAAAAhY"]
[Tue Apr 21 20:15:28.657527 2026] [:error] [pid 53978:tid 53980] [client 98.71.67.66:50488] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aedqYJ1ivsR4hcOSQbYVLgAAAoA"]
[Tue Apr 21 20:15:29.362695 2026] [:error] [pid 35321:tid 35395] [client 98.71.67.66:52094] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aedqYTeHLhVUuu8cVXx75AAAAEs"]
[Tue Apr 21 20:15:30.106937 2026] [:error] [pid 35321:tid 35391] [client 98.71.67.66:53371] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aedqYjeHLhVUuu8cVXx77QAAAEc"]
[Tue Apr 21 20:15:30.897144 2026] [:error] [pid 53832:tid 53839] [client 98.71.67.66:34790] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aedqYtzkuxsE_OhM9UJlLAAAAkQ"]
[Tue Apr 21 20:15:31.711519 2026] [:error] [pid 35415:tid 35443] [client 98.71.67.66:34768] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aedqY0iqDinI4_22zzhw1QAAANA"]
[Tue Apr 21 20:15:32.490250 2026] [:error] [pid 4777:tid 4791] [client 98.71.67.66:16438] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aedqZKxXur6bykKyLZSnBAAAAQM"]
[Tue Apr 21 20:15:33.073807 2026] [:error] [pid 35320:tid 35341] [client 98.71.67.66:16400] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "aedqZYJW6fdXWO6agMGqGwAAAAs"]
[Tue Apr 21 20:15:33.706632 2026] [:error] [pid 35321:tid 35390] [client 98.71.67.66:52083] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "aedqZTeHLhVUuu8cVXx79gAAAEY"]
[Tue Apr 21 20:15:34.488524 2026] [:error] [pid 35321:tid 35389] [client 98.71.67.66:53346] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Apr 21 20:15:35.049022 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:53346] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Tue Apr 21 20:15:35.600982 2026] [:error] [pid 35321:tid 35393] [client 98.71.67.66:53346] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Apr 21 20:15:35.875636 2026] [:error] [pid 35321:tid 35403] [client 98.71.67.66:53346] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Apr 21 20:15:36.153598 2026] [:error] [pid 35321:tid 35388] [client 98.71.67.66:53346] File does not exist: /usr/local/apache/htdocs/suspended-page/admin1.php
[Tue Apr 21 20:15:36.806724 2026] [:error] [pid 35321:tid 35393] [client 98.71.67.66:53346] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Tue Apr 21 20:15:37.639885 2026] [:error] [pid 35321:tid 35401] [client 98.71.67.66:53346] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aedqaTeHLhVUuu8cVXx8IQAAAFE"]
[Tue Apr 21 20:15:38.244802 2026] [:error] [pid 35320:tid 35338] [client 98.71.67.66:50438] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aedqaoJW6fdXWO6agMGqIQAAAAg"]
[Tue Apr 21 20:15:38.960023 2026] [:error] [pid 35320:tid 35346] [client 98.71.67.66:10715] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aedqaoJW6fdXWO6agMGqJAAAABA"]
[Tue Apr 21 20:15:39.738156 2026] [:error] [pid 54080:tid 54092] [client 98.71.67.66:28058] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "aedqa4zEbQHHxtmWbaavHwAAAso"]
[Tue Apr 21 20:15:40.385327 2026] [:error] [pid 35320:tid 35343] [client 98.71.67.66:7628] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aedqbIJW6fdXWO6agMGqJQAAAA0"]
[Tue Apr 21 20:15:41.154926 2026] [:error] [pid 53731:tid 53758] [client 98.71.67.66:16389] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aedqbV2I9THUR-bRVGxUwAAAAhY"]
[Tue Apr 21 20:15:41.852200 2026] [:error] [pid 53832:tid 53838] [client 98.71.67.66:52095] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aedqbdzkuxsE_OhM9UJlNQAAAkM"]
[Tue Apr 21 20:15:42.793697 2026] [:error] [pid 35321:tid 35398] [client 98.71.67.66:35442] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aedqbjeHLhVUuu8cVXx8QQAAAE4"]
[Tue Apr 21 20:15:43.360528 2026] [:error] [pid 35321:tid 35395] [client 98.71.67.66:50447] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "aedqbzeHLhVUuu8cVXx8RAAAAEs"]
[Tue Apr 21 20:15:43.965690 2026] [:error] [pid 35415:tid 35427] [client 98.71.67.66:16418] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "aedqb0iqDinI4_22zzhw5QAAAMA"]
[Tue Apr 21 20:15:44.627580 2026] [:error] [pid 35321:tid 35405] [client 98.71.67.66:7640] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "aedqcDeHLhVUuu8cVXx8SQAAAFU"]
[Tue Apr 21 20:15:45.211496 2026] [:error] [pid 4777:tid 4796] [client 98.71.67.66:16397] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "aedqcaxXur6bykKyLZSnBwAAAQg"]
[Tue Apr 21 20:15:45.852577 2026] [:error] [pid 4777:tid 4812] [client 98.71.67.66:28054] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aedqcaxXur6bykKyLZSnCAAAARg"]
[Tue Apr 21 20:15:46.456002 2026] [:error] [pid 35320:tid 35337] [client 98.71.67.66:7839] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aedqcoJW6fdXWO6agMGqNAAAAAc"]
[Tue Apr 21 20:15:47.021406 2026] [:error] [pid 35320:tid 35334] [client 98.71.67.66:35450] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aedqc4JW6fdXWO6agMGqOQAAAAQ"]
[Tue Apr 21 20:15:47.824669 2026] [:error] [pid 53731:tid 53736] [client 98.71.67.66:7623] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aedqc12I9THUR-bRVGxUzwAAAgE"]
[Tue Apr 21 20:15:48.465656 2026] [:error] [pid 54080:tid 54084] [client 98.71.67.66:52075] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aedqdIzEbQHHxtmWbaavLAAAAsI"]
[Tue Apr 21 20:15:49.204315 2026] [:error] [pid 54080:tid 54089] [client 98.71.67.66:36701] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aedqdYzEbQHHxtmWbaavLgAAAsc"]
[Tue Apr 21 20:15:49.998517 2026] [:error] [pid 35321:tid 35403] [client 98.71.67.66:10741] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aedqdTeHLhVUuu8cVXx8UwAAAFM"]
[Tue Apr 21 20:15:50.638571 2026] [:error] [pid 35321:tid 35404] [client 98.71.67.66:34803] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "aedqdjeHLhVUuu8cVXx8VQAAAFQ"]
[Tue Apr 21 20:15:51.237467 2026] [:error] [pid 4823:tid 4867] [client 98.71.67.66:28034] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "aedqd_c8mke3PfHqsxH6IwAAAY4"]
[Tue Apr 21 20:15:52.164790 2026] [:error] [pid 4823:tid 4857] [client 98.71.67.66:16393] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "aedqePc8mke3PfHqsxH6JQAAAYQ"]
[Tue Apr 21 20:15:52.765138 2026] [:error] [pid 53731:tid 53736] [client 98.71.67.66:52033] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "aedqeF2I9THUR-bRVGxU4QAAAgE"]
[Tue Apr 21 20:15:53.586862 2026] [:error] [pid 53731:tid 53760] [client 98.71.67.66:52086] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "aedqeV2I9THUR-bRVGxU5wAAAhg"]
[Tue Apr 21 20:15:54.301373 2026] [:error] [pid 35320:tid 35335] [client 98.71.67.66:7252] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "aedqeoJW6fdXWO6agMGqUQAAAAU"]
[Tue Apr 21 20:15:55.015012 2026] [:error] [pid 35320:tid 35347] [client 98.71.67.66:10692] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "aedqe4JW6fdXWO6agMGqUwAAABE"]
[Tue Apr 21 20:15:55.821971 2026] [:error] [pid 35320:tid 35334] [client 98.71.67.66:16444] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "aedqe4JW6fdXWO6agMGqVQAAAAQ"]
[Tue Apr 21 20:15:56.456195 2026] [:error] [pid 35320:tid 35351] [client 98.71.67.66:28079] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "aedqfIJW6fdXWO6agMGqWgAAABU"]
[Tue Apr 21 20:15:57.114568 2026] [:error] [pid 53731:tid 53758] [client 98.71.67.66:7854] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aedqfV2I9THUR-bRVGxU-AAAAhY"]
[Tue Apr 21 20:15:57.681207 2026] [:error] [pid 53978:tid 53995] [client 98.71.67.66:35426] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aedqfZ1ivsR4hcOSQbYVQAAAAo8"]
[Tue Apr 21 20:15:58.288893 2026] [:error] [pid 35320:tid 35352] [client 98.71.67.66:10695] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aedqfoJW6fdXWO6agMGqYgAAABY"]
[Tue Apr 21 20:15:58.827787 2026] [:error] [pid 53832:tid 53840] [client 98.71.67.66:28050] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aedqftzkuxsE_OhM9UJlPAAAAkU"]
[Tue Apr 21 20:15:59.633279 2026] [:error] [pid 4823:tid 4869] [client 98.71.67.66:33102] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aedqf_c8mke3PfHqsxH6LgAAAZA"]
[Tue Apr 21 20:16:00.398424 2026] [:error] [pid 54080:tid 54090] [client 98.71.67.66:10699] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aedqgIzEbQHHxtmWbaavPwAAAsg"]
[Tue Apr 21 20:16:01.185209 2026] [:error] [pid 4823:tid 4867] [client 98.71.67.66:35397] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aedqgfc8mke3PfHqsxH6MwAAAY4"]
[Tue Apr 21 20:16:01.948442 2026] [:error] [pid 4777:tid 4795] [client 98.71.67.66:53356] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "aedqgaxXur6bykKyLZSnEQAAAQc"]
[Tue Apr 21 20:16:02.747387 2026] [:error] [pid 53731:tid 53749] [client 98.71.67.66:34785] [client 98.71.67.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aedqgl2I9THUR-bRVGxVAwAAAg4"]
[Tue Apr 21 20:16:03.325273 2026] [:error] [pid 53731:tid 53750] [client 98.71.67.66:53364] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aedqg12I9THUR-bRVGxVCAAAAg8"]
[Tue Apr 21 20:16:03.974069 2026] [:error] [pid 54080:tid 54089] [client 98.71.67.66:34798] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aedqg4zEbQHHxtmWbaavQgAAAsc"]
[Tue Apr 21 20:16:05.225651 2026] [:error] [pid 54080:tid 54103] [client 98.71.67.66:28055] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aedqhYzEbQHHxtmWbaavQwAAAtU"]
[Tue Apr 21 20:16:05.786590 2026] [:error] [pid 54080:tid 54092] [client 98.71.67.66:53372] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aedqhYzEbQHHxtmWbaavRgAAAso"]
[Tue Apr 21 20:16:06.326088 2026] [:error] [pid 54080:tid 54085] [client 98.71.67.66:7633] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aedqhozEbQHHxtmWbaavRwAAAsM"]
[Tue Apr 21 20:16:07.059559 2026] [:error] [pid 53978:tid 53981] [client 98.71.67.66:35392] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aedqh51ivsR4hcOSQbYVSQAAAoE"]
[Tue Apr 21 20:16:07.689450 2026] [:error] [pid 35321:tid 35401] [client 98.71.67.66:28047] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aedqhzeHLhVUuu8cVXx8ZAAAAFE"]
[Tue Apr 21 20:16:08.269506 2026] [:error] [pid 35321:tid 35394] [client 98.71.67.66:53348] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aedqiDeHLhVUuu8cVXx8awAAAEo"]
[Tue Apr 21 20:16:09.120855 2026] [:error] [pid 53978:tid 53993] [client 98.71.67.66:50481] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aedqiZ1ivsR4hcOSQbYVTAAAAo0"]
[Tue Apr 21 20:16:09.921652 2026] [:error] [pid 35321:tid 35384] [client 98.71.67.66:7661] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aedqiTeHLhVUuu8cVXx8dwAAAEA"]
[Tue Apr 21 20:16:10.582790 2026] [:error] [pid 35321:tid 35388] [client 98.71.67.66:8087] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aedqijeHLhVUuu8cVXx8ewAAAEQ"]
[Tue Apr 21 20:16:11.455953 2026] [:error] [pid 53978:tid 53999] [client 98.71.67.66:35443] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aedqi51ivsR4hcOSQbYVWAAAApM"]
[Tue Apr 21 20:16:12.014334 2026] [:error] [pid 53978:tid 53987] [client 98.71.67.66:52085] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aedqjJ1ivsR4hcOSQbYVXgAAAoc"]
[Tue Apr 21 20:16:12.643866 2026] [:error] [pid 35321:tid 35386] [client 98.71.67.66:35415] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aedqjDeHLhVUuu8cVXx8fgAAAEI"]
[Tue Apr 21 20:16:13.268249 2026] [:error] [pid 35321:tid 35390] [client 98.71.67.66:34775] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aedqjTeHLhVUuu8cVXx8gwAAAEY"]
[Tue Apr 21 20:16:13.855150 2026] [:error] [pid 35321:tid 35406] [client 98.71.67.66:34793] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "aedqjTeHLhVUuu8cVXx8igAAAFY"]
[Tue Apr 21 20:16:14.513824 2026] [:error] [pid 35321:tid 35399] [client 98.71.67.66:52056] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dev.php"] [unique_id "aedqjjeHLhVUuu8cVXx8kAAAAE8"]
[Tue Apr 21 20:16:15.171131 2026] [:error] [pid 35321:tid 35388] [client 98.71.67.66:7672] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dev.php"] [unique_id "aedqjzeHLhVUuu8cVXx8mAAAAEQ"]
[Tue Apr 21 20:16:15.969356 2026] [:error] [pid 54080:tid 54085] [client 98.71.67.66:53331] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dev.php"] [unique_id "aedqj4zEbQHHxtmWbaavVwAAAsM"]
[Tue Apr 21 20:16:16.878818 2026] [:error] [pid 53978:tid 53983] [client 98.71.67.66:7622] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dev.php"] [unique_id "aedqkJ1ivsR4hcOSQbYVaQAAAoM"]
[Tue Apr 21 20:16:17.530806 2026] [:error] [pid 53731:tid 53746] [client 98.71.67.66:52052] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "aedqkV2I9THUR-bRVGxVHAAAAgs"]
[Tue Apr 21 20:16:18.256046 2026] [:error] [pid 53731:tid 53760] [client 98.71.67.66:28094] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "aedqkl2I9THUR-bRVGxVHwAAAhg"]
[Tue Apr 21 20:16:19.034192 2026] [:error] [pid 35321:tid 35406] [client 98.71.67.66:34770] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "aedqkzeHLhVUuu8cVXx8qgAAAFY"]
[Tue Apr 21 20:16:19.997589 2026] [:error] [pid 35321:tid 35386] [client 98.71.67.66:8118] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "aedqkzeHLhVUuu8cVXx8sAAAAEI"]
[Tue Apr 21 20:16:20.752328 2026] [:error] [pid 53731:tid 53759] [client 98.71.67.66:7639] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "aedqlF2I9THUR-bRVGxVKAAAAhc"]
[Tue Apr 21 20:16:21.449662 2026] [:error] [pid 35321:tid 35391] [client 98.71.67.66:34758] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "aedqlTeHLhVUuu8cVXx8tAAAAEc"]
[Tue Apr 21 20:16:22.534841 2026] [:error] [pid 35320:tid 35337] [client 98.71.67.66:33095] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "aedqloJW6fdXWO6agMGqpwAAAAc"]
[Tue Apr 21 20:16:23.308200 2026] [:error] [pid 53978:tid 53997] [client 98.71.67.66:52081] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "aedql51ivsR4hcOSQbYVcAAAApE"]
[Tue Apr 21 20:16:24.054643 2026] [:error] [pid 35320:tid 35347] [client 98.71.67.66:53322] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "aedqmIJW6fdXWO6agMGqqgAAABE"]
[Tue Apr 21 20:16:24.849813 2026] [:error] [pid 53978:tid 53982] [client 98.71.67.66:7815] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "aedqmJ1ivsR4hcOSQbYVdwAAAoI"]
[Tue Apr 21 20:16:25.590479 2026] [:error] [pid 53978:tid 53998] [client 98.71.67.66:10705] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "aedqmZ1ivsR4hcOSQbYVegAAApI"]
[Tue Apr 21 20:16:26.239019 2026] [:error] [pid 35321:tid 35403] [client 98.71.67.66:28069] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "aedqmjeHLhVUuu8cVXx8vQAAAFM"]
[Tue Apr 21 20:16:27.136478 2026] [:error] [pid 35321:tid 35404] [client 98.71.67.66:52071] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "aedqmzeHLhVUuu8cVXx8wwAAAFQ"]
[Tue Apr 21 20:16:27.870976 2026] [:error] [pid 53731:tid 53754] [client 98.71.67.66:7656] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "aedqm12I9THUR-bRVGxVLwAAAhI"]
[Tue Apr 21 20:16:28.530879 2026] [:error] [pid 53731:tid 53738] [client 98.71.67.66:35406] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "aedqnF2I9THUR-bRVGxVMAAAAgM"]
[Tue Apr 21 20:16:29.228037 2026] [:error] [pid 53832:tid 53843] [client 98.71.67.66:36675] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "aedqndzkuxsE_OhM9UJlQgAAAkg"]
[Tue Apr 21 20:16:29.929136 2026] [:error] [pid 35320:tid 35332] [client 98.71.67.66:53362] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "aedqnYJW6fdXWO6agMGqswAAAAI"]
[Tue Apr 21 20:16:30.615553 2026] [:error] [pid 35415:tid 35441] [client 98.71.67.66:36721] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "aedqnkiqDinI4_22zzhxNQAAAM4"]
[Tue Apr 21 20:16:31.295941 2026] [:error] [pid 35322:tid 35365] [client 98.71.67.66:7659] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "aedqn6PoAfV40BTfVKzZ8wAAAIg"]
[Tue Apr 21 20:16:31.925573 2026] [:error] [pid 35321:tid 35396] [client 98.71.67.66:7675] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "aedqnzeHLhVUuu8cVXx81QAAAEw"]
[Tue Apr 21 20:16:32.575671 2026] [:error] [pid 35320:tid 35330] [client 98.71.67.66:7616] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aedqoIJW6fdXWO6agMGqwAAAAAA"]
[Tue Apr 21 20:16:33.285146 2026] [:error] [pid 35321:tid 35404] [client 98.71.67.66:53366] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aedqoTeHLhVUuu8cVXx82AAAAFQ"]
[Tue Apr 21 20:16:33.995201 2026] [:error] [pid 35321:tid 35402] [client 98.71.67.66:7249] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aedqoTeHLhVUuu8cVXx82wAAAFI"]
[Tue Apr 21 20:16:34.695514 2026] [:error] [pid 35321:tid 35391] [client 98.71.67.66:34792] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aedqojeHLhVUuu8cVXx84QAAAEc"]
[Tue Apr 21 20:16:35.398340 2026] [:error] [pid 53978:tid 53996] [client 98.71.67.66:34809] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "aedqo51ivsR4hcOSQbYVgQAAApA"]
[Tue Apr 21 20:16:36.328683 2026] [:error] [pid 35320:tid 35348] [client 98.71.67.66:36730] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "aedqpIJW6fdXWO6agMGqygAAABI"]
[Tue Apr 21 20:16:37.007905 2026] [:error] [pid 53978:tid 53994] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Tue Apr 21 20:16:37.266731 2026] [:error] [pid 53978:tid 53997] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Tue Apr 21 20:16:37.524701 2026] [:error] [pid 53978:tid 53989] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Apr 21 20:16:37.779564 2026] [:error] [pid 53978:tid 53988] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Tue Apr 21 20:16:38.039605 2026] [:error] [pid 53978:tid 54002] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Tue Apr 21 20:16:38.294107 2026] [:error] [pid 53978:tid 53980] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Apr 21 20:16:38.811147 2026] [:error] [pid 53978:tid 53985] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 21 20:16:39.066871 2026] [:error] [pid 53978:tid 54003] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Tue Apr 21 20:16:40.488697 2026] [:error] [pid 53978:tid 54003] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Tue Apr 21 20:16:40.803607 2026] [:error] [pid 53978:tid 54001] [client 98.71.67.66:8111] File does not exist: /usr/local/apache/htdocs/suspended-page/hypo.php
[Tue Apr 21 20:16:41.053882 2026] [:error] [pid 53978:tid 53993] [client 98.71.67.66:8111] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file18.php"] [unique_id "aedqqZ1ivsR4hcOSQbYVlQAAAo0"]
[Tue Apr 21 20:16:41.659092 2026] [:error] [pid 4823:tid 4858] [client 98.71.67.66:35423] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file18.php"] [unique_id "aedqqfc8mke3PfHqsxH6QgAAAYU"]
[Tue Apr 21 20:16:42.331199 2026] [:error] [pid 4823:tid 4853] [client 98.71.67.66:28091] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file18.php"] [unique_id "aedqqvc8mke3PfHqsxH6RQAAAYA"]
[Tue Apr 21 20:16:43.160059 2026] [:error] [pid 54080:tid 54088] [client 98.71.67.66:35421] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file18.php"] [unique_id "aedqq4zEbQHHxtmWbaavZgAAAsY"]
[Tue Apr 21 20:16:43.934668 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:7859] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aedqqzeHLhVUuu8cVXx88AAAAEE"]
[Tue Apr 21 20:16:45.056690 2026] [:error] [pid 35321:tid 35397] [client 98.71.67.66:36724] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aedqrTeHLhVUuu8cVXx89wAAAE0"]
[Tue Apr 21 20:16:45.880171 2026] [:error] [pid 35321:tid 35385] [client 98.71.67.66:7818] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aedqrTeHLhVUuu8cVXx9AAAAAEE"]
[Tue Apr 21 20:16:46.510456 2026] [:error] [pid 35321:tid 35398] [client 98.71.67.66:35401] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aedqrjeHLhVUuu8cVXx9BQAAAE4"]
[Tue Apr 21 20:16:47.320760 2026] [:error] [pid 35321:tid 35393] [client 98.71.67.66:7669] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aedqrzeHLhVUuu8cVXx9EAAAAEk"]
[Tue Apr 21 20:16:48.042113 2026] [:error] [pid 35321:tid 35386] [client 98.71.67.66:28057] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aedqsDeHLhVUuu8cVXx9GAAAAEI"]
[Tue Apr 21 20:16:48.860653 2026] [:error] [pid 54080:tid 54100] [client 98.71.67.66:28073] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aedqsIzEbQHHxtmWbaavZwAAAtI"]
[Tue Apr 21 20:16:49.387819 2026] [:error] [pid 35320:tid 35347] [client 98.71.67.66:14850] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aedqsYJW6fdXWO6agMGq3gAAABE"]
[Tue Apr 21 20:16:50.166691 2026] [:error] [pid 35320:tid 35348] [client 98.71.67.66:7821] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "aedqsoJW6fdXWO6agMGq4gAAABI"]
[Tue Apr 21 20:16:50.904838 2026] [:error] [pid 53731:tid 53746] [client 98.71.67.66:8093] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "aedqsl2I9THUR-bRVGxVUAAAAgs"]
[Tue Apr 21 20:16:51.869419 2026] [:error] [pid 35321:tid 35399] [client 98.71.67.66:34755] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "aedqszeHLhVUuu8cVXx9IwAAAE8"]
[Tue Apr 21 20:16:52.594386 2026] [:error] [pid 35321:tid 35393] [client 98.71.67.66:53334] [client 98.71.67.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "aedqtDeHLhVUuu8cVXx9KAAAAEk"]
[Tue Apr 21 20:47:21.033900 2026] [:error] [pid 53978:tid 53994] [client 178.62.200.186:59937] [client 178.62.200.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.62.200.186, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aedx2Z1ivsR4hcOSQbYe8wAAAo4"]
[Tue Apr 21 20:47:21.037364 2026] [:error] [pid 53978:tid 53994] [client 178.62.200.186:59937] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 21 21:13:44.650606 2026] [:error] [pid 35320:tid 35342] [client 35.184.142.175:63700] [client 35.184.142.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.184.142.175, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aed4CIJW6fdXWO6agMHJkAAAAAw"]
[Tue Apr 21 21:13:44.653962 2026] [:error] [pid 35320:tid 35342] [client 35.184.142.175:63700] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 21 21:13:44.871515 2026] [:error] [pid 35320:tid 35352] [client 35.184.142.175:63700] [client 35.184.142.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.184.142.175, counter = 6"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aed4CIJW6fdXWO6agMHJlwAAABY"]
[Tue Apr 21 21:13:47.353889 2026] [:error] [pid 53731:tid 53738] [client 35.184.142.175:55960] [client 35.184.142.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.184.142.175, counter = 6"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "aed4C12I9THUR-bRVGxrsgAAAgM"]
[Tue Apr 21 22:53:34.861649 2026] [:error] [pid 35321:tid 35391] [client 34.9.16.187:59414] [client 34.9.16.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.9.16.187, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aeePbjeHLhVUuu8cVXz7vwAAAEc"]
[Tue Apr 21 22:53:34.864248 2026] [:error] [pid 35321:tid 35391] [client 34.9.16.187:59414] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 21 22:53:35.324192 2026] [:error] [pid 35321:tid 35397] [client 34.9.16.187:59414] [client 34.9.16.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "aeePbzeHLhVUuu8cVXz7yQAAAE0"]
[Wed Apr 22 01:00:24.347482 2026] [:error] [pid 54080:tid 54096] [client 15.235.186.61:54064] [client 15.235.186.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.186.61, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aeetKIzEbQHHxtmWbab0zwAAAs4"]
[Wed Apr 22 01:00:24.351057 2026] [:error] [pid 54080:tid 54096] [client 15.235.186.61:54064] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Apr 22 01:00:25.343089 2026] [:error] [pid 53731:tid 53740] [client 15.235.186.61:54078] [client 15.235.186.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.186.61, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aeetKV2I9THUR-bRVGzHBAAAAgU"]
[Wed Apr 22 01:00:25.346939 2026] [:error] [pid 53731:tid 53740] [client 15.235.186.61:54078] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Apr 22 01:00:42.115557 2026] [:error] [pid 35321:tid 35401] [client 103.179.188.213:51780] [client 103.179.188.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.179.188.213, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "aeetOjeHLhVUuu8cVXw_aAAAAFE"]
[Wed Apr 22 01:00:42.119799 2026] [:error] [pid 35321:tid 35401] [client 103.179.188.213:51780] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Apr 22 01:00:42.590157 2026] [:error] [pid 35320:tid 35351] [client 103.179.188.213:51908] [client 103.179.188.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.179.188.213, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "aeetOoJW6fdXWO6agMFipwAAABU"]
[Wed Apr 22 01:00:42.593491 2026] [:error] [pid 35320:tid 35351] [client 103.179.188.213:51908] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 23 03:02:50.042693 2026] [:error] [pid 6344:tid 6371] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/aboutc.php
[Thu Apr 23 03:02:50.340663 2026] [:error] [pid 6344:tid 6350] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Thu Apr 23 03:02:50.678196 2026] [:error] [pid 6344:tid 6361] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/hroxw.php
[Thu Apr 23 03:02:50.946403 2026] [:error] [pid 6344:tid 6352] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Thu Apr 23 03:02:51.216042 2026] [:error] [pid 6344:tid 6366] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/set.php
[Thu Apr 23 03:02:51.482791 2026] [:error] [pid 6344:tid 6360] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Thu Apr 23 03:02:52.015672 2026] [:error] [pid 6344:tid 6355] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Thu Apr 23 03:02:52.283714 2026] [:error] [pid 6344:tid 6349] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Thu Apr 23 03:02:52.549942 2026] [:error] [pid 6344:tid 6358] [client 74.241.244.158:22040] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Thu Apr 23 03:02:52.812623 2026] [:error] [pid 6344:tid 6351] [client 74.241.244.158:22040] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "aekbXEDOTF-pkQnDeUlQggAAAAI"]
[Thu Apr 23 03:02:53.573659 2026] [:error] [pid 6250:tid 6257] [client 74.241.244.158:21961] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "aekbXQ-iZeQkqmQVfj5WfQAAAEM"]
[Thu Apr 23 03:02:54.445841 2026] [:error] [pid 6384:tid 6404] [client 74.241.244.158:22052] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "aekbXj58M3t15ICeWHXukwAAANE"]
[Thu Apr 23 03:02:55.057564 2026] [:error] [pid 6252:tid 6314] [client 74.241.244.158:21973] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "aekbX-tGYuiYb1nWBpSM-AAAAQI"]
[Thu Apr 23 03:02:56.328837 2026] [:error] [pid 9085:tid 9087] [client 74.241.244.158:22055] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "aekbYN-_-or9vQnlWnpaagAAAUA"]
[Thu Apr 23 03:02:57.312000 2026] [:error] [pid 23776:tid 23783] [client 74.241.244.158:22078] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "aekbYbRExf-1pAbSeJt0bQAAAYU"]
[Thu Apr 23 03:02:58.329420 2026] [:error] [pid 6250:tid 6267] [client 74.241.244.158:22060] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "aekbYg-iZeQkqmQVfj5WfwAAAE0"]
[Thu Apr 23 03:02:59.732445 2026] [:error] [pid 6252:tid 6326] [client 74.241.244.158:22000] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/term.php"] [unique_id "aekbY-tGYuiYb1nWBpSM_gAAAQ4"]
[Thu Apr 23 03:03:00.624292 2026] [:error] [pid 6252:tid 6336] [client 74.241.244.158:21976] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aekbZOtGYuiYb1nWBpSNAAAAARg"]
[Thu Apr 23 03:03:01.930596 2026] [:error] [pid 6250:tid 6264] [client 74.241.244.158:21987] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aekbZQ-iZeQkqmQVfj5WgwAAAEo"]
[Thu Apr 23 03:03:02.636512 2026] [:error] [pid 9085:tid 9098] [client 74.241.244.158:22024] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aekbZt-_-or9vQnlWnpabAAAAUs"]
[Thu Apr 23 03:03:03.463052 2026] [:error] [pid 6252:tid 6324] [client 74.241.244.158:22073] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aekbZ-tGYuiYb1nWBpSNBgAAAQw"]
[Thu Apr 23 03:03:04.086088 2026] [:error] [pid 9085:tid 9089] [client 74.241.244.158:22046] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "aekbaN-_-or9vQnlWnpabgAAAUI"]
[Thu Apr 23 03:03:04.904725 2026] [:error] [pid 6250:tid 6266] [client 74.241.244.158:22049] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "aekbaA-iZeQkqmQVfj5WjgAAAEw"]
[Thu Apr 23 03:03:05.741848 2026] [:error] [pid 6384:tid 6398] [client 74.241.244.158:22025] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "aekbaT58M3t15ICeWHXumgAAAMs"]
[Thu Apr 23 03:03:06.801911 2026] [:error] [pid 6344:tid 6364] [client 74.241.244.158:21957] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tt.php"] [unique_id "aekbakDOTF-pkQnDeUlQhAAAAA8"]
[Thu Apr 23 03:03:07.473747 2026] [:error] [pid 6251:tid 6308] [client 74.241.244.158:22047] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aekbaysFAzbyObL-SQ60KgAAAJc"]
[Thu Apr 23 03:03:08.234618 2026] [:error] [pid 6344:tid 6369] [client 74.241.244.158:21967] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aekbbEDOTF-pkQnDeUlQhgAAABQ"]
[Thu Apr 23 03:03:08.873898 2026] [:error] [pid 6384:tid 6397] [client 74.241.244.158:22030] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aekbbD58M3t15ICeWHXunQAAAMo"]
[Thu Apr 23 03:03:09.555946 2026] [:error] [pid 6384:tid 6407] [client 74.241.244.158:22041] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "aekbbT58M3t15ICeWHXunwAAANQ"]
[Thu Apr 23 03:03:10.872966 2026] [:error] [pid 6344:tid 6370] [client 74.241.244.158:22023] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "aekbbkDOTF-pkQnDeUlQiQAAABU"]
[Thu Apr 23 03:03:11.683611 2026] [:error] [pid 6384:tid 6392] [client 74.241.244.158:22022] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "aekbbz58M3t15ICeWHXurQAAAMU"]
[Thu Apr 23 03:03:12.590888 2026] [:error] [pid 6252:tid 6313] [client 74.241.244.158:22063] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "aekbcOtGYuiYb1nWBpSNCAAAAQE"]
[Thu Apr 23 03:03:13.128555 2026] [:error] [pid 6384:tid 6404] [client 74.241.244.158:21975] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/66.php"] [unique_id "aekbcT58M3t15ICeWHXuuQAAANE"]
[Thu Apr 23 03:03:13.793151 2026] [:error] [pid 6250:tid 6257] [client 74.241.244.158:21958] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aekbcQ-iZeQkqmQVfj5WkwAAAEM"]
[Thu Apr 23 03:03:15.180758 2026] [:error] [pid 9085:tid 9093] [client 74.241.244.158:21965] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aekbc9-_-or9vQnlWnpadAAAAUY"]
[Thu Apr 23 03:03:16.197610 2026] [:error] [pid 6384:tid 6411] [client 74.241.244.158:21964] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aekbdD58M3t15ICeWHXuwgAAANg"]
[Thu Apr 23 03:03:17.089863 2026] [:error] [pid 6384:tid 6394] [client 74.241.244.158:22069] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "aekbdT58M3t15ICeWHXuwwAAAMc"]
[Thu Apr 23 03:03:17.703045 2026] [:error] [pid 9085:tid 9104] [client 74.241.244.158:21953] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "aekbdd-_-or9vQnlWnpadwAAAVE"]
[Thu Apr 23 03:03:18.364092 2026] [:error] [pid 6384:tid 6396] [client 74.241.244.158:22029] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "aekbdj58M3t15ICeWHXuxwAAAMk"]
[Thu Apr 23 03:03:19.198694 2026] [:error] [pid 6384:tid 6410] [client 74.241.244.158:21952] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "aekbdz58M3t15ICeWHXuyAAAANc"]
[Thu Apr 23 03:03:20.163575 2026] [:error] [pid 6252:tid 6328] [client 74.241.244.158:8142] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jga.php"] [unique_id "aekbeOtGYuiYb1nWBpSNCQAAARA"]
[Thu Apr 23 03:03:21.040440 2026] [:error] [pid 6384:tid 6404] [client 74.241.244.158:21968] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "aekbeT58M3t15ICeWHXuygAAANE"]
[Thu Apr 23 03:03:21.672165 2026] [:error] [pid 23776:tid 23794] [client 74.241.244.158:21977] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "aekbebRExf-1pAbSeJt0gAAAAZA"]
[Thu Apr 23 03:03:22.353386 2026] [:error] [pid 6344:tid 6351] [client 74.241.244.158:21993] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "aekbekDOTF-pkQnDeUlQkgAAAAI"]
[Thu Apr 23 03:03:22.990575 2026] [:error] [pid 9085:tid 9107] [client 74.241.244.158:22019] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog-header.php"] [unique_id "aekbet-_-or9vQnlWnpaegAAAVQ"]
[Thu Apr 23 03:03:23.672632 2026] [:error] [pid 6250:tid 6261] [client 74.241.244.158:22036] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bmi.php"] [unique_id "aekbew-iZeQkqmQVfj5WlQAAAEc"]
[Thu Apr 23 03:03:24.740759 2026] [:error] [pid 9085:tid 9089] [client 74.241.244.158:22045] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bmi.php"] [unique_id "aekbfN-_-or9vQnlWnpafQAAAUI"]
[Thu Apr 23 03:03:25.414638 2026] [:error] [pid 6384:tid 6390] [client 74.241.244.158:22034] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bmi.php"] [unique_id "aekbfT58M3t15ICeWHXuzgAAAMM"]
[Thu Apr 23 03:03:26.554191 2026] [:error] [pid 6252:tid 6323] [client 74.241.244.158:22074] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bmi.php"] [unique_id "aekbfutGYuiYb1nWBpSNCgAAAQs"]
[Thu Apr 23 03:03:28.322122 2026] [:error] [pid 6384:tid 6395] [client 74.241.244.158:22068] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aekbgD58M3t15ICeWHXu0wAAAMg"]
[Thu Apr 23 03:03:30.030986 2026] [:error] [pid 23776:tid 23784] [client 74.241.244.158:22033] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aekbgrRExf-1pAbSeJt0hAAAAYY"]
[Thu Apr 23 03:03:30.768993 2026] [:error] [pid 6344:tid 6365] [client 74.241.244.158:22071] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aekbgkDOTF-pkQnDeUlQlwAAABA"]
[Thu Apr 23 03:03:31.812035 2026] [:error] [pid 23776:tid 23786] [client 74.241.244.158:8140] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aekbg7RExf-1pAbSeJt0hgAAAYg"]
[Thu Apr 23 03:03:33.137699 2026] [:error] [pid 23776:tid 23788] [client 74.241.244.158:22066] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "aekbhbRExf-1pAbSeJt0hwAAAYo"]
[Thu Apr 23 03:03:34.205595 2026] [:error] [pid 9085:tid 9097] [client 74.241.244.158:21962] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "aekbht-_-or9vQnlWnpafwAAAUo"]
[Thu Apr 23 03:03:35.334382 2026] [:error] [pid 6344:tid 6352] [client 74.241.244.158:8168] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "aekbh0DOTF-pkQnDeUlQnAAAAAM"]
[Thu Apr 23 03:03:37.612370 2026] [:error] [pid 9085:tid 9101] [client 74.241.244.158:22079] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/radio.php"] [unique_id "aekbid-_-or9vQnlWnpagQAAAU4"]
[Thu Apr 23 03:03:38.526144 2026] [:error] [pid 6384:tid 6409] [client 74.241.244.158:22053] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aekbij58M3t15ICeWHXu2AAAANY"]
[Thu Apr 23 03:03:39.172936 2026] [:error] [pid 6384:tid 6404] [client 74.241.244.158:21956] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aekbiz58M3t15ICeWHXu2gAAANE"]
[Thu Apr 23 03:03:39.934833 2026] [:error] [pid 6384:tid 6403] [client 74.241.244.158:22020] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aekbiz58M3t15ICeWHXu2wAAANA"]
[Thu Apr 23 03:03:40.693357 2026] [:error] [pid 9085:tid 9087] [client 74.241.244.158:22050] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-png.php"] [unique_id "aekbjN-_-or9vQnlWnpahgAAAUA"]
[Thu Apr 23 03:03:41.909349 2026] [:error] [pid 6384:tid 6390] [client 74.241.244.158:22037] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "aekbjT58M3t15ICeWHXu3QAAAMM"]
[Thu Apr 23 03:03:42.575036 2026] [:error] [pid 9085:tid 9089] [client 74.241.244.158:8163] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "aekbjt-_-or9vQnlWnpaiAAAAUI"]
[Thu Apr 23 03:03:43.373338 2026] [:error] [pid 9085:tid 9099] [client 74.241.244.158:8169] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "aekbj9-_-or9vQnlWnpaiQAAAUw"]
[Thu Apr 23 03:03:43.980104 2026] [:error] [pid 6250:tid 6260] [client 74.241.244.158:21981] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wen.php"] [unique_id "aekbjw-iZeQkqmQVfj5WnAAAAEY"]
[Thu Apr 23 03:03:45.366938 2026] [:error] [pid 9085:tid 9094] [client 74.241.244.158:21972] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugin-install.php"] [unique_id "aekbkd-_-or9vQnlWnpajAAAAUc"]
[Thu Apr 23 03:03:46.587752 2026] [:error] [pid 6384:tid 6411] [client 74.241.244.158:21960] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugin-install.php"] [unique_id "aekbkj58M3t15ICeWHXu4AAAANg"]
[Thu Apr 23 03:03:47.910175 2026] [:error] [pid 6384:tid 6408] [client 74.241.244.158:21986] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugin-install.php"] [unique_id "aekbkz58M3t15ICeWHXu4gAAANU"]
[Thu Apr 23 03:03:48.816828 2026] [:error] [pid 6250:tid 6265] [client 74.241.244.158:22075] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugin-install.php"] [unique_id "aekblA-iZeQkqmQVfj5WngAAAEs"]
[Thu Apr 23 03:03:51.045094 2026] [:error] [pid 6384:tid 6403] [client 74.241.244.158:8134] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "aekblz58M3t15ICeWHXu5wAAANA"]
[Thu Apr 23 03:03:51.795185 2026] [:error] [pid 6384:tid 6400] [client 74.241.244.158:21982] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi001.PhP7"] [unique_id "aekblz58M3t15ICeWHXu6QAAAM0"]
[Thu Apr 23 03:03:53.274741 2026] [:error] [pid 6384:tid 6390] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Thu Apr 23 03:03:53.548604 2026] [:error] [pid 6384:tid 6401] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Thu Apr 23 03:03:53.906596 2026] [:error] [pid 6384:tid 6395] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Apr 23 03:03:54.174096 2026] [:error] [pid 6384:tid 6398] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Apr 23 03:03:54.710701 2026] [:error] [pid 6384:tid 6394] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/ws48.php
[Thu Apr 23 03:03:54.987134 2026] [:error] [pid 6384:tid 6387] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Thu Apr 23 03:03:55.254752 2026] [:error] [pid 6384:tid 6410] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Thu Apr 23 03:03:55.522572 2026] [:error] [pid 6384:tid 6400] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Thu Apr 23 03:03:55.790720 2026] [:error] [pid 6384:tid 6390] [client 74.241.244.158:22035] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Thu Apr 23 03:03:56.171389 2026] [:error] [pid 6384:tid 6399] [client 74.241.244.158:22035] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/eetu.php"] [unique_id "aekbnD58M3t15ICeWHXu_AAAAMw"]
[Thu Apr 23 03:03:56.999978 2026] [:error] [pid 6251:tid 6304] [client 74.241.244.158:22042] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/eetu.php"] [unique_id "aekbnCsFAzbyObL-SQ60PwAAAJM"]
[Thu Apr 23 03:03:57.822977 2026] [:error] [pid 6344:tid 6365] [client 74.241.244.158:22076] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/eetu.php"] [unique_id "aekbnUDOTF-pkQnDeUlQowAAABA"]
[Thu Apr 23 03:03:58.601173 2026] [:error] [pid 9085:tid 9096] [client 74.241.244.158:22056] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/eetu.php"] [unique_id "aekbnt-_-or9vQnlWnpajgAAAUk"]
[Thu Apr 23 03:03:59.311879 2026] [:error] [pid 9085:tid 9095] [client 74.241.244.158:8158] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aekbn9-_-or9vQnlWnpakAAAAUg"]
[Thu Apr 23 03:04:00.381849 2026] [:error] [pid 23776:tid 23785] [client 74.241.244.158:22054] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aekboLRExf-1pAbSeJt0kAAAAYc"]
[Thu Apr 23 03:04:01.140065 2026] [:error] [pid 6384:tid 6411] [client 74.241.244.158:8138] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aekboT58M3t15ICeWHXvAgAAANg"]
[Thu Apr 23 03:04:02.113310 2026] [:error] [pid 23776:tid 23793] [client 74.241.244.158:21966] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aekborRExf-1pAbSeJt0kQAAAY8"]
[Thu Apr 23 03:04:02.711004 2026] [:error] [pid 23776:tid 23789] [client 74.241.244.158:21994] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aekborRExf-1pAbSeJt0kwAAAYs"]
[Thu Apr 23 03:04:05.265165 2026] [:error] [pid 23776:tid 23781] [client 74.241.244.158:21963] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aekbpbRExf-1pAbSeJt0mAAAAYM"]
[Thu Apr 23 03:04:06.766031 2026] [:error] [pid 6384:tid 6404] [client 74.241.244.158:21985] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aekbpj58M3t15ICeWHXvCAAAANE"]
[Thu Apr 23 03:04:07.714583 2026] [:error] [pid 9085:tid 9111] [client 74.241.244.158:21983] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aekbp9-_-or9vQnlWnpamAAAAVg"]
[Thu Apr 23 03:04:09.768373 2026] [:error] [pid 9085:tid 9105] [client 74.241.244.158:8133] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "aekbqd-_-or9vQnlWnpanAAAAVI"]
[Thu Apr 23 03:04:10.815326 2026] [:error] [pid 23776:tid 23785] [client 74.241.244.158:21999] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "aekbqrRExf-1pAbSeJt0nAAAAYc"]
[Thu Apr 23 03:04:11.918802 2026] [:error] [pid 23776:tid 23800] [client 74.241.244.158:22014] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "aekbq7RExf-1pAbSeJt0nwAAAZY"]
[Thu Apr 23 03:04:13.916514 2026] [:error] [pid 9085:tid 9100] [client 74.241.244.158:22005] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/asd.php"] [unique_id "aekbrd-_-or9vQnlWnpapgAAAU0"]
[Thu Apr 23 03:04:15.549108 2026] [:error] [pid 23776:tid 23788] [client 74.241.244.158:22044] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xx.php"] [unique_id "aekbr7RExf-1pAbSeJt0ogAAAYo"]
[Thu Apr 23 03:04:18.275038 2026] [:error] [pid 9085:tid 9094] [client 74.241.244.158:22051] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xx.php"] [unique_id "aekbst-_-or9vQnlWnparQAAAUc"]
[Thu Apr 23 03:04:20.376374 2026] [:error] [pid 6384:tid 6394] [client 74.241.244.158:22006] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xx.php"] [unique_id "aekbtD58M3t15ICeWHXvEgAAAMc"]
[Thu Apr 23 03:04:22.150461 2026] [:error] [pid 6252:tid 6325] [client 74.241.244.158:21955] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xx.php"] [unique_id "aekbtutGYuiYb1nWBpSNDwAAAQ0"]
[Thu Apr 23 03:04:22.892015 2026] [:error] [pid 6250:tid 6259] [client 74.241.244.158:21954] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aekbtg-iZeQkqmQVfj5WogAAAEU"]
[Thu Apr 23 03:04:23.613134 2026] [:error] [pid 9085:tid 9106] [client 74.241.244.158:22012] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aekbt9-_-or9vQnlWnpasQAAAVM"]
[Thu Apr 23 03:04:24.365856 2026] [:error] [pid 6344:tid 6358] [client 74.241.244.158:22001] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aekbuEDOTF-pkQnDeUlQrAAAAAk"]
[Thu Apr 23 03:04:25.783512 2026] [:error] [pid 6384:tid 6400] [client 74.241.244.158:21980] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "aekbuT58M3t15ICeWHXvGQAAAM0"]
[Thu Apr 23 03:04:26.771469 2026] [:error] [pid 6384:tid 6409] [client 74.241.244.158:8098] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "aekbuj58M3t15ICeWHXvGwAAANY"]
[Thu Apr 23 03:04:27.808491 2026] [:error] [pid 9085:tid 9109] [client 74.241.244.158:21992] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "aekbu9-_-or9vQnlWnpatAAAAVY"]
[Thu Apr 23 03:04:28.637293 2026] [:error] [pid 6251:tid 6293] [client 74.241.244.158:22017] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "aekbvCsFAzbyObL-SQ60SAAAAIg"]
[Thu Apr 23 03:04:29.294944 2026] [:error] [pid 6250:tid 6278] [client 74.241.244.158:22031] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "aekbvQ-iZeQkqmQVfj5WpgAAAFg"]
[Thu Apr 23 03:04:30.458591 2026] [:error] [pid 23776:tid 23793] [client 74.241.244.158:8084] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aekbvrRExf-1pAbSeJt0qgAAAY8"]
[Thu Apr 23 03:04:31.576866 2026] [:error] [pid 9085:tid 9097] [client 74.241.244.158:21959] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aekbv9-_-or9vQnlWnpauAAAAUo"]
[Thu Apr 23 03:04:32.292733 2026] [:error] [pid 23776:tid 23799] [client 74.241.244.158:8151] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aekbwLRExf-1pAbSeJt0qwAAAZU"]
[Thu Apr 23 03:04:33.456421 2026] [:error] [pid 6384:tid 6392] [client 74.241.244.158:22026] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amax.php"] [unique_id "aekbwT58M3t15ICeWHXvHgAAAMU"]
[Thu Apr 23 03:04:35.350328 2026] [:error] [pid 23776:tid 23790] [client 74.241.244.158:21978] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aekbw7RExf-1pAbSeJt0rwAAAYw"]
[Thu Apr 23 03:04:36.497931 2026] [:error] [pid 6384:tid 6395] [client 74.241.244.158:22072] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aekbxD58M3t15ICeWHXvHwAAAMg"]
[Thu Apr 23 03:04:37.291747 2026] [:error] [pid 6251:tid 6309] [client 74.241.244.158:22058] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aekbxSsFAzbyObL-SQ60SQAAAJg"]
[Thu Apr 23 03:04:38.646568 2026] [:error] [pid 9085:tid 9095] [client 74.241.244.158:22021] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aekbxt-_-or9vQnlWnpawAAAAUg"]
[Thu Apr 23 03:04:39.323658 2026] [:error] [pid 9085:tid 9105] [client 74.241.244.158:8166] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Jcrop.php"] [unique_id "aekbx9-_-or9vQnlWnpawwAAAVI"]
[Thu Apr 23 03:04:40.064211 2026] [:error] [pid 6251:tid 6304] [client 74.241.244.158:22028] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Jcrop.php"] [unique_id "aekbyCsFAzbyObL-SQ60SgAAAJM"]
[Thu Apr 23 03:04:41.520421 2026] [:error] [pid 6252:tid 6315] [client 74.241.244.158:8159] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Jcrop.php"] [unique_id "aekbyetGYuiYb1nWBpSNFQAAAQM"]
[Thu Apr 23 03:04:43.400757 2026] [:error] [pid 6344:tid 6351] [client 74.241.244.158:22002] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Jcrop.php"] [unique_id "aekby0DOTF-pkQnDeUlQtgAAAAI"]
[Thu Apr 23 03:04:44.290987 2026] [:error] [pid 6384:tid 6397] [client 74.241.244.158:8179] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "aekbzD58M3t15ICeWHXvIgAAAMo"]
[Thu Apr 23 03:04:44.890335 2026] [:error] [pid 23776:tid 23796] [client 74.241.244.158:8078] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "aekbzLRExf-1pAbSeJt0tAAAAZI"]
[Thu Apr 23 03:04:45.557746 2026] [:error] [pid 6252:tid 6312] [client 74.241.244.158:8139] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "aekbzetGYuiYb1nWBpSNGQAAAQA"]
[Thu Apr 23 03:04:46.266121 2026] [:error] [pid 6251:tid 6296] [client 74.241.244.158:8176] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/abc.php"] [unique_id "aekbzisFAzbyObL-SQ60TQAAAIs"]
[Thu Apr 23 03:04:46.915528 2026] [:error] [pid 23776:tid 23785] [client 74.241.244.158:8172] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aekbzrRExf-1pAbSeJt0tgAAAYc"]
[Thu Apr 23 03:04:47.868805 2026] [:error] [pid 23776:tid 23800] [client 74.241.244.158:21979] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aekbz7RExf-1pAbSeJt0uAAAAZY"]
[Thu Apr 23 03:04:48.972608 2026] [:error] [pid 9085:tid 9100] [client 74.241.244.158:8155] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aekb0N-_-or9vQnlWnpazAAAAU0"]
[Thu Apr 23 03:04:49.889146 2026] [:error] [pid 23776:tid 23793] [client 74.241.244.158:8167] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "aekb0bRExf-1pAbSeJt0uwAAAY8"]
[Thu Apr 23 03:04:50.481032 2026] [:error] [pid 23776:tid 23786] [client 74.241.244.158:8136] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "aekb0rRExf-1pAbSeJt0vgAAAYg"]
[Thu Apr 23 03:04:51.397536 2026] [:error] [pid 9085:tid 9091] [client 74.241.244.158:8153] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "aekb09-_-or9vQnlWnpazwAAAUQ"]
[Thu Apr 23 03:04:52.397704 2026] [:error] [pid 6250:tid 6270] [client 74.241.244.158:22062] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "aekb1A-iZeQkqmQVfj5WqwAAAFA"]
[Thu Apr 23 03:04:53.114785 2026] [:error] [pid 6250:tid 6263] [client 74.241.244.158:8069] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bnm.php"] [unique_id "aekb1Q-iZeQkqmQVfj5WrAAAAEk"]
[Thu Apr 23 03:04:54.541412 2026] [:error] [pid 23776:tid 23790] [client 74.241.244.158:8154] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aekb1rRExf-1pAbSeJt0wQAAAYw"]
[Thu Apr 23 03:04:55.398060 2026] [:error] [pid 23776:tid 23802] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Thu Apr 23 03:04:55.961878 2026] [:error] [pid 23776:tid 23798] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Thu Apr 23 03:04:56.224931 2026] [:error] [pid 23776:tid 23785] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/tymn.php
[Thu Apr 23 03:04:56.504734 2026] [:error] [pid 23776:tid 23782] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Apr 23 03:04:56.897859 2026] [:error] [pid 23776:tid 23801] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Thu Apr 23 03:04:57.164138 2026] [:error] [pid 23776:tid 23789] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Thu Apr 23 03:04:57.430055 2026] [:error] [pid 23776:tid 23799] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Thu Apr 23 03:04:57.711591 2026] [:error] [pid 23776:tid 23797] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class-atom.php
[Thu Apr 23 03:04:57.994652 2026] [:error] [pid 23776:tid 23780] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu Apr 23 03:04:58.286586 2026] [:error] [pid 23776:tid 23779] [client 74.241.244.158:22061] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Thu Apr 23 03:04:58.576440 2026] [:error] [pid 23776:tid 23783] [client 74.241.244.158:22061] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/900.php"] [unique_id "aekb2rRExf-1pAbSeJt00AAAAYU"]
[Thu Apr 23 03:05:00.849211 2026] [:error] [pid 23776:tid 23781] [client 74.241.244.158:8171] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/900.php"] [unique_id "aekb3LRExf-1pAbSeJt00gAAAYM"]
[Thu Apr 23 03:05:03.200693 2026] [:error] [pid 6251:tid 6288] [client 74.241.244.158:21970] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/900.php"] [unique_id "aekb3ysFAzbyObL-SQ60UAAAAIM"]
[Thu Apr 23 03:05:03.974139 2026] [:error] [pid 6344:tid 6367] [client 74.241.244.158:8083] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/900.php"] [unique_id "aekb30DOTF-pkQnDeUlQxwAAABI"]
[Thu Apr 23 03:05:04.944776 2026] [:error] [pid 6250:tid 6266] [client 74.241.244.158:22059] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aekb4A-iZeQkqmQVfj5WsAAAAEw"]
[Thu Apr 23 03:05:05.676954 2026] [:error] [pid 6250:tid 6261] [client 74.241.244.158:22018] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aekb4Q-iZeQkqmQVfj5WsgAAAEc"]
[Thu Apr 23 03:05:06.442999 2026] [:error] [pid 6344:tid 6363] [client 74.241.244.158:22038] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aekb4kDOTF-pkQnDeUlQyQAAAA4"]
[Thu Apr 23 03:05:07.256513 2026] [:error] [pid 6384:tid 6396] [client 74.241.244.158:21991] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "aekb4z58M3t15ICeWHXvJwAAAMk"]
[Thu Apr 23 03:05:08.628714 2026] [:error] [pid 6252:tid 6336] [client 74.241.244.158:22043] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jk.php"] [unique_id "aekb5OtGYuiYb1nWBpSNJwAAARg"]
[Thu Apr 23 03:05:09.806694 2026] [:error] [pid 9085:tid 9108] [client 74.241.244.158:21969] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jk.php"] [unique_id "aekb5d-_-or9vQnlWnpa1wAAAVU"]
[Thu Apr 23 03:05:10.629110 2026] [:error] [pid 23776:tid 23801] [client 74.241.244.158:8135] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jk.php"] [unique_id "aekb5rRExf-1pAbSeJt01gAAAZc"]
[Thu Apr 23 03:05:11.269311 2026] [:error] [pid 6250:tid 6260] [client 74.241.244.158:8005] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/jk.php"] [unique_id "aekb5w-iZeQkqmQVfj5WtQAAAEY"]
[Thu Apr 23 03:05:12.424683 2026] [:error] [pid 9085:tid 9106] [client 74.241.244.158:8130] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aekb6N-_-or9vQnlWnpa2wAAAVM"]
[Thu Apr 23 03:05:13.304840 2026] [:error] [pid 6384:tid 6402] [client 74.241.244.158:8170] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aekb6T58M3t15ICeWHXvKgAAAM8"]
[Thu Apr 23 03:05:14.041419 2026] [:error] [pid 6384:tid 6390] [client 74.241.244.158:22077] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aekb6j58M3t15ICeWHXvLAAAAMM"]
[Thu Apr 23 03:05:16.377686 2026] [:error] [pid 6251:tid 6295] [client 74.241.244.158:22057] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aekb7CsFAzbyObL-SQ60VAAAAIo"]
[Thu Apr 23 03:05:18.044614 2026] [:error] [pid 23776:tid 23787] [client 74.241.244.158:8129] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aekb7rRExf-1pAbSeJt02AAAAYk"]
[Thu Apr 23 03:05:19.420202 2026] [:error] [pid 23776:tid 23792] [client 74.241.244.158:8147] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aekb77RExf-1pAbSeJt02QAAAY4"]
[Thu Apr 23 03:05:21.141751 2026] [:error] [pid 6251:tid 6291] [client 74.241.244.158:8141] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aekb8SsFAzbyObL-SQ60VwAAAIY"]
[Thu Apr 23 03:05:23.031111 2026] [:error] [pid 9085:tid 9106] [client 74.241.244.158:8177] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aekb89-_-or9vQnlWnpa5QAAAVM"]
[Thu Apr 23 03:05:24.183728 2026] [:error] [pid 6344:tid 6360] [client 74.241.244.158:21974] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "aekb9EDOTF-pkQnDeUlQzAAAAAs"]
[Thu Apr 23 03:05:25.122482 2026] [:error] [pid 6251:tid 6309] [client 74.241.244.158:8065] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "aekb9SsFAzbyObL-SQ60WAAAAJg"]
[Thu Apr 23 03:05:25.866584 2026] [:error] [pid 9085:tid 9105] [client 74.241.244.158:8162] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "aekb9d-_-or9vQnlWnpa7AAAAVI"]
[Thu Apr 23 03:05:26.770554 2026] [:error] [pid 6251:tid 6308] [client 74.241.244.158:8121] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mini.php"] [unique_id "aekb9isFAzbyObL-SQ60WgAAAJc"]
[Thu Apr 23 03:05:27.586856 2026] [:error] [pid 6252:tid 6316] [client 74.241.244.158:8006] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "aekb9-tGYuiYb1nWBpSNLAAAAQQ"]
[Thu Apr 23 03:05:28.616344 2026] [:error] [pid 6252:tid 6327] [client 74.241.244.158:22015] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "aekb-OtGYuiYb1nWBpSNLQAAAQ8"]
[Thu Apr 23 03:05:29.655079 2026] [:error] [pid 6251:tid 6296] [client 74.241.244.158:21984] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "aekb-SsFAzbyObL-SQ60XAAAAIs"]
[Thu Apr 23 03:05:30.272698 2026] [:error] [pid 23776:tid 23802] [client 74.241.244.158:8145] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "aekb-rRExf-1pAbSeJt03wAAAZg"]
[Thu Apr 23 03:05:30.831106 2026] [:error] [pid 6252:tid 6317] [client 74.241.244.158:22032] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "aekb-utGYuiYb1nWBpSNMAAAAQU"]
[Thu Apr 23 03:05:31.730631 2026] [:error] [pid 23776:tid 23784] [client 74.241.244.158:8118] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "aekb-7RExf-1pAbSeJt04AAAAYY"]
[Thu Apr 23 03:05:32.444596 2026] [:error] [pid 23776:tid 23798] [client 74.241.244.158:22039] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "aekb_LRExf-1pAbSeJt04gAAAZQ"]
[Thu Apr 23 03:05:33.184682 2026] [:error] [pid 9085:tid 9098] [client 74.241.244.158:22064] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "aekb_d-_-or9vQnlWnpa7QAAAUs"]
[Thu Apr 23 03:05:33.849533 2026] [:error] [pid 6344:tid 6358] [client 74.241.244.158:8183] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "aekb_UDOTF-pkQnDeUlQzQAAAAk"]
[Thu Apr 23 03:05:34.721264 2026] [:error] [pid 6250:tid 6259] [client 74.241.244.158:8182] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "aekb_g-iZeQkqmQVfj5WywAAAEU"]
[Thu Apr 23 03:05:35.960824 2026] [:error] [pid 23776:tid 23787] [client 74.241.244.158:22010] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "aekb_7RExf-1pAbSeJt05gAAAYk"]
[Thu Apr 23 03:05:36.749121 2026] [:error] [pid 6344:tid 6356] [client 74.241.244.158:8127] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "aekcAEDOTF-pkQnDeUlQ0AAAAAc"]
[Thu Apr 23 03:05:37.376358 2026] [:error] [pid 23776:tid 23792] [client 74.241.244.158:21998] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "aekcAbRExf-1pAbSeJt05wAAAY4"]
[Thu Apr 23 03:05:38.123419 2026] [:error] [pid 23776:tid 23793] [client 74.241.244.158:8144] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "aekcArRExf-1pAbSeJt06QAAAY8"]
[Thu Apr 23 03:05:38.893556 2026] [:error] [pid 6344:tid 6365] [client 74.241.244.158:8156] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "aekcAkDOTF-pkQnDeUlQ0gAAABA"]
[Thu Apr 23 03:05:39.975451 2026] [:error] [pid 6384:tid 6392] [client 74.241.244.158:22067] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "aekcAz58M3t15ICeWHXvLgAAAMU"]
[Thu Apr 23 03:05:40.740423 2026] [:error] [pid 6384:tid 6398] [client 74.241.244.158:8180] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "aekcBD58M3t15ICeWHXvLwAAAMs"]
[Thu Apr 23 03:05:41.646043 2026] [:error] [pid 6252:tid 6335] [client 74.241.244.158:7955] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "aekcBetGYuiYb1nWBpSNMwAAARc"]
[Thu Apr 23 03:05:42.408164 2026] [:error] [pid 6252:tid 6330] [client 74.241.244.158:8035] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "aekcButGYuiYb1nWBpSNNQAAARI"]
[Thu Apr 23 03:05:43.200731 2026] [:error] [pid 6251:tid 6298] [client 74.241.244.158:22027] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws88.php"] [unique_id "aekcBysFAzbyObL-SQ60XgAAAI0"]
[Thu Apr 23 03:05:43.878204 2026] [:error] [pid 6251:tid 6299] [client 74.241.244.158:8164] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adoms.php"] [unique_id "aekcBysFAzbyObL-SQ60XwAAAI4"]
[Thu Apr 23 03:05:44.767321 2026] [:error] [pid 6344:tid 6357] [client 74.241.244.158:8103] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adoms.php"] [unique_id "aekcCEDOTF-pkQnDeUlQ1gAAAAg"]
[Thu Apr 23 03:05:45.833840 2026] [:error] [pid 23776:tid 23781] [client 74.241.244.158:8105] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adoms.php"] [unique_id "aekcCbRExf-1pAbSeJt07QAAAYM"]
[Thu Apr 23 03:05:46.730522 2026] [:error] [pid 6344:tid 6353] [client 74.241.244.158:8178] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adoms.php"] [unique_id "aekcCkDOTF-pkQnDeUlQ2gAAAAQ"]
[Thu Apr 23 03:05:47.936334 2026] [:error] [pid 23776:tid 23802] [client 74.241.244.158:8146] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugin-editor.php"] [unique_id "aekcC7RExf-1pAbSeJt07gAAAZg"]
[Thu Apr 23 03:05:48.851286 2026] [:error] [pid 6251:tid 6288] [client 74.241.244.158:21971] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugin-editor.php"] [unique_id "aekcDCsFAzbyObL-SQ60YQAAAIM"]
[Thu Apr 23 03:05:49.420320 2026] [:error] [pid 6252:tid 6326] [client 74.241.244.158:8184] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugin-editor.php"] [unique_id "aekcDetGYuiYb1nWBpSNPAAAAQ4"]
[Thu Apr 23 03:05:50.106765 2026] [:error] [pid 6344:tid 6366] [client 74.241.244.158:8143] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugin-editor.php"] [unique_id "aekcDkDOTF-pkQnDeUlQ3AAAABE"]
[Thu Apr 23 03:05:50.937544 2026] [:error] [pid 23776:tid 23798] [client 74.241.244.158:21995] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aekcDrRExf-1pAbSeJt08QAAAZQ"]
[Thu Apr 23 03:05:51.931866 2026] [:error] [pid 6252:tid 6328] [client 74.241.244.158:8073] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aekcD-tGYuiYb1nWBpSNQAAAARA"]
[Thu Apr 23 03:05:53.034833 2026] [:error] [pid 6344:tid 6356] [client 74.241.244.158:22007] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aekcEUDOTF-pkQnDeUlQ4QAAAAc"]
[Thu Apr 23 03:05:53.827138 2026] [:error] [pid 9085:tid 9091] [client 74.241.244.158:22003] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aekcEd-_-or9vQnlWnpa8wAAAUQ"]
[Thu Apr 23 03:05:54.420488 2026] [:error] [pid 6251:tid 6294] [client 74.241.244.158:8150] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/an.php"] [unique_id "aekcEisFAzbyObL-SQ60ZAAAAIk"]
[Thu Apr 23 03:05:55.318715 2026] [:error] [pid 23776:tid 23801] [client 74.241.244.158:8137] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/an.php"] [unique_id "aekcE7RExf-1pAbSeJt08wAAAZc"]
[Thu Apr 23 03:05:56.248637 2026] [:error] [pid 6250:tid 6267] [client 74.241.244.158:8074] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/an.php"] [unique_id "aekcFA-iZeQkqmQVfj5W0QAAAE0"]
[Thu Apr 23 03:05:56.999026 2026] [:error] [pid 9085:tid 9110] [client 74.241.244.158:22013] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/an.php"] [unique_id "aekcFN-_-or9vQnlWnpa9wAAAVc"]
[Thu Apr 23 03:05:57.879053 2026] [:error] [pid 6252:tid 6313] [client 74.241.244.158:21989] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t.php"] [unique_id "aekcFetGYuiYb1nWBpSNSAAAAQE"]
[Thu Apr 23 03:05:58.706913 2026] [:error] [pid 9085:tid 9093] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Thu Apr 23 03:05:59.278192 2026] [:error] [pid 9085:tid 9107] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Thu Apr 23 03:05:59.574396 2026] [:error] [pid 9085:tid 9101] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/gaza.php
[Thu Apr 23 03:05:59.860599 2026] [:error] [pid 9085:tid 9108] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Thu Apr 23 03:06:00.145982 2026] [:error] [pid 9085:tid 9106] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Thu Apr 23 03:06:00.456529 2026] [:error] [pid 9085:tid 9087] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Thu Apr 23 03:06:00.741317 2026] [:error] [pid 9085:tid 9099] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Apr 23 03:06:01.027201 2026] [:error] [pid 9085:tid 9100] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/yw5bi63u.php
[Thu Apr 23 03:06:01.344017 2026] [:error] [pid 9085:tid 9111] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Thu Apr 23 03:06:01.643213 2026] [:error] [pid 9085:tid 9091] [client 74.241.244.158:22070] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu Apr 23 03:06:01.935560 2026] [:error] [pid 9085:tid 9095] [client 74.241.244.158:22070] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aekcGd-_-or9vQnlWnpbBQAAAUg"]
[Thu Apr 23 03:06:03.347378 2026] [:error] [pid 6251:tid 6306] [client 74.241.244.158:8066] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aekcGysFAzbyObL-SQ60ZgAAAJU"]
[Thu Apr 23 03:06:04.095490 2026] [:error] [pid 6250:tid 6264] [client 74.241.244.158:8131] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aekcHA-iZeQkqmQVfj5W0wAAAEo"]
[Thu Apr 23 03:06:04.974341 2026] [:error] [pid 9085:tid 9094] [client 74.241.244.158:8106] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aekcHN-_-or9vQnlWnpbCgAAAUc"]
[Thu Apr 23 03:06:05.843973 2026] [:error] [pid 6384:tid 6411] [client 74.241.244.158:21988] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class-t.api.php"] [unique_id "aekcHT58M3t15ICeWHXvMQAAANg"]
[Thu Apr 23 03:06:06.615613 2026] [:error] [pid 6384:tid 6394] [client 74.241.244.158:8076] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class-t.api.php"] [unique_id "aekcHj58M3t15ICeWHXvMwAAAMc"]
[Thu Apr 23 03:06:07.978444 2026] [:error] [pid 6384:tid 6393] [client 74.241.244.158:8181] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class-t.api.php"] [unique_id "aekcHz58M3t15ICeWHXvNgAAAMY"]
[Thu Apr 23 03:06:09.315140 2026] [:error] [pid 6384:tid 6402] [client 74.241.244.158:8087] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class-t.api.php"] [unique_id "aekcIT58M3t15ICeWHXvPAAAAM8"]
[Thu Apr 23 03:06:10.686923 2026] [:error] [pid 6384:tid 6409] [client 74.241.244.158:8128] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "aekcIj58M3t15ICeWHXvPgAAANY"]
[Thu Apr 23 03:06:11.405533 2026] [:error] [pid 6344:tid 6370] [client 74.241.244.158:21990] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "aekcI0DOTF-pkQnDeUlQ7wAAABU"]
[Thu Apr 23 03:06:12.172754 2026] [:error] [pid 9085:tid 9087] [client 74.241.244.158:8165] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "aekcJN-_-or9vQnlWnpbDwAAAUA"]
[Thu Apr 23 03:06:13.106512 2026] [:error] [pid 9085:tid 9091] [client 74.241.244.158:22065] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mk.php"] [unique_id "aekcJd-_-or9vQnlWnpbEgAAAUQ"]
[Thu Apr 23 03:06:14.940903 2026] [:error] [pid 6252:tid 6319] [client 74.241.244.158:8067] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aekcJutGYuiYb1nWBpSNVAAAAQc"]
[Thu Apr 23 03:06:16.264088 2026] [:error] [pid 6384:tid 6409] [client 74.241.244.158:8186] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aekcKD58M3t15ICeWHXvQwAAANY"]
[Thu Apr 23 03:06:17.109785 2026] [:error] [pid 6384:tid 6390] [client 74.241.244.158:22048] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aekcKT58M3t15ICeWHXvRgAAAMM"]
[Thu Apr 23 03:06:18.427076 2026] [:error] [pid 6252:tid 6313] [client 74.241.244.158:8080] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "aekcKutGYuiYb1nWBpSNVwAAAQE"]
[Thu Apr 23 03:06:20.348614 2026] [:error] [pid 23776:tid 23783] [client 74.241.244.158:7963] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aekcLLRExf-1pAbSeJt0-AAAAYU"]
[Thu Apr 23 03:06:21.339196 2026] [:error] [pid 9085:tid 9109] [client 74.241.244.158:8173] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aekcLd-_-or9vQnlWnpbGwAAAVY"]
[Thu Apr 23 03:06:22.206122 2026] [:error] [pid 23776:tid 23790] [client 74.241.244.158:8072] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aekcLrRExf-1pAbSeJt0_QAAAYw"]
[Thu Apr 23 03:06:23.088760 2026] [:error] [pid 9085:tid 9098] [client 74.241.244.158:8070] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "aekcL9-_-or9vQnlWnpbIgAAAUs"]
[Thu Apr 23 03:06:23.735180 2026] [:error] [pid 9085:tid 9108] [client 74.241.244.158:8187] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "aekcL9-_-or9vQnlWnpbIwAAAVU"]
[Thu Apr 23 03:06:24.641516 2026] [:error] [pid 9085:tid 9091] [client 74.241.244.158:8009] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "aekcMN-_-or9vQnlWnpbJwAAAUQ"]
[Thu Apr 23 03:06:25.891507 2026] [:error] [pid 9085:tid 9103] [client 74.241.244.158:8152] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "aekcMd-_-or9vQnlWnpbLQAAAVA"]
[Thu Apr 23 03:06:26.790439 2026] [:error] [pid 9085:tid 9101] [client 74.241.244.158:21996] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/retu11.PhP7"] [unique_id "aekcMt-_-or9vQnlWnpbMQAAAU4"]
[Thu Apr 23 03:06:28.186568 2026] [:error] [pid 6384:tid 6408] [client 74.241.244.158:8191] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rip.php"] [unique_id "aekcND58M3t15ICeWHXvSgAAANU"]
[Thu Apr 23 03:06:28.910273 2026] [:error] [pid 6250:tid 6270] [client 74.241.244.158:8002] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rip.php"] [unique_id "aekcNA-iZeQkqmQVfj5W1QAAAFA"]
[Thu Apr 23 03:06:29.703014 2026] [:error] [pid 9085:tid 9094] [client 74.241.244.158:8082] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rip.php"] [unique_id "aekcNd-_-or9vQnlWnpbOgAAAUc"]
[Thu Apr 23 03:06:30.396520 2026] [:error] [pid 23776:tid 23786] [client 74.241.244.158:8116] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rip.php"] [unique_id "aekcNrRExf-1pAbSeJt1AgAAAYg"]
[Thu Apr 23 03:06:31.156915 2026] [:error] [pid 6344:tid 6367] [client 74.241.244.158:8095] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aekcN0DOTF-pkQnDeUlQ-AAAABI"]
[Thu Apr 23 03:06:31.899559 2026] [:error] [pid 6344:tid 6370] [client 74.241.244.158:22008] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aekcN0DOTF-pkQnDeUlQ-QAAABU"]
[Thu Apr 23 03:06:32.535476 2026] [:error] [pid 6344:tid 6357] [client 74.241.244.158:8064] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aekcOEDOTF-pkQnDeUlQ-gAAAAg"]
[Thu Apr 23 03:06:33.342672 2026] [:error] [pid 6384:tid 6394] [client 74.241.244.158:22011] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "aekcOT58M3t15ICeWHXvTAAAAMc"]
[Thu Apr 23 03:06:34.257317 2026] [:error] [pid 23776:tid 23795] [client 74.241.244.158:8114] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zoo.php"] [unique_id "aekcOrRExf-1pAbSeJt1BgAAAZE"]
[Thu Apr 23 03:06:35.388100 2026] [:error] [pid 9085:tid 9091] [client 74.241.244.158:8149] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zoo.php"] [unique_id "aekcO9-_-or9vQnlWnpbRgAAAUQ"]
[Thu Apr 23 03:06:36.077693 2026] [:error] [pid 9085:tid 9089] [client 74.241.244.158:8088] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zoo.php"] [unique_id "aekcPN-_-or9vQnlWnpbSgAAAUI"]
[Thu Apr 23 03:06:37.794282 2026] [:error] [pid 9085:tid 9105] [client 74.241.244.158:8013] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zoo.php"] [unique_id "aekcPd-_-or9vQnlWnpbTgAAAVI"]
[Thu Apr 23 03:06:39.644577 2026] [:error] [pid 9085:tid 9109] [client 74.241.244.158:8096] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admlo.php"] [unique_id "aekcP9-_-or9vQnlWnpbUgAAAVY"]
[Thu Apr 23 03:06:40.509499 2026] [:error] [pid 9085:tid 9095] [client 74.241.244.158:8132] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admlo.php"] [unique_id "aekcQN-_-or9vQnlWnpbVQAAAUg"]
[Thu Apr 23 03:06:41.231731 2026] [:error] [pid 6384:tid 6390] [client 74.241.244.158:8107] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admlo.php"] [unique_id "aekcQT58M3t15ICeWHXvVAAAAMM"]
[Thu Apr 23 03:06:41.993219 2026] [:error] [pid 6384:tid 6399] [client 74.241.244.158:8120] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admlo.php"] [unique_id "aekcQT58M3t15ICeWHXvVQAAAMw"]
[Thu Apr 23 03:06:42.768618 2026] [:error] [pid 6384:tid 6403] [client 74.241.244.158:8079] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gcqoa.php"] [unique_id "aekcQj58M3t15ICeWHXvVgAAANA"]
[Thu Apr 23 03:06:43.805730 2026] [:error] [pid 6384:tid 6408] [client 74.241.244.158:8024] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gcqoa.php"] [unique_id "aekcQz58M3t15ICeWHXvWAAAANU"]
[Thu Apr 23 03:06:44.557907 2026] [:error] [pid 23776:tid 23802] [client 74.241.244.158:8020] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gcqoa.php"] [unique_id "aekcRLRExf-1pAbSeJt1CAAAAZg"]
[Thu Apr 23 03:06:45.270505 2026] [:error] [pid 6384:tid 6389] [client 74.241.244.158:8007] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gcqoa.php"] [unique_id "aekcRT58M3t15ICeWHXvWgAAAMI"]
[Thu Apr 23 03:06:45.997454 2026] [:error] [pid 6384:tid 6387] [client 74.241.244.158:7939] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "aekcRT58M3t15ICeWHXvXgAAAMA"]
[Thu Apr 23 03:06:46.776446 2026] [:error] [pid 9085:tid 9088] [client 74.241.244.158:8117] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "aekcRt-_-or9vQnlWnpbcAAAAUE"]
[Thu Apr 23 03:06:47.428056 2026] [:error] [pid 23776:tid 23781] [client 74.241.244.158:8025] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "aekcR7RExf-1pAbSeJt1DAAAAYM"]
[Thu Apr 23 03:06:47.971584 2026] [:error] [pid 6251:tid 6286] [client 74.241.244.158:8089] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "aekcRysFAzbyObL-SQ60bQAAAIE"]
[Thu Apr 23 03:06:48.712564 2026] [:error] [pid 9085:tid 9111] [client 74.241.244.158:8047] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "aekcSN-_-or9vQnlWnpbcQAAAVg"]
[Thu Apr 23 03:06:49.391466 2026] [:error] [pid 9085:tid 9098] [client 74.241.244.158:8090] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "aekcSd-_-or9vQnlWnpbdAAAAUs"]
[Thu Apr 23 03:06:50.234750 2026] [:error] [pid 9085:tid 9091] [client 74.241.244.158:21997] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "aekcSt-_-or9vQnlWnpbeAAAAUQ"]
[Thu Apr 23 03:06:50.835838 2026] [:error] [pid 6251:tid 6287] [client 74.241.244.158:8039] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/b.php"] [unique_id "aekcSisFAzbyObL-SQ60dAAAAII"]
[Thu Apr 23 03:06:51.565547 2026] [:error] [pid 9085:tid 9090] [client 74.241.244.158:8041] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "aekcS9-_-or9vQnlWnpbfAAAAUM"]
[Thu Apr 23 03:06:52.540918 2026] [:error] [pid 6344:tid 6371] [client 74.241.244.158:22070] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "aekcTEDOTF-pkQnDeUlQ_wAAABY"]
[Thu Apr 23 03:06:53.640952 2026] [:error] [pid 6384:tid 6407] [client 74.241.244.158:8015] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "aekcTT58M3t15ICeWHXvYAAAANQ"]
[Thu Apr 23 03:06:54.893442 2026] [:error] [pid 6344:tid 6362] [client 74.241.244.158:8123] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/grsiuk.php"] [unique_id "aekcTkDOTF-pkQnDeUlRAAAAAA0"]
[Thu Apr 23 03:06:59.481290 2026] [:error] [pid 6344:tid 6366] [client 74.241.244.158:7956] [client 74.241.244.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-class-api.php"] [unique_id "aekcU0DOTF-pkQnDeUlRAgAAABE"]
[Thu Apr 23 03:07:02.499172 2026] [:error] [pid 6384:tid 6403] [client 74.241.244.158:8068] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class-api.php
[Thu Apr 23 03:07:02.784289 2026] [:error] [pid 6384:tid 6408] [client 74.241.244.158:8068] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Thu Apr 23 03:07:03.106085 2026] [:error] [pid 6384:tid 6406] [client 74.241.244.158:8068] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Apr 23 03:07:03.417906 2026] [:error] [pid 6384:tid 6389] [client 74.241.244.158:8068] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Thu Apr 23 03:07:03.702555 2026] [:error] [pid 6384:tid 6393] [client 74.241.244.158:8068] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Thu Apr 23 07:22:30.769149 2026] [:error] [pid 42973:tid 43043] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Apr 23 07:22:31.268721 2026] [:error] [pid 42973:tid 43065] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Apr 23 07:22:31.588447 2026] [:error] [pid 42973:tid 43052] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 23 07:22:31.982710 2026] [:error] [pid 42973:tid 43059] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Apr 23 07:22:32.290062 2026] [:error] [pid 42973:tid 43055] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 23 07:22:32.608347 2026] [:error] [pid 42973:tid 43061] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 23 07:22:32.936300 2026] [:error] [pid 42973:tid 43059] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 23 07:22:33.247001 2026] [:error] [pid 42973:tid 43050] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Apr 23 07:22:34.042933 2026] [:error] [pid 42973:tid 43044] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Apr 23 07:22:34.395601 2026] [:error] [pid 42973:tid 43056] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Apr 23 07:22:34.707487 2026] [:error] [pid 42973:tid 43045] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 23 07:22:35.362585 2026] [:error] [pid 42973:tid 43061] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Apr 23 07:22:35.663182 2026] [:error] [pid 42973:tid 43055] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 23 07:22:36.010268 2026] [:error] [pid 42973:tid 43049] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Apr 23 07:22:36.341940 2026] [:error] [pid 42973:tid 43064] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Apr 23 07:22:36.652915 2026] [:error] [pid 42973:tid 43044] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 23 07:22:37.052255 2026] [:error] [pid 42973:tid 43055] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 23 07:22:37.466727 2026] [:error] [pid 42973:tid 43052] [client 89.251.0.128:23981] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Apr 23 07:22:40.387469 2026] [:error] [pid 42973:tid 43058] [client 89.251.0.128:23981] [client 89.251.0.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/upload.php"] [unique_id "aelYQG6I0QqmmmLTHE3S1AAAAI8"]
[Thu Apr 23 07:22:43.014692 2026] [:error] [pid 25635:tid 25656] [client 89.251.0.144:41571] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aelYQ8Rxv6UsgRGKB3LZCwAAARE"]
[Thu Apr 23 07:22:44.606895 2026] [:error] [pid 42972:tid 43016] [client 89.251.0.121:36633] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aelYRMOAb-3sOknsk4cVfgAAAEA"]
[Thu Apr 23 07:22:46.196376 2026] [:error] [pid 42972:tid 43028] [client 89.251.0.128:50481] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 23 07:22:47.222376 2026] [:error] [pid 42972:tid 43029] [client 89.251.0.128:50481] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aelYR8OAb-3sOknsk4cVsgAAAE0"]
[Thu Apr 23 07:22:48.520915 2026] [:error] [pid 25635:tid 25639] [client 89.251.0.143:31681] [client 89.251.0.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "aelYSMRxv6UsgRGKB3LZTwAAAQA"]
[Thu Apr 23 07:22:49.209949 2026] [:error] [pid 42973:tid 43051] [client 89.251.0.151:59075] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 23 07:22:49.522324 2026] [:error] [pid 42973:tid 43044] [client 89.251.0.151:59075] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aelYSW6I0QqmmmLTHE3TPAAAAIE"]
[Thu Apr 23 07:22:50.456128 2026] [:error] [pid 42973:tid 43051] [client 89.251.0.131:59363] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Apr 23 07:22:52.543306 2026] [:error] [pid 42973:tid 43048] [client 89.251.0.131:59363] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aelYTG6I0QqmmmLTHE3TcgAAAIU"]
[Thu Apr 23 07:22:53.582091 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.114:58889] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aelYTb6vRb9j6psK2ZaFgAAAAg8"]
[Thu Apr 23 07:22:54.194837 2026] [:error] [pid 25635:tid 25659] [client 89.251.0.142:55245] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aelYTsRxv6UsgRGKB3LZhAAAARQ"]
[Thu Apr 23 07:22:54.838843 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.133:30189] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aelYTr6vRb9j6psK2ZaFmAAAAg4"]
[Thu Apr 23 07:22:55.430740 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.115:26523] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aelYT76vRb9j6psK2ZaFrQAAAg4"]
[Thu Apr 23 07:22:56.061752 2026] [:error] [pid 42972:tid 43026] [client 89.251.0.142:49579] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aelYUMOAb-3sOknsk4cV_AAAAEo"]
[Thu Apr 23 07:22:57.608508 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.119:21765] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aelYUb6vRb9j6psK2ZaF8QAAAgw"]
[Thu Apr 23 07:22:58.231929 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.124:63161] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Apr 23 07:22:58.870942 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.124:63161] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aelYUoV5EysYcTLjmwjqegAAAcM"]
[Thu Apr 23 07:23:00.118647 2026] [:error] [pid 42973:tid 43059] [client 89.251.0.146:42285] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aelYVG6I0QqmmmLTHE3TywAAAJA"]
[Thu Apr 23 07:23:00.787542 2026] [:error] [pid 65000:tid 65037] [client 89.251.0.120:52767] [client 89.251.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "aelYVL6vRb9j6psK2ZaGMgAAAgQ"]
[Thu Apr 23 07:23:01.831174 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.129:31731] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aelYVYV5EysYcTLjmwjqiwAAAdM"]
[Thu Apr 23 07:23:02.572450 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.129:44853] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Apr 23 07:23:02.849595 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.129:44853] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aelYVr6vRb9j6psK2ZaGWwAAAhc"]
[Thu Apr 23 07:23:03.446172 2026] [:error] [pid 64967:tid 64980] [client 89.251.0.115:30345] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Apr 23 07:23:04.512013 2026] [:error] [pid 64967:tid 64975] [client 89.251.0.115:30345] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Apr 23 07:23:05.487901 2026] [:error] [pid 64967:tid 64992] [client 89.251.0.115:30345] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aelYWYAV4GfOOdX8QzoJogAAAZc"]
[Thu Apr 23 07:23:06.099924 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.140:55701] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Apr 23 07:23:06.404888 2026] [:error] [pid 64998:tid 65020] [client 89.251.0.140:55701] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aelYWoV5EysYcTLjmwjqnwAAAdI"]
[Thu Apr 23 07:23:07.016537 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.117:61135] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Apr 23 07:23:07.617864 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.117:61135] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aelYW76vRb9j6psK2ZaG-QAAAgA"]
[Thu Apr 23 07:23:08.565774 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.134:38527] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aelYXL6vRb9j6psK2ZaHHwAAAgk"]
[Thu Apr 23 07:23:09.485659 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.139:20815] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Apr 23 07:23:09.951058 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.139:20815] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Apr 23 07:23:10.943768 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.139:20815] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aelYXr6vRb9j6psK2ZaHXwAAAgs"]
[Thu Apr 23 07:23:11.876912 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.132:32873] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aelYXzC5hrvNXosL83LAwwAAAMw"]
[Thu Apr 23 07:23:12.882971 2026] [:error] [pid 25635:tid 25644] [client 89.251.0.121:30067] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aelYYMRxv6UsgRGKB3LadgAAAQU"]
[Thu Apr 23 07:23:13.496957 2026] [:error] [pid 42971:tid 42987] [client 89.251.0.114:36211] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aelYYTEP2_5RswrH8bGfvAAAAAE"]
[Thu Apr 23 07:23:14.114022 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.133:51535] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aelYYr6vRb9j6psK2ZaHmQAAAg8"]
[Thu Apr 23 07:23:15.414171 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.137:42025] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Apr 23 07:23:15.726576 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.137:42025] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aelYY76vRb9j6psK2ZaHxwAAAgE"]
[Thu Apr 23 07:23:16.363616 2026] [:error] [pid 43083:tid 43094] [client 89.251.0.150:46213] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aelYZDC5hrvNXosL83LA6QAAAMk"]
[Thu Apr 23 07:23:17.047228 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.123:31659] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aelYZYV5EysYcTLjmwjrGgAAAcg"]
[Thu Apr 23 07:23:18.285859 2026] [:error] [pid 42972:tid 43017] [client 89.251.0.145:31691] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Apr 23 07:23:18.717262 2026] [:error] [pid 42972:tid 43040] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Apr 23 07:23:18.980296 2026] [:error] [pid 42972:tid 43018] [client 89.251.0.145:31691] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Apr 23 07:23:19.045129 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Apr 23 07:23:19.384341 2026] [:error] [pid 42972:tid 43040] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 23 07:23:19.755409 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Apr 23 07:23:20.111378 2026] [:error] [pid 42972:tid 43031] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 23 07:23:20.428975 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.145:31691] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aelYaMOAb-3sOknsk4cW7AAAAEU"]
[Thu Apr 23 07:23:20.440094 2026] [:error] [pid 42972:tid 43022] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 23 07:23:20.741167 2026] [:error] [pid 42972:tid 43032] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 23 07:23:21.058136 2026] [:error] [pid 42972:tid 43039] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Apr 23 07:23:21.706162 2026] [:error] [pid 42972:tid 43016] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Apr 23 07:23:21.988252 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.137:57005] [client 89.251.0.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.137, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aelYaTEP2_5RswrH8bGf9AAAABQ"]
[Thu Apr 23 07:23:22.013105 2026] [:error] [pid 42972:tid 43017] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Apr 23 07:23:22.311818 2026] [:error] [pid 42971:tid 43008] [client 89.251.0.137:57005] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Apr 23 07:23:22.324081 2026] [:error] [pid 42972:tid 43019] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 23 07:23:22.645432 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.139:56747] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Apr 23 07:23:22.970336 2026] [:error] [pid 42972:tid 43030] [client 89.251.0.139:56747] [client 89.251.0.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "aelYasOAb-3sOknsk4cXEAAAAE4"]
[Thu Apr 23 07:23:23.589634 2026] [:error] [pid 43083:tid 43089] [client 89.251.0.115:63049] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 23 07:23:23.869528 2026] [:error] [pid 42971:tid 43001] [client 89.251.0.137:57005] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Apr 23 07:23:23.902441 2026] [:error] [pid 43083:tid 43090] [client 89.251.0.115:63049] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Apr 23 07:23:24.185039 2026] [:error] [pid 42971:tid 43000] [client 89.251.0.137:57005] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Apr 23 07:23:24.234823 2026] [:error] [pid 43083:tid 43098] [client 89.251.0.115:63049] [client 89.251.0.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "aelYbDC5hrvNXosL83LBYQAAAM0"]
[Thu Apr 23 07:23:24.931640 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.120:54075] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Apr 23 07:23:25.263882 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.120:54075] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 23 07:23:25.563902 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.120:54075] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 23 07:23:26.905755 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.120:54075] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Apr 23 07:23:28.546733 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.120:54075] [client 89.251.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/edit-wolf.php"] [unique_id "aelYcL6vRb9j6psK2ZaIwwAAAg8"]
[Thu Apr 23 07:23:32.333795 2026] [:error] [pid 42973:tid 43059] [client 89.251.0.119:55401] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aelYdG6I0QqmmmLTHE3VGgAAAJA"]
[Thu Apr 23 07:23:33.976840 2026] [:error] [pid 43083:tid 43090] [client 89.251.0.124:46617] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aelYdTC5hrvNXosL83LBtwAAAMU"]
[Thu Apr 23 07:23:35.763305 2026] [:error] [pid 65000:tid 65050] [client 89.251.0.129:46723] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 23 07:23:37.377883 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.129:46723] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aelYeb6vRb9j6psK2ZaJyAAAAhY"]
[Thu Apr 23 07:23:38.764573 2026] [:error] [pid 59700:tid 59702] [client 89.251.0.146:60245] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 23 07:23:39.055700 2026] [:error] [pid 25635:tid 25640] [client 89.251.0.140:59281] [client 89.251.0.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/"] [unique_id "aelYe8Rxv6UsgRGKB3LbkAAAAQE"]
[Thu Apr 23 07:23:39.096066 2026] [:error] [pid 59700:tid 59721] [client 89.251.0.146:60245] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aelYe5XyGZJFeAIDWtlRmAAAAVM"]
[Thu Apr 23 07:23:40.088464 2026] [:error] [pid 25635:tid 25655] [client 89.251.0.121:59755] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Apr 23 07:23:41.790613 2026] [:error] [pid 25635:tid 25659] [client 89.251.0.121:59755] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aelYfcRxv6UsgRGKB3LbugAAARQ"]
[Thu Apr 23 07:23:42.795971 2026] [:error] [pid 64998:tid 65014] [client 89.251.0.116:40675] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aelYfoV5EysYcTLjmwjsOgAAAcw"]
[Thu Apr 23 07:23:43.421045 2026] [:error] [pid 43083:tid 43100] [client 89.251.0.133:61427] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aelYfzC5hrvNXosL83LB7gAAAM8"]
[Thu Apr 23 07:23:44.122021 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.133:43017] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aelYgL6vRb9j6psK2ZaKwAAAAgg"]
[Thu Apr 23 07:23:44.736532 2026] [:error] [pid 43083:tid 43090] [client 89.251.0.136:37149] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aelYgDC5hrvNXosL83LB9AAAAMU"]
[Thu Apr 23 07:23:45.363961 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.145:45313] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aelYgb6vRb9j6psK2ZaK4QAAAgk"]
[Thu Apr 23 07:23:46.441743 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.129:56965] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aelYgr6vRb9j6psK2ZaLAwAAAgI"]
[Thu Apr 23 07:23:47.082579 2026] [:error] [pid 64967:tid 64978] [client 89.251.0.143:44339] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Apr 23 07:23:47.799601 2026] [:error] [pid 64967:tid 64987] [client 89.251.0.143:44339] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "aelYg4AV4GfOOdX8QzoKuAAAAZI"]
[Thu Apr 23 07:23:49.128630 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.120:43995] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aelYhTC5hrvNXosL83LCIAAAANc"]
[Thu Apr 23 07:23:50.127859 2026] [:error] [pid 64998:tid 65023] [client 89.251.0.129:60405] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aelYhoV5EysYcTLjmwjsgQAAAdU"]
[Thu Apr 23 07:23:50.706408 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.136:24553] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Apr 23 07:23:51.019916 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.136:24553] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aelYh76vRb9j6psK2ZaLkAAAAhA"]
[Thu Apr 23 07:23:51.733377 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.126:43961] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Apr 23 07:23:52.787252 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.126:43961] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Apr 23 07:23:54.015113 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.126:43961] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aelYib6vRb9j6psK2ZaL6wAAAgM"]
[Thu Apr 23 07:23:54.695002 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.128:46185] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Apr 23 07:23:55.081201 2026] [:error] [pid 59700:tid 59717] [client 89.251.0.128:46185] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aelYi5XyGZJFeAIDWtlSHQAAAU8"]
[Thu Apr 23 07:23:55.763516 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.134:21579] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Apr 23 07:23:56.427721 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.134:21579] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aelYjL6vRb9j6psK2ZaMNAAAAhc"]
[Thu Apr 23 07:23:58.400651 2026] [:error] [pid 42971:tid 42993] [client 89.251.0.127:26303] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aelYjjEP2_5RswrH8bGguQAAAAc"]
[Thu Apr 23 07:23:59.759883 2026] [:error] [pid 65000:tid 65054] [client 89.251.0.151:53975] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Apr 23 07:24:00.074114 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.151:53975] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Apr 23 07:24:00.931071 2026] [:error] [pid 65000:tid 65050] [client 89.251.0.151:53975] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aelYkL6vRb9j6psK2ZaMogAAAhE"]
[Thu Apr 23 07:24:01.837447 2026] [:error] [pid 42973:tid 43065] [client 89.251.0.123:63173] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aelYkW6I0QqmmmLTHE3VkgAAAJY"]
[Thu Apr 23 07:24:02.748196 2026] [:error] [pid 43083:tid 43086] [client 89.251.0.116:49495] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aelYkjC5hrvNXosL83LCvQAAAME"]
[Thu Apr 23 07:24:03.345138 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.129:59061] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aelYk76vRb9j6psK2ZaM1gAAAg8"]
[Thu Apr 23 07:24:04.200136 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.131:54229] [client 89.251.0.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/up/"] [unique_id "aelYlL6vRb9j6psK2ZaM7gAAAg8"]
[Thu Apr 23 07:24:05.546556 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.129:54977] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aelYlb6vRb9j6psK2ZaNIgAAAgk"]
[Thu Apr 23 07:24:06.516363 2026] [:error] [pid 25635:tid 25656] [client 89.251.0.128:25775] [client 89.251.0.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/dummyyummy/"] [unique_id "aelYlsRxv6UsgRGKB3LcpAAAARE"]
[Thu Apr 23 07:24:07.781586 2026] [:error] [pid 25635:tid 25643] [client 89.251.0.144:25041] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Apr 23 07:24:08.088519 2026] [:error] [pid 25635:tid 25663] [client 89.251.0.144:25041] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aelYmMRxv6UsgRGKB3LcswAAARg"]
[Thu Apr 23 07:24:08.712627 2026] [:error] [pid 64998:tid 65013] [client 89.251.0.132:33853] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aelYmIV5EysYcTLjmwjtzAAAAcs"]
[Thu Apr 23 07:24:09.331625 2026] [:error] [pid 64998:tid 65009] [client 89.251.0.128:36989] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aelYmYV5EysYcTLjmwjt2AAAAcc"]
[Thu Apr 23 07:24:12.179642 2026] [:error] [pid 25635:tid 25652] [client 89.251.0.129:35607] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Apr 23 07:24:12.830265 2026] [:error] [pid 25635:tid 25661] [client 89.251.0.129:35607] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Apr 23 07:24:14.388962 2026] [:error] [pid 25635:tid 25643] [client 89.251.0.129:35607] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aelYnsRxv6UsgRGKB3Lc7AAAAQQ"]
[Thu Apr 23 07:24:14.446355 2026] [autoindex:error] [pid 42972:tid 43032] [client 89.251.0.129:32585] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:24:16.062159 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.117:34211] [client 89.251.0.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.117, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aelYoL6vRb9j6psK2ZaONQAAAgU"]
[Thu Apr 23 07:24:16.385392 2026] [:error] [pid 65000:tid 65052] [client 89.251.0.117:34211] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Apr 23 07:24:18.145706 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.117:34211] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Apr 23 07:24:18.879361 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.117:34211] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Apr 23 07:24:20.491467 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.117:34211] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aelYpL6vRb9j6psK2ZaOsAAAAhQ"]
[Thu Apr 23 07:24:22.507738 2026] [:error] [pid 64967:tid 64976] [client 89.251.0.147:36827] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Apr 23 07:24:22.820202 2026] [:error] [pid 64967:tid 64989] [client 89.251.0.147:36827] [client 89.251.0.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.147, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aelYpoAV4GfOOdX8QzoMAQAAAZQ"]
[Thu Apr 23 07:24:23.481612 2026] [:error] [pid 64967:tid 64976] [client 89.251.0.147:36827] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "aelYp4AV4GfOOdX8QzoMCgAAAYc"]
[Thu Apr 23 07:24:25.520319 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.127:55641] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Apr 23 07:24:26.170706 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.127:55641] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Apr 23 07:24:26.792630 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.127:55641] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aelYqr6vRb9j6psK2ZaPCgAAAgY"]
[Thu Apr 23 07:24:27.422189 2026] [:error] [pid 42971:tid 43000] [client 89.251.0.127:22509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 23 07:24:28.531567 2026] [:error] [pid 42971:tid 43008] [client 89.251.0.127:22509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Apr 23 07:24:29.163850 2026] [:error] [pid 42971:tid 43003] [client 89.251.0.127:22509] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Apr 23 07:24:29.777794 2026] [:error] [pid 42971:tid 43007] [client 89.251.0.127:22509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Apr 23 07:24:30.107665 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.127:22509] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aelYrjEP2_5RswrH8bGhowAAAAg"]
[Thu Apr 23 07:24:30.726924 2026] [:error] [pid 64967:tid 64984] [client 89.251.0.143:64029] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Apr 23 07:24:31.006632 2026] [:error] [pid 64967:tid 64987] [client 89.251.0.143:64029] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Apr 23 07:24:31.307636 2026] [:error] [pid 64967:tid 64975] [client 89.251.0.143:64029] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aelYr4AV4GfOOdX8QzoMpgAAAYY"]
[Thu Apr 23 07:24:32.376843 2026] [:error] [pid 25635:tid 25649] [client 89.251.0.135:38115] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Apr 23 07:24:33.012956 2026] [:error] [pid 25635:tid 25650] [client 89.251.0.135:38115] [client 89.251.0.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.135, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aelYscRxv6UsgRGKB3LdpQAAAQs"]
[Thu Apr 23 07:24:33.353612 2026] [:error] [pid 25635:tid 25644] [client 89.251.0.135:38115] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aelYscRxv6UsgRGKB3LdpwAAAQU"]
[Thu Apr 23 07:24:34.099382 2026] [:error] [pid 43083:tid 43089] [client 89.251.0.141:45687] [client 89.251.0.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/languages/about.php"] [unique_id "aelYsjC5hrvNXosL83LD0wAAAMQ"]
[Thu Apr 23 07:24:44.267684 2026] [:error] [pid 25635:tid 25655] [client 89.251.0.113:32099] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Apr 23 07:24:46.079831 2026] [:error] [pid 25635:tid 25659] [client 89.251.0.113:32099] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Apr 23 07:24:46.784479 2026] [:error] [pid 25635:tid 25646] [client 89.251.0.113:32099] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aelYvsRxv6UsgRGKB3LeHwAAAQc"]
[Thu Apr 23 07:24:47.393253 2026] [:error] [pid 43083:tid 43091] [client 89.251.0.147:59433] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Apr 23 07:24:48.346030 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.147:59433] [client 89.251.0.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.147, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aelYwDC5hrvNXosL83LEUwAAAMc"]
[Thu Apr 23 07:24:48.676354 2026] [:error] [pid 43083:tid 43101] [client 89.251.0.147:59433] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Apr 23 07:24:48.969780 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.147:59433] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Apr 23 07:24:49.287337 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.147:59433] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Apr 23 07:24:49.576923 2026] [:error] [pid 43083:tid 43102] [client 89.251.0.147:59433] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aelYwTC5hrvNXosL83LEZAAAANE"]
[Thu Apr 23 07:24:50.276401 2026] [:error] [pid 25635:tid 25660] [client 89.251.0.121:27897] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Apr 23 07:24:50.624032 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.121:27897] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aelYwsRxv6UsgRGKB3LePgAAAQY"]
[Thu Apr 23 07:24:51.524362 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.148:61445] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Apr 23 07:24:51.798340 2026] [:error] [pid 42971:tid 42988] [client 89.251.0.148:61445] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aelYwzEP2_5RswrH8bGitgAAAAI"]
[Thu Apr 23 07:24:52.159810 2026] [:error] [pid 43083:tid 43101] [client 89.251.0.134:50489] [client 89.251.0.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-admin/includes/"] [unique_id "aelYxDC5hrvNXosL83LEeAAAANA"]
[Thu Apr 23 07:24:53.055398 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.150:25631] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Apr 23 07:24:53.407677 2026] [:error] [pid 42971:tid 42987] [client 89.251.0.150:25631] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aelYxTEP2_5RswrH8bGiyAAAAAE"]
[Thu Apr 23 07:24:54.112113 2026] [:error] [pid 25635:tid 25658] [client 89.251.0.148:43841] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aelYxsRxv6UsgRGKB3LeXwAAARM"]
[Thu Apr 23 07:24:54.787682 2026] [:error] [pid 64998:tid 65007] [client 89.251.0.150:20215] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Apr 23 07:24:55.108135 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.150:20215] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Apr 23 07:24:55.881182 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.123:32043] [client 89.251.0.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rest-api/fields/"] [unique_id "aelYx8Rxv6UsgRGKB3LebwAAAQY"]
[Thu Apr 23 07:24:56.471286 2026] [:error] [pid 64998:tid 65011] [client 89.251.0.150:20215] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aelYyIV5EysYcTLjmwjwOQAAAck"]
[Thu Apr 23 07:24:57.375511 2026] [:error] [pid 42973:tid 43063] [client 89.251.0.115:23255] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aelYyW6I0QqmmmLTHE3XEgAAAJQ"]
[Thu Apr 23 07:24:57.742161 2026] [:error] [pid 59700:tid 59722] [client 89.251.0.123:47625] [client 89.251.0.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rest-api/fields/"] [unique_id "aelYyZXyGZJFeAIDWtlT-QAAAVQ"]
[Thu Apr 23 07:24:58.284292 2026] [:error] [pid 42973:tid 43060] [client 89.251.0.128:36701] [client 89.251.0.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/cache/index.php"] [unique_id "aelYym6I0QqmmmLTHE3XGwAAAJE"]
[Thu Apr 23 07:24:59.631485 2026] [:error] [pid 43083:tid 43100] [client 89.251.0.140:44305] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aelYyzC5hrvNXosL83LE1gAAAM8"]
[Thu Apr 23 07:25:00.292894 2026] [:error] [pid 25635:tid 25663] [client 89.251.0.125:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Apr 23 07:25:01.116713 2026] [:error] [pid 25635:tid 25649] [client 89.251.0.125:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Apr 23 07:25:01.574513 2026] [:error] [pid 25635:tid 25646] [client 89.251.0.125:44231] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aelYzcRxv6UsgRGKB3LelwAAAQc"]
[Thu Apr 23 07:25:02.589982 2026] [:error] [pid 43083:tid 43098] [client 89.251.0.123:41411] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Apr 23 07:25:03.256654 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.123:41411] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "aelYzzC5hrvNXosL83LE6gAAANM"]
[Thu Apr 23 07:25:08.447688 2026] [:error] [pid 59700:tid 59712] [client 89.251.0.126:33633] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aelY1JXyGZJFeAIDWtlUXQAAAUo"]
[Thu Apr 23 07:25:09.793526 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.129:54221] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Apr 23 07:25:10.877592 2026] [:error] [pid 59700:tid 59710] [client 89.251.0.129:54221] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Apr 23 07:25:11.839399 2026] [:error] [pid 59700:tid 59722] [client 89.251.0.129:54221] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Apr 23 07:25:12.150466 2026] [:error] [pid 59700:tid 59709] [client 89.251.0.129:54221] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aelY2JXyGZJFeAIDWtlUpQAAAUc"]
[Thu Apr 23 07:25:12.773648 2026] [:error] [pid 42972:tid 43035] [client 89.251.0.144:36771] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aelY2MOAb-3sOknsk4cb1gAAAFM"]
[Thu Apr 23 07:25:13.408781 2026] [:error] [pid 64967:tid 64979] [client 89.251.0.128:34615] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aelY2YAV4GfOOdX8QzoOqAAAAYo"]
[Thu Apr 23 07:25:14.076454 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.125:24873] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aelY2r6vRb9j6psK2ZaTFwAAAg0"]
[Thu Apr 23 07:25:14.722921 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.132:24711] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Apr 23 07:25:15.678582 2026] [:error] [pid 42971:tid 43008] [client 89.251.0.132:24711] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aelY2zEP2_5RswrH8bGjqgAAABY"]
[Thu Apr 23 07:25:16.397941 2026] [:error] [pid 25635:tid 25646] [client 89.251.0.138:42835] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aelY3MRxv6UsgRGKB3Le4wAAAQc"]
[Thu Apr 23 07:25:17.025634 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.133:39539] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Apr 23 07:25:17.696569 2026] [:error] [pid 65000:tid 65037] [client 89.251.0.133:39539] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aelY3b6vRb9j6psK2ZaTXgAAAgQ"]
[Thu Apr 23 07:25:20.522204 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.120:27031] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aelY4DC5hrvNXosL83LFwAAAAMI"]
[Thu Apr 23 07:25:21.092800 2026] [:error] [pid 59700:tid 59709] [client 89.251.0.114:33637] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aelY4ZXyGZJFeAIDWtlVDAAAAUc"]
[Thu Apr 23 07:25:21.772963 2026] [:error] [pid 59700:tid 59726] [client 89.251.0.131:43937] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aelY4ZXyGZJFeAIDWtlVGwAAAVg"]
[Thu Apr 23 07:25:22.798304 2026] [:error] [pid 43083:tid 43090] [client 89.251.0.141:45637] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aelY4jC5hrvNXosL83LF4wAAAMU"]
[Thu Apr 23 07:25:24.120225 2026] [:error] [pid 59700:tid 59702] [client 89.251.0.139:50491] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aelY5JXyGZJFeAIDWtlVMwAAAUA"]
[Thu Apr 23 07:25:24.848409 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.126:28075] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Apr 23 07:25:25.882104 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.126:28075] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Apr 23 07:25:26.242077 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.126:28075] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aelY5jEP2_5RswrH8bGkQgAAABA"]
[Thu Apr 23 07:25:27.319569 2026] [:error] [pid 64998:tid 65023] [client 89.251.0.145:60059] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Apr 23 07:25:27.635840 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.145:60059] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Apr 23 07:25:29.362319 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.145:60059] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aelY6YV5EysYcTLjmwjxuQAAAcY"]
[Thu Apr 23 07:25:31.089775 2026] [:error] [pid 42972:tid 43040] [client 89.251.0.126:60155] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aelY68OAb-3sOknsk4ccawAAAFg"]
[Thu Apr 23 07:25:32.158045 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.114:43093] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aelY7JXyGZJFeAIDWtlVgQAAAUI"]
[Thu Apr 23 07:25:34.145983 2026] [:error] [pid 64998:tid 65024] [client 89.251.0.141:64863] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aelY7oV5EysYcTLjmwjx9QAAAdY"]
[Thu Apr 23 07:25:36.541540 2026] [:error] [pid 64998:tid 65015] [client 89.251.0.140:29137] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Apr 23 07:25:36.848580 2026] [:error] [pid 64998:tid 65002] [client 89.251.0.140:29137] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Apr 23 07:25:37.164043 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.140:29137] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Apr 23 07:25:37.497937 2026] [:error] [pid 64998:tid 65026] [client 89.251.0.140:29137] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Apr 23 07:25:39.359626 2026] [:error] [pid 64998:tid 65013] [client 89.251.0.140:29137] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aelY84V5EysYcTLjmwjyjQAAAcs"]
[Thu Apr 23 07:25:39.987421 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.138:38623] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aelY8zEP2_5RswrH8bGk4AAAABc"]
[Thu Apr 23 07:25:41.343446 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.116:46759] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aelY9TEP2_5RswrH8bGk_AAAAAU"]
[Thu Apr 23 07:25:41.987629 2026] [:error] [pid 42971:tid 43000] [client 89.251.0.113:21409] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aelY9TEP2_5RswrH8bGlEgAAAA4"]
[Thu Apr 23 07:25:45.400865 2026] [:error] [pid 64967:tid 64977] [client 89.251.0.148:27861] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aelY-YAV4GfOOdX8QzoP1wAAAYg"]
[Thu Apr 23 07:25:46.039816 2026] [:error] [pid 59700:tid 59717] [client 89.251.0.133:36651] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aelY-pXyGZJFeAIDWtlVugAAAU8"]
[Thu Apr 23 07:25:47.549041 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.124:30893] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aelY-76vRb9j6psK2ZaUrwAAAg8"]
[Thu Apr 23 07:25:48.420601 2026] [:error] [pid 42973:tid 43051] [client 89.251.0.133:48549] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aelY_G6I0QqmmmLTHE3YlAAAAIg"]
[Thu Apr 23 07:25:49.099129 2026] [:error] [pid 25635:tid 25642] [client 89.251.0.129:39109] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aelY_cRxv6UsgRGKB3Lf1QAAAQM"]
[Thu Apr 23 07:25:49.742615 2026] [:error] [pid 43083:tid 43089] [client 89.251.0.139:52403] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aelY_TC5hrvNXosL83LG_AAAAMQ"]
[Thu Apr 23 07:25:51.237157 2026] [:error] [pid 42973:tid 43063] [client 89.251.0.119:38671] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aelY_26I0QqmmmLTHE3YrAAAAJQ"]
[Thu Apr 23 07:25:52.247886 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.117:45593] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aelZADEP2_5RswrH8bGlqAAAABc"]
[Thu Apr 23 07:25:52.875677 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.139:29943] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Apr 23 07:25:53.613202 2026] [:error] [pid 64998:tid 65009] [client 89.251.0.139:29943] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aelZAYV5EysYcTLjmwjzIwAAAcc"]
[Thu Apr 23 07:25:54.804355 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.119:23175] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aelZApXyGZJFeAIDWtlWDAAAAUM"]
[Thu Apr 23 07:25:56.043028 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.138:64637] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Thu Apr 23 07:25:56.453132 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.138:64637] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aelZBDC5hrvNXosL83LHKAAAANc"]
[Thu Apr 23 07:25:57.490845 2026] [:error] [pid 42972:tid 43022] [client 89.251.0.117:61091] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Apr 23 07:25:57.804307 2026] [:error] [pid 42972:tid 43023] [client 89.251.0.117:61091] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Apr 23 07:25:58.120378 2026] [:error] [pid 42972:tid 43027] [client 89.251.0.117:61091] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Apr 23 07:25:58.415371 2026] [:error] [pid 42972:tid 43026] [client 89.251.0.117:61091] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aelZBsOAb-3sOknsk4cdigAAAEo"]
[Thu Apr 23 07:25:59.028364 2026] [:error] [pid 59700:tid 59707] [client 89.251.0.143:42775] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Apr 23 07:25:59.355924 2026] [:error] [pid 59700:tid 59717] [client 89.251.0.143:42775] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aelZB5XyGZJFeAIDWtlWMQAAAU8"]
[Thu Apr 23 07:26:00.670734 2026] [:error] [pid 64998:tid 65020] [client 89.251.0.114:32459] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 23 07:26:00.992607 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.114:32459] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Apr 23 07:26:01.348448 2026] [:error] [pid 64998:tid 65022] [client 89.251.0.114:32459] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Thu Apr 23 07:26:03.122250 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.114:32459] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Apr 23 07:26:03.452312 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.114:32459] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Apr 23 07:26:04.504738 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.114:32459] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Thu Apr 23 07:26:05.468714 2026] [:error] [pid 64998:tid 65011] [client 89.251.0.114:32459] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 23 07:26:05.823648 2026] [:error] [pid 64998:tid 65020] [client 89.251.0.114:32459] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aelZDYV5EysYcTLjmwjziAAAAdI"]
[Thu Apr 23 07:26:06.424980 2026] [:error] [pid 42973:tid 43067] [client 89.251.0.115:61757] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aelZDm6I0QqmmmLTHE3ZBwAAAJg"]
[Thu Apr 23 07:26:07.010530 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.126:22179] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Apr 23 07:26:07.341207 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.126:22179] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aelZD76vRb9j6psK2ZaVmgAAAgw"]
[Thu Apr 23 07:26:08.262198 2026] [:error] [pid 64998:tid 65009] [client 89.251.0.141:39481] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Apr 23 07:26:08.580787 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.141:39481] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aelZEIV5EysYcTLjmwjzmwAAAdE"]
[Thu Apr 23 07:26:09.201808 2026] [:error] [pid 42971:tid 42989] [client 89.251.0.132:33255] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aelZETEP2_5RswrH8bGmSgAAAAM"]
[Thu Apr 23 07:26:11.054408 2026] [:error] [pid 64998:tid 65024] [client 89.251.0.140:59327] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aelZE4V5EysYcTLjmwjzvQAAAdY"]
[Thu Apr 23 07:26:11.699661 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.132:29745] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "aelZE4V5EysYcTLjmwjzwwAAAcY"]
[Thu Apr 23 07:26:15.144691 2026] [:error] [pid 64967:tid 64980] [client 89.251.0.116:58875] [client 89.251.0.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/about.php"] [unique_id "aelZF4AV4GfOOdX8QzoQ0QAAAYs"]
[Thu Apr 23 07:26:16.210242 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.120:55719] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Apr 23 07:26:16.515767 2026] [:error] [pid 59700:tid 59724] [client 89.251.0.120:55719] [client 89.251.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/coffee/cloud.php"] [unique_id "aelZGJXyGZJFeAIDWtlXOQAAAVY"]
[Thu Apr 23 07:26:17.482173 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.142:55811] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aelZGb6vRb9j6psK2ZaWAgAAAhQ"]
[Thu Apr 23 07:26:18.353653 2026] [:error] [pid 59700:tid 59703] [client 89.251.0.133:47335] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Thu Apr 23 07:26:18.937645 2026] [:error] [pid 59700:tid 59722] [client 89.251.0.133:47335] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/function.php"] [unique_id "aelZGpXyGZJFeAIDWtlXYgAAAVQ"]
[Thu Apr 23 07:26:19.555000 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.141:37813] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aelZG76vRb9j6psK2ZaWJgAAAhg"]
[Thu Apr 23 07:26:21.999306 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.148:22173] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Apr 23 07:26:22.400063 2026] [:error] [pid 65000:tid 65054] [client 89.251.0.148:22173] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aelZHr6vRb9j6psK2ZaWUQAAAhU"]
[Thu Apr 23 07:26:23.110379 2026] [:error] [pid 42971:tid 42990] [client 89.251.0.127:39729] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aelZHzEP2_5RswrH8bGnDAAAAAQ"]
[Thu Apr 23 07:26:24.445168 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.131:20431] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Apr 23 07:26:25.248372 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.131:20431] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Apr 23 07:26:25.867623 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.131:20431] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Apr 23 07:26:26.445822 2026] [:error] [pid 42971:tid 42995] [client 89.251.0.131:20431] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aelZIjEP2_5RswrH8bGnVQAAAAk"]
[Thu Apr 23 07:26:27.071147 2026] [:error] [pid 64967:tid 64986] [client 89.251.0.124:30265] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aelZI4AV4GfOOdX8QzoRJAAAAZE"]
[Thu Apr 23 07:26:28.651877 2026] [:error] [pid 42971:tid 43003] [client 89.251.0.141:24295] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Apr 23 07:26:28.966733 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.141:24295] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/index.php"] [unique_id "aelZJDEP2_5RswrH8bGnnAAAAAU"]
[Thu Apr 23 07:26:29.591044 2026] [:error] [pid 64967:tid 64980] [client 89.251.0.138:30555] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aelZJYAV4GfOOdX8QzoRYQAAAYs"]
[Thu Apr 23 07:26:30.262551 2026] [:error] [pid 59700:tid 59715] [client 89.251.0.119:42615] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aelZJpXyGZJFeAIDWtlX4AAAAU0"]
[Thu Apr 23 07:26:32.169726 2026] [:error] [pid 25635:tid 25653] [client 89.251.0.132:40175] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Apr 23 07:26:32.463008 2026] [:error] [pid 25635:tid 25659] [client 89.251.0.132:40175] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aelZKMRxv6UsgRGKB3LgvwAAARQ"]
[Thu Apr 23 07:26:33.501858 2026] [:error] [pid 64967:tid 64971] [client 89.251.0.141:59593] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aelZKYAV4GfOOdX8QzoRhwAAAYI"]
[Thu Apr 23 07:26:34.087945 2026] [:error] [pid 42972:tid 43038] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Apr 23 07:26:34.397679 2026] [:error] [pid 42972:tid 43035] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Apr 23 07:26:35.389392 2026] [:error] [pid 42972:tid 43023] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Apr 23 07:26:37.083494 2026] [:error] [pid 42972:tid 43018] [client 89.251.0.147:52749] [client 89.251.0.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.147, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/js/wp-login.php"] [unique_id "aelZLcOAb-3sOknsk4cetQAAAEI"]
[Thu Apr 23 07:26:37.757687 2026] [:error] [pid 42972:tid 43039] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Thu Apr 23 07:26:38.043334 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Apr 23 07:26:38.362504 2026] [:error] [pid 42972:tid 43032] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Thu Apr 23 07:26:39.079890 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.147:52749] [client 89.251.0.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.147, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aelZL8OAb-3sOknsk4cexwAAAEg"]
[Thu Apr 23 07:26:40.605526 2026] [:error] [pid 42972:tid 43027] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Apr 23 07:26:40.935745 2026] [:error] [pid 42972:tid 43025] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Thu Apr 23 07:26:41.560792 2026] [:error] [pid 42972:tid 43035] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Thu Apr 23 07:26:42.175939 2026] [:error] [pid 42972:tid 43018] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Apr 23 07:26:43.110976 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Thu Apr 23 07:26:45.388041 2026] [:error] [pid 42972:tid 43031] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 23 07:26:45.700961 2026] [:error] [pid 42972:tid 43040] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Apr 23 07:26:47.291764 2026] [:error] [pid 42972:tid 43030] [client 89.251.0.147:52749] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Apr 23 07:26:47.880715 2026] [:error] [pid 42972:tid 43016] [client 89.251.0.147:52749] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aelZN8OAb-3sOknsk4cfDAAAAEA"]
[Thu Apr 23 07:26:49.050475 2026] [:error] [pid 64998:tid 65014] [client 89.251.0.133:58645] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Apr 23 07:26:49.394798 2026] [:error] [pid 64998:tid 65017] [client 89.251.0.133:58645] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aelZOYV5EysYcTLjmwj1EQAAAc8"]
[Thu Apr 23 07:26:50.325621 2026] [:error] [pid 25635:tid 25647] [client 89.251.0.121:59679] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Apr 23 07:26:50.618140 2026] [:error] [pid 25635:tid 25641] [client 89.251.0.121:59679] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aelZOsRxv6UsgRGKB3LhIgAAAQI"]
[Thu Apr 23 07:26:51.853105 2026] [:error] [pid 42971:tid 43004] [client 89.251.0.129:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Apr 23 07:26:52.508878 2026] [:error] [pid 42971:tid 42989] [client 89.251.0.129:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Apr 23 07:26:53.202524 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.129:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu Apr 23 07:26:53.534369 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.129:30107] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Thu Apr 23 07:26:54.316522 2026] [:error] [pid 42971:tid 43007] [client 89.251.0.129:30107] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aelZPjEP2_5RswrH8bGpJgAAABU"]
[Thu Apr 23 07:26:54.973776 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.135:26579] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Thu Apr 23 07:26:55.284968 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.135:26579] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Apr 23 07:26:55.720910 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.135:26579] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aelZP76vRb9j6psK2ZaXZAAAAhA"]
[Thu Apr 23 07:26:56.648867 2026] [:error] [pid 42971:tid 42988] [client 89.251.0.127:21855] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aelZQDEP2_5RswrH8bGpQgAAAAI"]
[Thu Apr 23 07:26:57.659510 2026] [:error] [pid 43083:tid 43093] [client 89.251.0.125:28415] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Apr 23 07:26:58.634770 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.125:28415] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Thu Apr 23 07:26:58.940469 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.125:28415] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Thu Apr 23 07:26:59.279904 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.125:28415] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aelZQzC5hrvNXosL83LJWwAAAMI"]
[Thu Apr 23 07:26:59.906434 2026] [:error] [pid 42971:tid 42986] [client 89.251.0.132:36263] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aelZQzEP2_5RswrH8bGpVwAAAAA"]
[Thu Apr 23 07:27:00.629188 2026] [:error] [pid 25635:tid 25639] [client 89.251.0.129:34351] [client 89.251.0.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/theme-editor.php"] [unique_id "aelZRMRxv6UsgRGKB3LhTQAAAQA"]
[Thu Apr 23 07:27:03.150933 2026] [:error] [pid 42971:tid 43007] [client 89.251.0.142:37085] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Thu Apr 23 07:27:03.468166 2026] [:error] [pid 42971:tid 43000] [client 89.251.0.142:37085] [client 89.251.0.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/languages/index.php"] [unique_id "aelZRzEP2_5RswrH8bGpbAAAAA4"]
[Thu Apr 23 07:27:04.357455 2026] [:error] [pid 43083:tid 43094] [client 89.251.0.136:54089] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aelZSDC5hrvNXosL83LJwQAAAMk"]
[Thu Apr 23 07:27:05.370623 2026] [:error] [pid 42972:tid 43036] [client 89.251.0.133:52423] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aelZScOAb-3sOknsk4cfgwAAAFQ"]
[Thu Apr 23 07:27:06.326535 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.138:31401] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Apr 23 07:27:06.627652 2026] [:error] [pid 43083:tid 43093] [client 89.251.0.138:31401] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Apr 23 07:27:06.963901 2026] [:error] [pid 43083:tid 43096] [client 89.251.0.138:31401] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aelZSjC5hrvNXosL83LJ8wAAAMs"]
[Thu Apr 23 07:27:08.927930 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.145:20347] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Thu Apr 23 07:27:09.229608 2026] [:error] [pid 43083:tid 43085] [client 89.251.0.145:20347] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Thu Apr 23 07:27:09.892254 2026] [:error] [pid 43083:tid 43091] [client 89.251.0.145:20347] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Apr 23 07:27:10.931053 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.145:20347] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aelZTjC5hrvNXosL83LKJQAAANg"]
[Thu Apr 23 07:27:11.658607 2026] [:error] [pid 64998:tid 65022] [client 89.251.0.137:27553] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Thu Apr 23 07:27:12.688368 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.137:27553] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aelZUIV5EysYcTLjmwj2JAAAAcY"]
[Thu Apr 23 07:27:13.931952 2026] [:error] [pid 64967:tid 64970] [client 89.251.0.114:58919] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Thu Apr 23 07:27:14.913308 2026] [:error] [pid 64967:tid 64972] [client 89.251.0.114:58919] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Thu Apr 23 07:27:15.223831 2026] [:error] [pid 64967:tid 64975] [client 89.251.0.114:58919] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Thu Apr 23 07:27:15.826150 2026] [:error] [pid 64967:tid 64976] [client 89.251.0.114:58919] [client 89.251.0.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.114, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aelZU4AV4GfOOdX8QzoS2gAAAYc"]
[Thu Apr 23 07:27:17.475962 2026] [:error] [pid 64967:tid 64977] [client 89.251.0.114:58919] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aelZVYAV4GfOOdX8QzoS9AAAAYg"]
[Thu Apr 23 07:27:18.174168 2026] [:error] [pid 25635:tid 25647] [client 89.251.0.141:45959] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Thu Apr 23 07:27:18.523123 2026] [:error] [pid 25635:tid 25657] [client 89.251.0.141:45959] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aelZVsRxv6UsgRGKB3LhpwAAARI"]
[Thu Apr 23 07:27:19.201278 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.146:58043] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Thu Apr 23 07:27:19.830337 2026] [:error] [pid 43083:tid 43094] [client 89.251.0.146:58043] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Apr 23 07:27:20.445586 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.146:58043] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aelZWDC5hrvNXosL83LKnwAAAMw"]
[Thu Apr 23 07:27:21.903114 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.136:32571] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Thu Apr 23 07:27:22.274176 2026] [:error] [pid 43083:tid 43100] [client 89.251.0.136:32571] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Apr 23 07:27:22.572734 2026] [:error] [pid 43083:tid 43103] [client 89.251.0.136:32571] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aelZWjC5hrvNXosL83LKsgAAANI"]
[Thu Apr 23 07:27:23.218793 2026] [:error] [pid 59700:tid 59717] [client 89.251.0.138:44857] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aelZW5XyGZJFeAIDWtlZWgAAAU8"]
[Thu Apr 23 07:27:23.833087 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.144:51187] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Thu Apr 23 07:27:24.159704 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.144:51187] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Thu Apr 23 07:27:24.794875 2026] [:error] [pid 43083:tid 43086] [client 89.251.0.144:51187] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aelZXDC5hrvNXosL83LKxgAAAME"]
[Thu Apr 23 07:27:25.407115 2026] [:error] [pid 64998:tid 65017] [client 89.251.0.119:33287] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Thu Apr 23 07:27:26.039014 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.119:33287] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Thu Apr 23 07:27:26.376145 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.119:33287] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aelZXoV5EysYcTLjmwj2kAAAAdE"]
[Thu Apr 23 07:27:27.274841 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.139:42849] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/db.php"] [unique_id "aelZX5XyGZJFeAIDWtlZiQAAAUM"]
[Thu Apr 23 07:27:27.969866 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.136:47827] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aelZX4V5EysYcTLjmwj2ngAAAdM"]
[Thu Apr 23 07:27:28.568369 2026] [:error] [pid 42973:tid 43059] [client 89.251.0.126:54755] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aelZYG6I0QqmmmLTHE3a0QAAAJA"]
[Thu Apr 23 07:27:29.174041 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.151:20845] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aelZYcOAb-3sOknsk4cgvAAAAEU"]
[Thu Apr 23 07:27:29.768833 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.145:51959] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aelZYb6vRb9j6psK2ZaY-wAAAgk"]
[Thu Apr 23 07:27:30.356726 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.145:49395] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aelZYpXyGZJFeAIDWtlZpAAAAUI"]
[Thu Apr 23 07:27:31.594099 2026] [:error] [pid 42971:tid 43000] [client 89.251.0.146:45729] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aelZYzEP2_5RswrH8bGqcgAAAA4"]
[Thu Apr 23 07:27:32.422443 2026] [:error] [pid 64998:tid 65004] [client 89.251.0.135:61821] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aelZZIV5EysYcTLjmwj2xAAAAcI"]
[Thu Apr 23 07:27:33.137675 2026] [:error] [pid 64967:tid 64989] [client 89.251.0.148:52369] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aelZZYAV4GfOOdX8QzoTggAAAZQ"]
[Thu Apr 23 07:27:34.857318 2026] [:error] [pid 43083:tid 43091] [client 89.251.0.141:61021] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aelZZjC5hrvNXosL83LLQAAAAMY"]
[Thu Apr 23 07:27:35.513573 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.133:29519] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aelZZzC5hrvNXosL83LLRgAAAMw"]
[Thu Apr 23 07:27:36.238474 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.137:34429] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Thu Apr 23 07:27:37.291139 2026] [:error] [pid 59700:tid 59702] [client 89.251.0.137:34429] [client 89.251.0.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.137, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aelZaZXyGZJFeAIDWtlZ3QAAAUA"]
[Thu Apr 23 07:27:41.671356 2026] [:error] [pid 59700:tid 59710] [client 89.251.0.137:34429] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aelZbZXyGZJFeAIDWtlaDwAAAUg"]
[Thu Apr 23 07:27:47.333937 2026] [:error] [pid 25635:tid 25650] [client 89.251.0.119:56881] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Apr 23 07:27:47.669959 2026] [:error] [pid 25635:tid 25662] [client 89.251.0.119:56881] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Thu Apr 23 07:27:48.991888 2026] [:error] [pid 25635:tid 25644] [client 89.251.0.119:56881] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Thu Apr 23 07:27:49.315211 2026] [:error] [pid 25635:tid 25655] [client 89.251.0.119:56881] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Thu Apr 23 07:27:53.290919 2026] [:error] [pid 25635:tid 25640] [client 89.251.0.119:56881] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Thu Apr 23 07:27:53.610965 2026] [:error] [pid 25635:tid 25642] [client 89.251.0.119:56881] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Thu Apr 23 07:27:53.964827 2026] [:error] [pid 25635:tid 25647] [client 89.251.0.119:56881] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Apr 23 07:27:54.310558 2026] [:error] [pid 25635:tid 25654] [client 89.251.0.119:56881] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Thu Apr 23 07:27:54.834528 2026] [:error] [pid 25635:tid 25653] [client 89.251.0.119:56881] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aelZesRxv6UsgRGKB3LihAAAAQ4"]
[Thu Apr 23 07:27:55.581415 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.135:39451] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aelZe76vRb9j6psK2ZaaTgAAAhA"]
[Thu Apr 23 07:27:56.185574 2026] [:error] [pid 42971:tid 42992] [client 89.251.0.124:50179] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aelZfDEP2_5RswrH8bGrUgAAAAY"]
[Thu Apr 23 07:27:57.232092 2026] [:error] [pid 64998:tid 65013] [client 89.251.0.136:53279] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Thu Apr 23 07:27:57.639414 2026] [:error] [pid 64998:tid 65025] [client 89.251.0.136:53279] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Thu Apr 23 07:27:58.259382 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.136:53279] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Thu Apr 23 07:27:58.901400 2026] [:error] [pid 64998:tid 65014] [client 89.251.0.136:53279] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aelZfoV5EysYcTLjmwj3ygAAAcw"]
[Thu Apr 23 07:27:59.521025 2026] [:error] [pid 59700:tid 59717] [client 89.251.0.132:30777] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aelZf5XyGZJFeAIDWtlajwAAAU8"]
[Thu Apr 23 07:28:00.218853 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.121:20137] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aelZgJXyGZJFeAIDWtlalQAAAUI"]
[Thu Apr 23 07:28:02.404054 2026] [:error] [pid 64998:tid 65003] [client 89.251.0.129:53365] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aelZgoV5EysYcTLjmwj32AAAAcE"]
[Thu Apr 23 07:28:03.342271 2026] [:error] [pid 42972:tid 43016] [client 89.251.0.129:21305] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aelZg8OAb-3sOknsk4ch0gAAAEA"]
[Thu Apr 23 07:28:04.676827 2026] [:error] [pid 42973:tid 43057] [client 89.251.0.127:27769] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aelZhG6I0QqmmmLTHE3bjwAAAI4"]
[Thu Apr 23 07:28:09.404890 2026] [:error] [pid 64998:tid 65007] [client 89.251.0.116:33005] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aelZiYV5EysYcTLjmwj4GgAAAcU"]
[Thu Apr 23 07:28:10.070410 2026] [:error] [pid 64967:tid 64983] [client 89.251.0.134:36817] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Thu Apr 23 07:28:10.380322 2026] [:error] [pid 64967:tid 64973] [client 89.251.0.134:36817] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/about.php"] [unique_id "aelZioAV4GfOOdX8QzoUcwAAAYQ"]
[Thu Apr 23 07:28:11.840494 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.127:39653] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Thu Apr 23 07:28:13.313922 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.127:39653] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Apr 23 07:28:13.604103 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.127:39653] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aelZjb6vRb9j6psK2ZabbwAAAg4"]
[Thu Apr 23 07:28:14.884056 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.128:61399] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aelZjjEP2_5RswrH8bGrvQAAABQ"]
[Thu Apr 23 07:28:20.522604 2026] [:error] [pid 42973:tid 43055] [client 89.251.0.135:45675] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aelZlG6I0QqmmmLTHE3cBwAAAIw"]
[Thu Apr 23 07:28:22.374733 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.115:55309] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aelZljC5hrvNXosL83LNrgAAANM"]
[Thu Apr 23 07:28:23.331334 2026] [:error] [pid 64998:tid 65026] [client 89.251.0.143:58913] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Apr 23 07:28:23.632035 2026] [:error] [pid 64998:tid 65012] [client 89.251.0.143:58913] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aelZl4V5EysYcTLjmwj4pAAAAco"]
[Thu Apr 23 07:28:24.205006 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.141:61573] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aelZmL6vRb9j6psK2ZacBwAAAgw"]
[Thu Apr 23 07:28:26.418950 2026] [:error] [pid 64998:tid 65012] [client 89.251.0.124:61169] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aelZmoV5EysYcTLjmwj4yQAAAco"]
[Thu Apr 23 07:28:27.095082 2026] [:error] [pid 59700:tid 59716] [client 89.251.0.114:55191] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Thu Apr 23 07:28:28.837084 2026] [:error] [pid 59700:tid 59712] [client 89.251.0.114:55191] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Thu Apr 23 07:28:29.123845 2026] [:error] [pid 59700:tid 59709] [client 89.251.0.114:55191] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aelZnZXyGZJFeAIDWtlbZgAAAUc"]
[Thu Apr 23 07:28:30.380572 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.138:59971] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Thu Apr 23 07:28:31.352816 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.138:59971] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aelZn76vRb9j6psK2ZacaQAAAgM"]
[Thu Apr 23 07:28:32.107931 2026] [:error] [pid 59700:tid 59726] [client 89.251.0.124:51761] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aelZoJXyGZJFeAIDWtlbgwAAAVg"]
[Thu Apr 23 07:28:33.139116 2026] [:error] [pid 42973:tid 43060] [client 89.251.0.125:43683] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aelZoW6I0QqmmmLTHE3cSgAAAJE"]
[Thu Apr 23 07:28:34.478483 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.116:37875] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aelZor6vRb9j6psK2ZaciQAAAhc"]
[Thu Apr 23 07:28:35.133616 2026] [:error] [pid 42971:tid 43007] [client 89.251.0.145:45277] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aelZozEP2_5RswrH8bGsUQAAABU"]
[Thu Apr 23 07:28:36.926958 2026] [:error] [pid 64967:tid 64978] [client 89.251.0.114:56191] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Thu Apr 23 07:28:38.603613 2026] [:error] [pid 64967:tid 64983] [client 89.251.0.114:56191] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aelZpoAV4GfOOdX8QzoVnQAAAY4"]
[Thu Apr 23 07:28:39.951569 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.129:21589] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aelZp76vRb9j6psK2ZacyAAAAhQ"]
[Thu Apr 23 07:28:40.603388 2026] [:error] [pid 64967:tid 64978] [client 89.251.0.128:61967] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aelZqIAV4GfOOdX8QzoVpwAAAYk"]
[Thu Apr 23 07:28:41.719584 2026] [:error] [pid 43083:tid 43094] [client 89.251.0.151:54479] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Thu Apr 23 07:28:42.115426 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.151:54479] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aelZqjC5hrvNXosL83LOpwAAANY"]
[Thu Apr 23 07:28:43.238037 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.132:53995] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aelZq5XyGZJFeAIDWtlcCAAAAUM"]
[Thu Apr 23 07:28:46.521680 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.140:44479] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aelZroV5EysYcTLjmwj5vAAAAcM"]
[Thu Apr 23 07:28:47.516401 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.141:37581] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Thu Apr 23 07:28:48.199701 2026] [:error] [pid 43083:tid 43085] [client 89.251.0.141:37581] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aelZsDC5hrvNXosL83LOzwAAAMA"]
[Thu Apr 23 07:28:50.780281 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.116:39485] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aelZsjC5hrvNXosL83LO6gAAANM"]
[Thu Apr 23 07:28:51.765693 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.142:61671] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/as.php"] [unique_id "aelZs4V5EysYcTLjmwj56QAAAcg"]
[Thu Apr 23 07:28:52.705548 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.142:34027] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aelZtL6vRb9j6psK2ZadQgAAAhY"]
[Thu Apr 23 07:28:53.352785 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.121:43869] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/install.php"] [unique_id "aelZtTEP2_5RswrH8bGs7AAAABc"]
[Thu Apr 23 07:28:54.979572 2026] [:error] [pid 59700:tid 59707] [client 89.251.0.137:54633] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aelZtpXyGZJFeAIDWtlcYgAAAUU"]
[Thu Apr 23 07:28:57.700875 2026] [:error] [pid 42973:tid 43046] [client 89.251.0.113:54339] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aelZuW6I0QqmmmLTHE3cxQAAAIM"]
[Thu Apr 23 07:28:59.878502 2026] [:error] [pid 59700:tid 59709] [client 89.251.0.126:59679] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aelZu5XyGZJFeAIDWtlclwAAAUc"]
[Thu Apr 23 07:29:01.435451 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.127:47665] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Thu Apr 23 07:29:01.914008 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.127:47665] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aelZvb6vRb9j6psK2ZadxQAAAhQ"]
[Thu Apr 23 07:29:03.268468 2026] [:error] [pid 64967:tid 64983] [client 89.251.0.148:61823] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aelZv4AV4GfOOdX8QzoWEAAAAY4"]
[Thu Apr 23 07:29:04.003489 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.131:58455] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Thu Apr 23 07:29:05.695745 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.131:58455] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aelZwTC5hrvNXosL83LPowAAANQ"]
[Thu Apr 23 07:29:06.802280 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.125:38063] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aelZwsRxv6UsgRGKB3Lj4wAAAQY"]
[Thu Apr 23 07:29:07.809611 2026] [:error] [pid 43083:tid 43085] [client 89.251.0.113:55925] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aelZwzC5hrvNXosL83LPswAAAMA"]
[Thu Apr 23 07:29:09.180510 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.142:28955] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aelZxTEP2_5RswrH8bGtnQAAAAs"]
[Thu Apr 23 07:29:12.458527 2026] [:error] [pid 59700:tid 59726] [client 89.251.0.134:45653] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aelZyJXyGZJFeAIDWtlc9gAAAVg"]
[Thu Apr 23 07:29:13.504088 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.132:35847] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aelZyTC5hrvNXosL83LP3wAAAMo"]
[Thu Apr 23 07:29:16.296419 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.139:34135] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aelZzDEP2_5RswrH8bGt_gAAAAg"]
[Thu Apr 23 07:29:17.013093 2026] [:error] [pid 59700:tid 59721] [client 89.251.0.132:46759] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aelZzZXyGZJFeAIDWtldIwAAAVM"]
[Thu Apr 23 07:29:18.319731 2026] [:error] [pid 42972:tid 43037] [client 89.251.0.132:58797] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aelZzsOAb-3sOknsk4cj6QAAAFU"]
[Thu Apr 23 07:29:19.093787 2026] [:error] [pid 42971:tid 42989] [client 89.251.0.129:37587] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aelZzzEP2_5RswrH8bGuIQAAAAM"]
[Thu Apr 23 07:29:19.790561 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.139:30963] [client 89.251.0.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.139, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aelZzzC5hrvNXosL83LQHAAAANU"]
[Thu Apr 23 07:29:19.807984 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.139:30963] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Thu Apr 23 07:29:20.096926 2026] [:error] [pid 43083:tid 43085] [client 89.251.0.139:30963] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aelZ0DC5hrvNXosL83LQIAAAAMA"]
[Thu Apr 23 07:29:21.714466 2026] [:error] [pid 59700:tid 59713] [client 89.251.0.133:62019] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Thu Apr 23 07:29:22.081010 2026] [:error] [pid 59700:tid 59724] [client 89.251.0.133:62019] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aelZ0pXyGZJFeAIDWtldXAAAAVY"]
[Thu Apr 23 07:29:22.769666 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.124:37701] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/network.php"] [unique_id "aelZ0r6vRb9j6psK2ZaecwAAAgg"]
[Thu Apr 23 07:29:23.293659 2026] [:error] [pid 42973:tid 43065] [client 89.251.0.115:46015] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Thu Apr 23 07:29:25.547344 2026] [:error] [pid 42973:tid 43062] [client 89.251.0.115:46015] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aelZ1W6I0QqmmmLTHE3dbwAAAJM"]
[Thu Apr 23 07:29:26.226910 2026] [:error] [pid 64998:tid 65018] [client 89.251.0.133:41131] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aelZ1oV5EysYcTLjmwj7NAAAAdA"]
[Thu Apr 23 07:29:27.490213 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.126:47639] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aelZ1zC5hrvNXosL83LQfQAAANQ"]
[Thu Apr 23 07:29:28.120622 2026] [:error] [pid 64998:tid 65024] [client 89.251.0.115:54373] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aelZ2IV5EysYcTLjmwj7awAAAdY"]
[Thu Apr 23 07:29:28.823708 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.116:33391] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Thu Apr 23 07:29:29.129329 2026] [:error] [pid 65000:tid 65052] [client 89.251.0.116:33391] [client 89.251.0.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.116, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aelZ2b6vRb9j6psK2ZaepgAAAhM"]
[Thu Apr 23 07:29:29.855588 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.116:33391] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aelZ2b6vRb9j6psK2ZaerQAAAhA"]
[Thu Apr 23 07:29:32.319188 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.138:54307] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aelZ3DC5hrvNXosL83LQxgAAAMI"]
[Thu Apr 23 07:29:32.929250 2026] [:error] [pid 64998:tid 65012] [client 89.251.0.128:47845] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Thu Apr 23 07:29:33.488494 2026] [:error] [pid 64998:tid 65007] [client 89.251.0.128:47845] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aelZ3YV5EysYcTLjmwj7wwAAAcU"]
[Thu Apr 23 07:29:34.137676 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.140:27987] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aelZ3r6vRb9j6psK2ZaevgAAAg0"]
[Thu Apr 23 07:29:34.787833 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.147:36507] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Thu Apr 23 07:29:35.802544 2026] [:error] [pid 65000:tid 65051] [client 89.251.0.147:36507] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aelZ376vRb9j6psK2Zae8gAAAhI"]
[Thu Apr 23 07:29:37.082348 2026] [:error] [pid 43083:tid 43090] [client 89.251.0.133:33993] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aelZ4TC5hrvNXosL83LRHgAAAMU"]
[Thu Apr 23 07:29:37.665246 2026] [:error] [pid 59700:tid 59706] [client 89.251.0.121:63605] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Thu Apr 23 07:29:38.401858 2026] [:error] [pid 59700:tid 59703] [client 89.251.0.121:63605] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Apr 23 07:29:39.079255 2026] [:error] [pid 59700:tid 59723] [client 89.251.0.121:63605] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aelZ45XyGZJFeAIDWtld-AAAAVU"]
[Thu Apr 23 07:29:39.782088 2026] [:error] [pid 25635:tid 25649] [client 89.251.0.136:52851] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aelZ48Rxv6UsgRGKB3LkpgAAAQo"]
[Thu Apr 23 07:29:40.769894 2026] [:error] [pid 59700:tid 59719] [client 89.251.0.139:37853] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/count.php"] [unique_id "aelZ5JXyGZJFeAIDWtleFAAAAVE"]
[Thu Apr 23 07:29:42.415004 2026] [:error] [pid 59700:tid 59706] [client 89.251.0.113:52899] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Thu Apr 23 07:29:44.621387 2026] [:error] [pid 59700:tid 59726] [client 89.251.0.113:52899] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aelZ6JXyGZJFeAIDWtleYwAAAVg"]
[Thu Apr 23 07:29:46.917008 2026] [:error] [pid 42972:tid 43018] [client 89.251.0.113:31783] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||www.windfc.windfarmcoolants.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/images/stories/themes.php"] [unique_id "aelZ6sOAb-3sOknsk4cksQAAAEI"]
[Thu Apr 23 07:29:47.256540 2026] [:error] [pid 42972:tid 43032] [client 89.251.0.113:31783] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aelZ68OAb-3sOknsk4cksgAAAFA"]
[Thu Apr 23 07:29:48.569104 2026] [:error] [pid 59700:tid 59717] [client 89.251.0.147:54353] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aelZ7JXyGZJFeAIDWtlerQAAAU8"]
[Thu Apr 23 07:29:49.208655 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.142:25875] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aelZ7YV5EysYcTLjmwj8YgAAAc4"]
[Thu Apr 23 07:29:50.382062 2026] [:error] [pid 64998:tid 65022] [client 89.251.0.147:60709] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Apr 23 07:29:51.617472 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.147:60709] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aelZ74V5EysYcTLjmwj8kQAAAc4"]
[Thu Apr 23 07:29:53.071727 2026] [:error] [pid 64967:tid 64974] [client 89.251.0.135:62973] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aelZ8YAV4GfOOdX8QzoW8QAAAYU"]
[Thu Apr 23 07:29:54.111926 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.143:27679] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aelZ8jC5hrvNXosL83LSTgAAAMw"]
[Thu Apr 23 07:29:54.646309 2026] [:error] [pid 59700:tid 59726] [client 89.251.0.125:28927] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Thu Apr 23 07:29:56.475399 2026] [:error] [pid 59700:tid 59721] [client 89.251.0.125:28927] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aelZ9JXyGZJFeAIDWtle9AAAAVM"]
[Thu Apr 23 07:29:57.120648 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.121:30067] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aelZ9TC5hrvNXosL83LScwAAANM"]
[Thu Apr 23 07:29:57.737097 2026] [:error] [pid 64967:tid 64978] [client 89.251.0.140:45083] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Apr 23 07:29:58.081853 2026] [:error] [pid 64967:tid 64985] [client 89.251.0.140:45083] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aelZ9oAV4GfOOdX8QzoXDgAAAZA"]
[Thu Apr 23 07:29:58.939610 2026] [:error] [pid 42973:tid 43050] [client 89.251.0.116:36947] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aelZ9m6I0QqmmmLTHE3dyQAAAIc"]
[Thu Apr 23 07:30:00.543950 2026] [:error] [pid 42972:tid 43037] [client 89.251.0.138:27307] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aelZ-MOAb-3sOknsk4clMQAAAFU"]
[Thu Apr 23 07:30:02.097565 2026] [:error] [pid 25635:tid 25642] [client 89.251.0.126:22443] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aelZ-sRxv6UsgRGKB3LlGAAAAQM"]
[Thu Apr 23 07:30:02.976975 2026] [:error] [pid 43083:tid 43093] [client 89.251.0.146:24653] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aelZ-jC5hrvNXosL83LSjwAAAMg"]
[Thu Apr 23 07:30:05.184689 2026] [:error] [pid 64998:tid 65011] [client 89.251.0.125:29497] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aelZ_YV5EysYcTLjmwj86wAAAck"]
[Thu Apr 23 07:30:07.662981 2026] [:error] [pid 64967:tid 64982] [client 89.251.0.121:61669] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aelZ_4AV4GfOOdX8QzoXMgAAAY0"]
[Thu Apr 23 07:30:08.391785 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.134:63481] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Thu Apr 23 07:30:09.399965 2026] [:error] [pid 43083:tid 43098] [client 89.251.0.134:63481] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aelaATC5hrvNXosL83LS0wAAAM0"]
[Thu Apr 23 07:30:10.214516 2026] [:error] [pid 25635:tid 25656] [client 89.251.0.114:57947] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aelaAsRxv6UsgRGKB3LlWQAAARE"]
[Thu Apr 23 07:30:10.984069 2026] [:error] [pid 25635:tid 25661] [client 89.251.0.114:53445] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aelaAsRxv6UsgRGKB3LlXQAAARY"]
[Thu Apr 23 07:30:11.769086 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.114:32507] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Thu Apr 23 07:30:12.532601 2026] [:error] [pid 42972:tid 43019] [client 89.251.0.114:32507] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aelaBMOAb-3sOknsk4clkQAAAEM"]
[Thu Apr 23 07:30:13.169455 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.146:38831] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Thu Apr 23 07:30:13.894378 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.146:38831] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aelaBTC5hrvNXosL83LTEQAAAMc"]
[Thu Apr 23 07:30:14.717254 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.148:36525] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aelaBr6vRb9j6psK2ZagOQAAAgs"]
[Thu Apr 23 07:30:15.926992 2026] [:error] [pid 42972:tid 43025] [client 89.251.0.116:43793] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aelaB8OAb-3sOknsk4clpwAAAEk"]
[Thu Apr 23 07:30:17.599771 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.129:41801] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aelaCb6vRb9j6psK2ZagbAAAAhA"]
[Thu Apr 23 07:30:18.967442 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.147:40641] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aelaCr6vRb9j6psK2ZagtwAAAgo"]
[Thu Apr 23 07:30:22.957446 2026] [:error] [pid 64967:tid 64982] [client 89.251.0.141:35837] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aelaDoAV4GfOOdX8QzoXfAAAAY0"]
[Thu Apr 23 07:30:23.585047 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.140:61027] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aelaD76vRb9j6psK2ZahNQAAAg4"]
[Thu Apr 23 07:30:24.350805 2026] [:error] [pid 64998:tid 65015] [client 89.251.0.146:30183] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aelaEIV5EysYcTLjmwj9VgAAAc0"]
[Thu Apr 23 07:30:25.794470 2026] [:error] [pid 59700:tid 59724] [client 89.251.0.116:28653] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aelaEZXyGZJFeAIDWtlfwAAAAVY"]
[Thu Apr 23 07:30:27.129570 2026] [:error] [pid 42971:tid 42988] [client 89.251.0.135:30429] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aelaEzEP2_5RswrH8bGwZgAAAAI"]
[Thu Apr 23 07:30:28.998166 2026] [:error] [pid 64998:tid 65009] [client 89.251.0.137:42433] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aelaFIV5EysYcTLjmwj9cwAAAcc"]
[Thu Apr 23 07:30:30.412581 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.138:44801] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aelaFjEP2_5RswrH8bGwoAAAAAs"]
[Thu Apr 23 07:30:31.958955 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.136:49989] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Thu Apr 23 07:30:36.737743 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.136:49989] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aelaHDC5hrvNXosL83LTogAAANM"]
[Thu Apr 23 07:30:40.106072 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.116:45001] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aelaIL6vRb9j6psK2Zah8QAAAgc"]
[Thu Apr 23 07:30:41.406884 2026] [:error] [pid 42971:tid 42997] [client 89.251.0.140:26209] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Thu Apr 23 07:30:41.696697 2026] [:error] [pid 42971:tid 43010] [client 89.251.0.140:26209] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aelaITEP2_5RswrH8bGw9AAAABg"]
[Thu Apr 23 07:30:44.009605 2026] [:error] [pid 42972:tid 43022] [client 89.251.0.139:27601] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aelaJMOAb-3sOknsk4cmUAAAAEY"]
[Thu Apr 23 07:30:45.179598 2026] [:error] [pid 64998:tid 65026] [client 89.251.0.150:65069] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Thu Apr 23 07:30:45.474119 2026] [:error] [pid 64998:tid 65002] [client 89.251.0.150:65069] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aelaJYV5EysYcTLjmwj-PQAAAcA"]
[Thu Apr 23 07:30:46.906417 2026] [:error] [pid 42973:tid 43055] [client 89.251.0.134:29911] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aelaJm6I0QqmmmLTHE3eeAAAAIw"]
[Thu Apr 23 07:30:47.679923 2026] [:error] [pid 25635:tid 25652] [client 89.251.0.142:36131] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Thu Apr 23 07:30:48.027646 2026] [:error] [pid 25635:tid 25643] [client 89.251.0.142:36131] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aelaKMRxv6UsgRGKB3Ll0AAAAQQ"]
[Thu Apr 23 07:30:49.105102 2026] [:error] [pid 59700:tid 59715] [client 89.251.0.140:64927] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aelaKZXyGZJFeAIDWtlgqAAAAU0"]
[Thu Apr 23 07:30:50.872751 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.119:42081] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Thu Apr 23 07:30:51.172662 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.119:42081] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aelaKzC5hrvNXosL83LT9QAAAMo"]
[Thu Apr 23 07:30:53.212784 2026] [:error] [pid 42971:tid 42998] [client 89.251.0.142:59671] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aelaLTEP2_5RswrH8bGxSgAAAAw"]
[Thu Apr 23 07:30:53.858739 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.113:34253] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Thu Apr 23 07:30:54.154424 2026] [:error] [pid 64998:tid 65022] [client 89.251.0.113:34253] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aelaLoV5EysYcTLjmwj-dQAAAdQ"]
[Thu Apr 23 07:30:54.849387 2026] [:error] [pid 42973:tid 43065] [client 89.251.0.121:36183] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aelaLm6I0QqmmmLTHE3ekgAAAJY"]
[Thu Apr 23 07:30:55.543705 2026] [:error] [pid 42973:tid 43043] [client 89.251.0.134:57159] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Thu Apr 23 07:30:56.149049 2026] [:error] [pid 42973:tid 43067] [client 89.251.0.134:57159] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aelaMG6I0QqmmmLTHE3emgAAAJg"]
[Thu Apr 23 07:30:56.778040 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.137:24821] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aelaMDC5hrvNXosL83LUJQAAAMc"]
[Thu Apr 23 07:31:01.700291 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.143:34707] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aelaNb6vRb9j6psK2ZajMgAAAgs"]
[Thu Apr 23 07:31:02.486813 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.147:43333] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aelaNjC5hrvNXosL83LUWAAAAM4"]
[Thu Apr 23 07:31:03.816557 2026] [:error] [pid 59700:tid 59725] [client 89.251.0.133:32891] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/log.php"] [unique_id "aelaN5XyGZJFeAIDWtlhFwAAAVc"]
[Thu Apr 23 07:31:04.584989 2026] [:error] [pid 65000:tid 65051] [client 89.251.0.128:27413] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aelaOL6vRb9j6psK2ZajeQAAAhI"]
[Thu Apr 23 07:31:05.443936 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.125:56583] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aelaOZXyGZJFeAIDWtlhHQAAAUI"]
[Thu Apr 23 07:31:06.322280 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.138:47759] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aelaOoV5EysYcTLjmwj_CQAAAdM"]
[Thu Apr 23 07:31:09.420437 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.146:55005] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aelaPb6vRb9j6psK2Zaj7AAAAhc"]
[Thu Apr 23 07:31:10.056053 2026] [:error] [pid 59700:tid 59723] [client 89.251.0.141:57337] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aelaPpXyGZJFeAIDWtlhOQAAAVU"]
[Thu Apr 23 07:31:11.156107 2026] [:error] [pid 64998:tid 65003] [client 89.251.0.137:46687] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Thu Apr 23 07:31:12.122681 2026] [:error] [pid 64998:tid 65011] [client 89.251.0.137:46687] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aelaQIV5EysYcTLjmwj_OQAAAck"]
[Thu Apr 23 07:31:13.910223 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.127:29957] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aelaQTC5hrvNXosL83LU1wAAANM"]
[Thu Apr 23 07:31:15.343460 2026] [:error] [pid 43083:tid 43086] [client 89.251.0.146:60387] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aelaQzC5hrvNXosL83LU4wAAAME"]
[Thu Apr 23 07:31:15.955600 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.142:25089] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aelaQ76vRb9j6psK2ZakWAAAAgM"]
[Thu Apr 23 07:31:19.077810 2026] [:error] [pid 25635:tid 25658] [client 89.251.0.128:27629] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aelaR8Rxv6UsgRGKB3LmPwAAARM"]
[Thu Apr 23 07:31:19.741489 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.133:57863] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aelaR76vRb9j6psK2ZaklwAAAgU"]
[Thu Apr 23 07:31:21.504561 2026] [:error] [pid 42971:tid 43003] [client 89.251.0.125:36701] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/file.php"] [unique_id "aelaSTEP2_5RswrH8bGxwQAAABE"]
[Thu Apr 23 07:31:22.726032 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.126:35401] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aelaSr6vRb9j6psK2Zak1gAAAhc"]
[Thu Apr 23 07:31:24.762693 2026] [:error] [pid 64967:tid 64991] [client 89.251.0.124:37957] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/load.php"] [unique_id "aelaTIAV4GfOOdX8QzoYdAAAAZY"]
[Thu Apr 23 07:31:25.562017 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.134:44017] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aelaTb6vRb9j6psK2ZalBgAAAgo"]
[Thu Apr 23 07:31:26.331660 2026] [:error] [pid 64998:tid 65011] [client 89.251.0.151:29625] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aelaToV5EysYcTLjmwj_xQAAAck"]
[Thu Apr 23 07:31:29.323501 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.124:35297] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aelaUb6vRb9j6psK2ZalTgAAAgA"]
[Thu Apr 23 07:31:30.150625 2026] [:error] [pid 25635:tid 25659] [client 89.251.0.116:29557] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Thu Apr 23 07:31:31.091192 2026] [:error] [pid 25635:tid 25641] [client 89.251.0.116:29557] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aelaU8Rxv6UsgRGKB3LmUwAAAQI"]
[Thu Apr 23 07:31:34.486279 2026] [:error] [pid 59700:tid 59721] [client 89.251.0.140:29413] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Thu Apr 23 07:31:35.310831 2026] [:error] [pid 59700:tid 59724] [client 89.251.0.140:29413] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aelaV5XyGZJFeAIDWtlh4wAAAVY"]
[Thu Apr 23 07:31:35.995774 2026] [:error] [pid 59700:tid 59706] [client 89.251.0.115:34573] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aelaV5XyGZJFeAIDWtlh6AAAAUQ"]
[Thu Apr 23 07:31:36.728370 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.138:62483] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aelaWDEP2_5RswrH8bGyEwAAABA"]
[Thu Apr 23 07:31:38.802206 2026] [:error] [pid 59700:tid 59710] [client 89.251.0.132:56025] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Apr 23 07:31:40.324454 2026] [:error] [pid 59700:tid 59725] [client 89.251.0.132:56025] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aelaXJXyGZJFeAIDWtliEwAAAVc"]
[Thu Apr 23 07:31:42.196921 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.124:54247] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aelaXoV5EysYcTLjmwgAkgAAAdE"]
[Thu Apr 23 07:31:43.624157 2026] [:error] [pid 64967:tid 64987] [client 89.251.0.125:20843] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aelaX4AV4GfOOdX8QzoYygAAAZI"]
[Thu Apr 23 07:31:44.342480 2026] [:error] [pid 64998:tid 65004] [client 89.251.0.127:54163] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aelaYIV5EysYcTLjmwgAoQAAAcI"]
[Thu Apr 23 07:31:45.052695 2026] [:error] [pid 64967:tid 64972] [client 89.251.0.123:56431] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aelaYYAV4GfOOdX8QzoY1AAAAYM"]
[Thu Apr 23 07:31:46.684905 2026] [:error] [pid 43083:tid 43086] [client 89.251.0.144:46161] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aelaYjC5hrvNXosL83LWDAAAAME"]
[Thu Apr 23 07:31:51.592855 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.148:63895] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ms-pie.php"] [unique_id "aelaZ8Rxv6UsgRGKB3LmfgAAAQY"]
[Thu Apr 23 07:31:56.667215 2026] [:error] [pid 59700:tid 59711] [client 89.251.0.120:38243] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aelabJXyGZJFeAIDWtliXgAAAUk"]
[Thu Apr 23 07:32:00.211298 2026] [:error] [pid 64967:tid 64978] [client 89.251.0.125:49585] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/nav-menu.php"] [unique_id "aelacIAV4GfOOdX8QzoZcgAAAYk"]
[Thu Apr 23 07:32:01.070987 2026] [:error] [pid 43083:tid 43101] [client 89.251.0.142:35571] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aelacTC5hrvNXosL83LWbAAAANA"]
[Thu Apr 23 07:32:08.117487 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.147:43733] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aelaeL6vRb9j6psK2ZamrAAAAg4"]
[Thu Apr 23 07:32:08.754712 2026] [:error] [pid 25635:tid 25658] [client 89.251.0.119:65053] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aelaeMRxv6UsgRGKB3LmvwAAARM"]
[Thu Apr 23 07:32:09.404879 2026] [:error] [pid 64998:tid 65025] [client 89.251.0.121:54869] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aelaeYV5EysYcTLjmwgBjgAAAdc"]
[Thu Apr 23 07:32:10.475352 2026] [:error] [pid 65000:tid 65050] [client 89.251.0.148:38895] [client 89.251.0.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.148, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aelaer6vRb9j6psK2ZamxQAAAhE"]
[Thu Apr 23 07:32:11.201610 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.148:38895] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aelae76vRb9j6psK2ZamzwAAAhg"]
[Thu Apr 23 07:32:11.828647 2026] [:error] [pid 42971:tid 43007] [client 89.251.0.142:30035] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aelaezEP2_5RswrH8bGzPgAAABU"]
[Thu Apr 23 07:32:13.554528 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.137:44483] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aelafb6vRb9j6psK2Zam6gAAAg4"]
[Thu Apr 23 07:32:16.649481 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.142:22327] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aelagL6vRb9j6psK2ZanMgAAAgE"]
[Thu Apr 23 07:32:20.216587 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.127:57521] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aelahIV5EysYcTLjmwgCIAAAAdM"]
[Thu Apr 23 07:32:21.710519 2026] [:error] [pid 64967:tid 64974] [client 89.251.0.113:40649] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aelahYAV4GfOOdX8QzoZzAAAAYU"]
[Thu Apr 23 07:32:27.247474 2026] [:error] [pid 64967:tid 64982] [client 89.251.0.113:43525] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aelai4AV4GfOOdX8QzoZ_AAAAY0"]
[Thu Apr 23 07:32:28.008840 2026] [:error] [pid 42972:tid 43037] [client 89.251.0.127:48427] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aelajMOAb-3sOknsk4coQQAAAFU"]
[Thu Apr 23 07:32:28.661728 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.114:47769] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aelajDC5hrvNXosL83LXJQAAANM"]
[Thu Apr 23 07:32:29.579520 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.116:31351] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aelajb6vRb9j6psK2Zan5wAAAg8"]
[Thu Apr 23 07:32:32.332623 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.121:27955] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aelakL6vRb9j6psK2ZaoBwAAAhc"]
[Thu Apr 23 07:32:34.381216 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.146:35723] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aelakoV5EysYcTLjmwgCqgAAAcM"]
[Thu Apr 23 07:32:37.383771 2026] [:error] [pid 42972:tid 43023] [client 89.251.0.116:28277] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aelalcOAb-3sOknsk4coawAAAEc"]
[Thu Apr 23 07:32:39.934904 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.136:59061] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aelalzEP2_5RswrH8bG0PgAAAAg"]
[Thu Apr 23 07:32:40.549685 2026] [:error] [pid 59700:tid 59715] [client 89.251.0.139:59457] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aelamJXyGZJFeAIDWtljhwAAAU0"]
[Thu Apr 23 07:33:21.594737 2026] [autoindex:error] [pid 65000:tid 65046] [client 89.251.0.148:33071] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 12:12:15.595636 2026] [:error] [pid 42973:tid 43043] [client 69.5.21.178:50864] [client 69.5.21.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/logs/HEAD"] [unique_id "aemcH26I0QqmmmLTHE09JgAAAIA"]
[Thu Apr 23 12:12:29.294652 2026] [:error] [pid 42973:tid 43063] [client 69.5.21.178:53726] [client 69.5.21.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aemcLW6I0QqmmmLTHE09NwAAAJQ"]
[Thu Apr 23 16:53:36.063066 2026] [:error] [pid 42971:tid 42998] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Thu Apr 23 16:53:36.394102 2026] [:error] [pid 42971:tid 42990] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/485.php
[Thu Apr 23 16:53:36.713856 2026] [:error] [pid 42971:tid 43002] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Thu Apr 23 16:53:37.033412 2026] [:error] [pid 42971:tid 42986] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Thu Apr 23 16:53:37.353435 2026] [:error] [pid 42971:tid 42999] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Thu Apr 23 16:53:37.870835 2026] [:error] [pid 42971:tid 43008] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/xminie.php
[Thu Apr 23 16:53:38.190022 2026] [:error] [pid 42971:tid 42987] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Apr 23 16:53:38.513509 2026] [:error] [pid 42971:tid 42992] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/x=34.php
[Thu Apr 23 16:53:38.838488 2026] [:error] [pid 42971:tid 43005] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/insta.php
[Thu Apr 23 16:53:39.171068 2026] [:error] [pid 42971:tid 43006] [client 20.216.173.101:19410] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Thu Apr 23 16:53:39.494194 2026] [:error] [pid 42971:tid 42988] [client 20.216.173.101:19410] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "aeneEzEP2_5RswrH8bEOvwAAAAI"]
[Thu Apr 23 16:53:41.007807 2026] [:error] [pid 42973:tid 43046] [client 20.216.173.101:31474] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "aeneFW6I0QqmmmLTHE3QXAAAAIM"]
[Thu Apr 23 16:53:42.395481 2026] [:error] [pid 64967:tid 64970] [client 20.216.173.101:53933] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "aeneFoAV4GfOOdX8QzpbvAAAAYE"]
[Thu Apr 23 16:53:46.446804 2026] [:error] [pid 42973:tid 43061] [client 20.216.173.101:34338] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "aeneGm6I0QqmmmLTHE3QYwAAAJI"]
[Thu Apr 23 16:53:50.479431 2026] [:error] [pid 42971:tid 43007] [client 20.216.173.101:8457] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aeneHjEP2_5RswrH8bEOxgAAABU"]
[Thu Apr 23 16:53:55.714704 2026] [:error] [pid 42971:tid 43001] [client 20.216.173.101:6982] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aeneIzEP2_5RswrH8bEOygAAAA8"]
[Thu Apr 23 16:53:59.225837 2026] [:error] [pid 42972:tid 43035] [client 20.216.173.101:10477] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aeneJ8OAb-3sOknsk4fYPgAAAFM"]
[Thu Apr 23 16:54:08.239550 2026] [:error] [pid 65000:tid 65031] [client 20.216.173.101:6586] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxcs.php"] [unique_id "aeneML6vRb9j6psK2ZbPPAAAAgI"]
[Thu Apr 23 16:54:13.973210 2026] [:error] [pid 65000:tid 65056] [client 20.216.173.101:1215] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxcs.php"] [unique_id "aeneNb6vRb9j6psK2ZbPWwAAAhc"]
[Thu Apr 23 16:54:18.737534 2026] [:error] [pid 46953:tid 46979] [client 20.216.173.101:55578] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxcs.php"] [unique_id "aeneOknlpdHh-P6wKboMTAAAAlY"]
[Thu Apr 23 16:54:22.482073 2026] [:error] [pid 64998:tid 65019] [client 20.216.173.101:10072] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxcs.php"] [unique_id "aenePoV5EysYcTLjmwj51wAAAdE"]
[Thu Apr 23 16:54:25.247780 2026] [:error] [pid 65000:tid 65041] [client 20.216.173.101:51781] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "aeneQb6vRb9j6psK2ZbPfwAAAgg"]
[Thu Apr 23 16:54:28.125204 2026] [:error] [pid 64998:tid 65016] [client 20.216.173.101:51818] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "aeneRIV5EysYcTLjmwj52AAAAc4"]
[Thu Apr 23 16:54:32.698652 2026] [:error] [pid 65000:tid 65047] [client 20.216.173.101:51829] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "aeneSL6vRb9j6psK2ZbP-AAAAg4"]
[Thu Apr 23 16:54:39.154385 2026] [:error] [pid 59700:tid 59720] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kz.php
[Thu Apr 23 16:54:39.399101 2026] [:error] [pid 59700:tid 59726] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Thu Apr 23 16:54:39.642248 2026] [:error] [pid 59700:tid 59710] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Thu Apr 23 16:54:39.883071 2026] [:error] [pid 59700:tid 59714] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Apr 23 16:54:40.135286 2026] [:error] [pid 59700:tid 59704] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Thu Apr 23 16:54:40.377523 2026] [:error] [pid 59700:tid 59725] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/file-kikikoko.php
[Thu Apr 23 16:54:40.618174 2026] [:error] [pid 59700:tid 59707] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Thu Apr 23 16:54:40.859976 2026] [:error] [pid 59700:tid 59706] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/ganja.php
[Thu Apr 23 16:54:41.101642 2026] [:error] [pid 59700:tid 59703] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 23 16:54:41.343667 2026] [:error] [pid 59700:tid 59709] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/sad821.php
[Thu Apr 23 16:54:41.665374 2026] [:error] [pid 59700:tid 59711] [client 20.216.173.101:48148] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8210.php
[Thu Apr 23 16:54:41.910550 2026] [:error] [pid 59700:tid 59715] [client 20.216.173.101:48148] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "aeneUZXyGZJFeAIDWtnwqAAAAU0"]
[Thu Apr 23 16:54:42.880572 2026] [:error] [pid 64998:tid 65025] [client 20.216.173.101:28080] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "aeneUoV5EysYcTLjmwj53wAAAdc"]
[Thu Apr 23 16:54:44.004050 2026] [:error] [pid 64967:tid 64981] [client 20.216.173.101:33232] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "aeneVIAV4GfOOdX8QzpbzgAAAYw"]
[Thu Apr 23 16:54:44.858796 2026] [:error] [pid 64967:tid 64973] [client 20.216.173.101:28143] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "aeneVIAV4GfOOdX8Qzpb0AAAAYQ"]
[Thu Apr 23 16:54:45.723487 2026] [:error] [pid 65000:tid 65032] [client 20.216.173.101:33257] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "aeneVb6vRb9j6psK2ZbQCAAAAgM"]
[Thu Apr 23 16:54:46.596832 2026] [:error] [pid 65000:tid 65057] [client 20.216.173.101:47186] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "aeneVr6vRb9j6psK2ZbQCgAAAhg"]
[Thu Apr 23 16:54:47.565668 2026] [:error] [pid 65000:tid 65049] [client 20.216.173.101:14413] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "aeneV76vRb9j6psK2ZbQDQAAAhA"]
[Thu Apr 23 16:54:48.950738 2026] [:error] [pid 42972:tid 43034] [client 20.216.173.101:13726] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "aeneWMOAb-3sOknsk4fYbAAAAFI"]
[Thu Apr 23 16:54:50.998765 2026] [:error] [pid 65000:tid 65029] [client 20.216.173.101:33172] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "aeneWr6vRb9j6psK2ZbQGQAAAgA"]
[Thu Apr 23 16:54:53.751075 2026] [:error] [pid 42972:tid 43039] [client 20.216.173.101:33271] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "aeneXcOAb-3sOknsk4fYcAAAAFc"]
[Thu Apr 23 16:54:56.448166 2026] [:error] [pid 65000:tid 65031] [client 20.216.173.101:44292] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "aeneYL6vRb9j6psK2ZbQLwAAAgI"]
[Thu Apr 23 16:54:59.109640 2026] [:error] [pid 42973:tid 43057] [client 20.216.173.101:30732] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "aeneY26I0QqmmmLTHE3QogAAAI4"]
[Thu Apr 23 16:55:02.883435 2026] [:error] [pid 42972:tid 43033] [client 20.216.173.101:1963] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aeneZsOAb-3sOknsk4fYegAAAFE"]
[Thu Apr 23 16:55:07.196379 2026] [:error] [pid 42973:tid 43050] [client 20.216.173.101:33224] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aenea26I0QqmmmLTHE3QrAAAAIc"]
[Thu Apr 23 16:55:09.279177 2026] [:error] [pid 65000:tid 65050] [client 20.216.173.101:13727] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aenebb6vRb9j6psK2ZbQUAAAAhE"]
[Thu Apr 23 16:55:13.580284 2026] [:error] [pid 25635:tid 25651] [client 20.216.173.101:22052] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aeneccRxv6UsgRGKB3IgMgAAAQw"]
[Thu Apr 23 16:55:18.967399 2026] [:error] [pid 42972:tid 43038] [client 20.216.173.101:33679] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aenedsOAb-3sOknsk4fYkAAAAFY"]
[Thu Apr 23 16:55:24.630349 2026] [:error] [pid 65000:tid 65056] [client 20.216.173.101:11171] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aenefL6vRb9j6psK2ZbQxgAAAhc"]
[Thu Apr 23 16:55:27.378072 2026] [:error] [pid 65000:tid 65054] [client 20.216.173.101:45986] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aenef76vRb9j6psK2ZbQzQAAAhU"]
[Thu Apr 23 16:55:28.870964 2026] [:error] [pid 59700:tid 59714] [client 20.216.173.101:29483] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aenegJXyGZJFeAIDWtnwvgAAAUw"]
[Thu Apr 23 16:55:30.538232 2026] [:error] [pid 65000:tid 65049] [client 20.216.173.101:6982] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aenegr6vRb9j6psK2ZbQ0gAAAhA"]
[Thu Apr 23 16:55:33.829682 2026] [:error] [pid 43083:tid 43105] [client 20.216.173.101:36886] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aenehTC5hrvNXosL83JXIwAAANQ"]
[Thu Apr 23 16:55:36.118120 2026] [:error] [pid 42972:tid 43022] [client 20.216.173.101:22840] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aeneiMOAb-3sOknsk4fYoAAAAEY"]
[Thu Apr 23 16:55:38.961610 2026] [:error] [pid 42972:tid 43027] [client 20.216.173.101:25507] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aeneisOAb-3sOknsk4fYpgAAAEs"]
[Thu Apr 23 16:55:42.019698 2026] [:error] [pid 59700:tid 59708] [client 20.216.173.101:10761] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Thu Apr 23 16:55:42.263046 2026] [:error] [pid 59700:tid 59713] [client 20.216.173.101:10761] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Thu Apr 23 16:55:42.506708 2026] [:error] [pid 59700:tid 59718] [client 20.216.173.101:10761] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Thu Apr 23 16:55:42.756884 2026] [:error] [pid 59700:tid 59712] [client 20.216.173.101:10761] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Thu Apr 23 16:55:43.007318 2026] [:error] [pid 59700:tid 59719] [client 20.216.173.101:10761] File does not exist: /usr/local/apache/htdocs/suspended-page/ws66.php
[Thu Apr 23 16:55:43.251182 2026] [:error] [pid 59700:tid 59726] [client 20.216.173.101:10761] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Apr 23 16:55:43.504283 2026] [:error] [pid 59700:tid 59720] [client 20.216.173.101:10761] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Thu Apr 23 16:55:43.770319 2026] [:error] [pid 59700:tid 59717] [client 20.216.173.101:10761] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Thu Apr 23 16:55:44.010543 2026] [:error] [pid 59700:tid 59710] [client 20.216.173.101:10761] [client 20.216.173.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aenekJXyGZJFeAIDWtnwzAAAAUg"]
[Thu Apr 23 16:55:46.505058 2026] [:error] [pid 65000:tid 65037] [client 20.216.173.101:30787] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Apr 23 16:55:46.754300 2026] [:error] [pid 65000:tid 65032] [client 20.216.173.101:30787] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Thu Apr 23 16:55:46.995020 2026] [:error] [pid 65000:tid 65039] [client 20.216.173.101:30787] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Thu Apr 23 16:55:47.232516 2026] [:error] [pid 65000:tid 65029] [client 20.216.173.101:30787] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/roksad1.php"] [unique_id "aenek76vRb9j6psK2ZbQ-AAAAgA"]
[Thu Apr 23 16:55:50.040616 2026] [:error] [pid 64998:tid 65009] [client 20.216.173.101:46070] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/roksad1.php"] [unique_id "aeneloV5EysYcTLjmwj6AAAAAcc"]
[Thu Apr 23 16:55:53.015271 2026] [:error] [pid 43083:tid 43090] [client 20.216.173.101:25481] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/roksad1.php"] [unique_id "aenemTC5hrvNXosL83JXNAAAAMU"]
[Thu Apr 23 16:56:18.234459 2026] [:error] [pid 42973:tid 43051] [client 20.216.173.101:7793] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fone1.php"] [unique_id "aenesm6I0QqmmmLTHE3QzAAAAIg"]
[Thu Apr 23 16:56:20.595800 2026] [:error] [pid 64967:tid 64990] [client 20.216.173.101:18168] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "aenetIAV4GfOOdX8Qzpb6QAAAZU"]
[Thu Apr 23 16:56:23.654772 2026] [:error] [pid 65000:tid 65032] [client 20.216.173.101:18115] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "aenet76vRb9j6psK2ZbRJgAAAgM"]
[Thu Apr 23 16:56:26.149526 2026] [:error] [pid 25635:tid 25640] [client 20.216.173.101:42604] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "aeneusRxv6UsgRGKB3IgSgAAAQE"]
[Thu Apr 23 16:56:26.987842 2026] [:error] [pid 65000:tid 65040] [client 20.216.173.101:1142] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.php"] [unique_id "aeneur6vRb9j6psK2ZbRLAAAAgc"]
[Thu Apr 23 16:56:32.699742 2026] [:error] [pid 25635:tid 25644] [client 20.216.173.101:46059] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "aenewMRxv6UsgRGKB3IgTQAAAQU"]
[Thu Apr 23 16:56:34.535158 2026] [:error] [pid 42972:tid 43029] [client 20.216.173.101:1143] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "aenewsOAb-3sOknsk4fY4AAAAE0"]
[Thu Apr 23 16:56:35.442889 2026] [:error] [pid 42972:tid 43034] [client 20.216.173.101:8315] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "aenew8OAb-3sOknsk4fY4QAAAFI"]
[Thu Apr 23 16:56:38.841091 2026] [:error] [pid 42972:tid 43033] [client 20.216.173.101:46050] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "aenexsOAb-3sOknsk4fY5wAAAFE"]
[Thu Apr 23 16:56:40.979553 2026] [:error] [pid 42972:tid 43018] [client 20.216.173.101:22804] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeneyMOAb-3sOknsk4fY6wAAAEI"]
[Thu Apr 23 16:56:45.385466 2026] [:error] [pid 42973:tid 43067] [client 20.216.173.101:32518] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aenezW6I0QqmmmLTHE3Q6wAAAJg"]
[Thu Apr 23 16:56:48.935120 2026] [:error] [pid 65000:tid 65055] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Thu Apr 23 16:56:49.172558 2026] [:error] [pid 65000:tid 65043] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Thu Apr 23 16:56:49.412175 2026] [:error] [pid 65000:tid 65040] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Thu Apr 23 16:56:49.650873 2026] [:error] [pid 65000:tid 65038] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/wglum1.php
[Thu Apr 23 16:56:49.888270 2026] [:error] [pid 65000:tid 65047] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/ng.php
[Thu Apr 23 16:56:50.126465 2026] [:error] [pid 65000:tid 65039] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/wgift1.php
[Thu Apr 23 16:56:50.397708 2026] [:error] [pid 65000:tid 65050] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/xynz.php
[Thu Apr 23 16:56:50.901677 2026] [:error] [pid 65000:tid 65031] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Thu Apr 23 16:56:51.139523 2026] [:error] [pid 65000:tid 65051] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Thu Apr 23 16:56:51.376992 2026] [:error] [pid 65000:tid 65052] [client 20.216.173.101:10794] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Thu Apr 23 16:56:51.618055 2026] [:error] [pid 65000:tid 65041] [client 20.216.173.101:10794] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d.php"] [unique_id "aene076vRb9j6psK2ZbRUwAAAgg"]
[Thu Apr 23 16:56:53.122925 2026] [:error] [pid 65000:tid 65051] [client 20.216.173.101:30744] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d.php"] [unique_id "aene1b6vRb9j6psK2ZbRXgAAAhI"]
[Thu Apr 23 16:56:55.562812 2026] [:error] [pid 65000:tid 65032] [client 20.216.173.101:1977] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d.php"] [unique_id "aene176vRb9j6psK2ZbRYwAAAgM"]
[Thu Apr 23 16:57:03.873949 2026] [:error] [pid 42973:tid 43058] [client 20.216.173.101:36923] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/d.php"] [unique_id "aene326I0QqmmmLTHE3Q_wAAAI8"]
[Thu Apr 23 16:57:07.579862 2026] [:error] [pid 64998:tid 65007] [client 20.216.173.101:10086] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aene44V5EysYcTLjmwj6WAAAAcU"]
[Thu Apr 23 16:57:15.264592 2026] [:error] [pid 46953:tid 46981] [client 20.216.173.101:64780] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aene60nlpdHh-P6wKboM_AAAAlg"]
[Thu Apr 23 16:57:17.277657 2026] [:error] [pid 42972:tid 43023] [client 20.216.173.101:8887] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aene7cOAb-3sOknsk4fZBQAAAEc"]
[Thu Apr 23 16:57:26.003753 2026] [:error] [pid 64998:tid 65026] [client 20.216.173.101:58347] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/view.php"] [unique_id "aene9oV5EysYcTLjmwj6dQAAAdg"]
[Thu Apr 23 16:57:28.753764 2026] [:error] [pid 65000:tid 65043] [client 20.216.173.101:15036] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/view.php"] [unique_id "aene-L6vRb9j6psK2ZbRpwAAAgo"]
[Thu Apr 23 16:57:31.370037 2026] [:error] [pid 42972:tid 43027] [client 20.216.173.101:19441] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/view.php"] [unique_id "aene-8OAb-3sOknsk4fZDAAAAEs"]
[Thu Apr 23 16:57:35.264435 2026] [:error] [pid 65000:tid 65049] [client 20.216.173.101:60072] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/view.php"] [unique_id "aene_76vRb9j6psK2ZbRtgAAAhA"]
[Thu Apr 23 16:57:54.053802 2026] [:error] [pid 42972:tid 43017] [client 20.216.173.101:1808] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Apr 23 16:57:54.357346 2026] [:error] [pid 42972:tid 43038] [client 20.216.173.101:1808] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 23 16:57:54.673018 2026] [:error] [pid 42972:tid 43025] [client 20.216.173.101:1808] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Thu Apr 23 16:57:54.977801 2026] [:error] [pid 42972:tid 43026] [client 20.216.173.101:1808] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Thu Apr 23 16:57:55.290210 2026] [:error] [pid 42972:tid 43020] [client 20.216.173.101:1808] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Thu Apr 23 16:57:55.593532 2026] [:error] [pid 42972:tid 43037] [client 20.216.173.101:1808] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Thu Apr 23 16:57:55.893478 2026] [:error] [pid 42972:tid 43022] [client 20.216.173.101:1808] [client 20.216.173.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aenfE8OAb-3sOknsk4fZKAAAAEY"]
[Thu Apr 23 16:57:59.841906 2026] [:error] [pid 42971:tid 42991] [client 20.216.173.101:15631] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Apr 23 16:58:00.084091 2026] [:error] [pid 42971:tid 43001] [client 20.216.173.101:15631] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Thu Apr 23 16:58:00.325670 2026] [:error] [pid 42971:tid 42988] [client 20.216.173.101:15631] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Thu Apr 23 16:58:00.576307 2026] [:error] [pid 42971:tid 42994] [client 20.216.173.101:15631] File does not exist: /usr/local/apache/htdocs/suspended-page/zogy1.php
[Thu Apr 23 16:58:00.823619 2026] [:error] [pid 42971:tid 43005] [client 20.216.173.101:15631] File does not exist: /usr/local/apache/htdocs/suspended-page/state.php
[Thu Apr 23 16:58:01.065132 2026] [:error] [pid 42971:tid 43006] [client 20.216.173.101:15631] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ss.php"] [unique_id "aenfGTEP2_5RswrH8bEPGwAAABQ"]
[Thu Apr 23 16:58:03.306670 2026] [:error] [pid 65000:tid 65054] [client 20.216.173.101:43772] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ss.php"] [unique_id "aenfG76vRb9j6psK2ZbR_gAAAhU"]
[Thu Apr 23 16:58:07.798151 2026] [:error] [pid 42971:tid 42990] [client 20.216.173.101:64832] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ss.php"] [unique_id "aenfHzEP2_5RswrH8bEPHQAAAAQ"]
[Thu Apr 23 16:58:09.556142 2026] [:error] [pid 42972:tid 43033] [client 20.216.173.101:43241] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ss.php"] [unique_id "aenfIcOAb-3sOknsk4fZKgAAAFE"]
[Thu Apr 23 16:58:11.447910 2026] [:error] [pid 42971:tid 42999] [client 20.216.173.101:37486] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "aenfIzEP2_5RswrH8bEPHwAAAA0"]
[Thu Apr 23 16:58:16.955452 2026] [:error] [pid 64998:tid 65015] [client 20.216.173.101:7175] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "aenfKIV5EysYcTLjmwj6ngAAAc0"]
[Thu Apr 23 16:58:19.622444 2026] [:error] [pid 64998:tid 65013] [client 20.216.173.101:20775] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "aenfK4V5EysYcTLjmwj6pgAAAcs"]
[Thu Apr 23 16:58:21.805958 2026] [:error] [pid 65000:tid 65030] [client 20.216.173.101:49920] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "aenfLb6vRb9j6psK2ZbSHAAAAgE"]
[Thu Apr 23 16:58:24.255767 2026] [:error] [pid 65000:tid 65048] [client 20.216.173.101:44371] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mifta.php"] [unique_id "aenfML6vRb9j6psK2ZbSJwAAAg8"]
[Thu Apr 23 16:58:28.157698 2026] [:error] [pid 43083:tid 43100] [client 20.216.173.101:31909] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mifta.php"] [unique_id "aenfNDC5hrvNXosL83JXbAAAAM8"]
[Thu Apr 23 16:58:31.713973 2026] [:error] [pid 42972:tid 43039] [client 20.216.173.101:57845] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mifta.php"] [unique_id "aenfN8OAb-3sOknsk4fZOgAAAFc"]
[Thu Apr 23 16:58:35.951182 2026] [:error] [pid 65000:tid 65049] [client 20.216.173.101:43136] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mifta.php"] [unique_id "aenfO76vRb9j6psK2ZbSOgAAAhA"]
[Thu Apr 23 16:58:40.991002 2026] [:error] [pid 65000:tid 65055] [client 20.216.173.101:49979] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aenfQL6vRb9j6psK2ZbSTAAAAhY"]
[Thu Apr 23 16:58:44.453638 2026] [:error] [pid 64998:tid 65023] [client 20.216.173.101:57772] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aenfRIV5EysYcTLjmwj6wgAAAdU"]
[Thu Apr 23 16:58:47.108943 2026] [:error] [pid 42972:tid 43021] [client 20.216.173.101:7216] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws57.php"] [unique_id "aenfR8OAb-3sOknsk4fZSAAAAEU"]
[Thu Apr 23 16:58:54.114507 2026] [:error] [pid 42973:tid 43056] [client 20.216.173.101:30148] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "aenfTm6I0QqmmmLTHE3RSgAAAI0"]
[Thu Apr 23 16:58:57.623923 2026] [:error] [pid 64998:tid 65010] [client 20.216.173.101:57734] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "aenfUYV5EysYcTLjmwj61gAAAcg"]
[Thu Apr 23 16:58:59.313448 2026] [:error] [pid 64998:tid 65005] [client 20.216.173.101:11824] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws86.php"] [unique_id "aenfU4V5EysYcTLjmwj63wAAAcM"]
[Thu Apr 23 16:59:00.032391 2026] [:error] [pid 59700:tid 59726] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Thu Apr 23 16:59:00.313129 2026] [:error] [pid 59700:tid 59714] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Thu Apr 23 16:59:00.552584 2026] [:error] [pid 59700:tid 59708] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Thu Apr 23 16:59:00.854445 2026] [:error] [pid 59700:tid 59724] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Thu Apr 23 16:59:01.095780 2026] [:error] [pid 59700:tid 59715] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Thu Apr 23 16:59:01.338029 2026] [:error] [pid 59700:tid 59723] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 23 16:59:01.598989 2026] [:error] [pid 59700:tid 59704] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Thu Apr 23 16:59:01.949819 2026] [:error] [pid 59700:tid 59717] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 23 16:59:03.524400 2026] [:error] [pid 59700:tid 59717] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Thu Apr 23 16:59:03.907567 2026] [:error] [pid 59700:tid 59716] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 23 16:59:04.146944 2026] [:error] [pid 59700:tid 59719] [client 20.216.173.101:38290] File does not exist: /usr/local/apache/htdocs/suspended-page/areak1.php
[Thu Apr 23 16:59:04.383279 2026] [:error] [pid 59700:tid 59721] [client 20.216.173.101:38290] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sallu.php"] [unique_id "aenfWJXyGZJFeAIDWtnxbwAAAVM"]
[Thu Apr 23 16:59:05.295403 2026] [:error] [pid 46953:tid 46973] [client 20.216.173.101:11835] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sallu.php"] [unique_id "aenfWUnlpdHh-P6wKboNPQAAAlE"]
[Thu Apr 23 16:59:07.369301 2026] [:error] [pid 42972:tid 43027] [client 20.216.173.101:11836] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sallu.php"] [unique_id "aenfW8OAb-3sOknsk4fZVgAAAEs"]
[Thu Apr 23 16:59:16.122840 2026] [:error] [pid 42972:tid 43035] [client 20.216.173.101:20751] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sallu.php"] [unique_id "aenfZMOAb-3sOknsk4fZZQAAAFM"]
[Thu Apr 23 16:59:19.710566 2026] [:error] [pid 65000:tid 65051] [client 20.216.173.101:8006] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny2.php"] [unique_id "aenfZ76vRb9j6psK2ZbSfwAAAhI"]
[Thu Apr 23 16:59:23.904906 2026] [:error] [pid 25635:tid 25640] [client 20.216.173.101:43196] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny2.php"] [unique_id "aenfa8Rxv6UsgRGKB3IgZgAAAQE"]
[Thu Apr 23 16:59:26.390895 2026] [:error] [pid 43083:tid 43107] [client 20.216.173.101:38272] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny2.php"] [unique_id "aenfbjC5hrvNXosL83JXfgAAANY"]
[Thu Apr 23 16:59:28.309383 2026] [:error] [pid 64998:tid 65016] [client 20.216.173.101:44409] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny2.php"] [unique_id "aenfcIV5EysYcTLjmwj69QAAAc4"]
[Thu Apr 23 16:59:31.179898 2026] [:error] [pid 65000:tid 65051] [client 20.216.173.101:59264] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "aenfc76vRb9j6psK2ZbSkgAAAhI"]
[Thu Apr 23 16:59:34.092833 2026] [:error] [pid 65000:tid 65048] [client 20.216.173.101:59284] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "aenfdr6vRb9j6psK2ZbSmAAAAg8"]
[Thu Apr 23 16:59:46.838328 2026] [:error] [pid 42973:tid 43056] [client 20.216.173.101:43136] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gz.php"] [unique_id "aenfgm6I0QqmmmLTHE3RgAAAAI0"]
[Thu Apr 23 16:59:48.517772 2026] [:error] [pid 65000:tid 65039] [client 20.216.173.101:50462] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gz.php"] [unique_id "aenfhL6vRb9j6psK2ZbSxQAAAgY"]
[Thu Apr 23 16:59:49.249749 2026] [:error] [pid 46953:tid 46964] [client 20.216.173.101:56819] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gz.php"] [unique_id "aenfhUnlpdHh-P6wKboNZQAAAkg"]
[Thu Apr 23 16:59:52.098093 2026] [:error] [pid 64998:tid 65013] [client 20.216.173.101:38327] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gz.php"] [unique_id "aenfiIV5EysYcTLjmwj7IAAAAcs"]
[Thu Apr 23 16:59:54.387645 2026] [:error] [pid 64998:tid 65021] [client 20.216.173.101:50473] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aenfioV5EysYcTLjmwj7JAAAAdM"]
[Thu Apr 23 16:59:59.036913 2026] [:error] [pid 25635:tid 25650] [client 20.216.173.101:38318] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aenfj8Rxv6UsgRGKB3IgagAAAQs"]
[Thu Apr 23 17:00:03.699257 2026] [:error] [pid 64998:tid 65023] [client 20.216.173.101:56769] [client 20.216.173.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "aenfk4V5EysYcTLjmwj7SAAAAdU"]
[Thu Apr 23 17:00:12.303551 2026] [:error] [pid 65000:tid 65057] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Thu Apr 23 17:00:12.581479 2026] [:error] [pid 65000:tid 65038] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Thu Apr 23 17:00:12.847482 2026] [:error] [pid 65000:tid 65045] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/ws68.php
[Thu Apr 23 17:00:13.111871 2026] [:error] [pid 65000:tid 65031] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Thu Apr 23 17:00:13.381384 2026] [:error] [pid 65000:tid 65044] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Thu Apr 23 17:00:13.656349 2026] [:error] [pid 65000:tid 65051] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Thu Apr 23 17:00:13.920888 2026] [:error] [pid 65000:tid 65043] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Thu Apr 23 17:00:14.201400 2026] [:error] [pid 65000:tid 65050] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Thu Apr 23 17:00:14.466441 2026] [:error] [pid 65000:tid 65046] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Thu Apr 23 17:00:14.737185 2026] [:error] [pid 65000:tid 65032] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/ws61.php
[Thu Apr 23 17:00:15.013885 2026] [:error] [pid 65000:tid 65054] [client 20.216.173.101:44378] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Thu Apr 23 17:46:08.843405 2026] [:error] [pid 43083:tid 43103] [client 160.30.179.124:42540] [client 160.30.179.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "aenqYDC5hrvNXosL83Jb-AAAANI"]
[Fri Apr 24 03:15:16.842668 2026] [:error] [pid 64998:tid 65004] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Fri Apr 24 03:15:17.171524 2026] [:error] [pid 64998:tid 65007] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/485.php
[Fri Apr 24 03:15:17.503364 2026] [:error] [pid 64998:tid 65003] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Fri Apr 24 03:15:17.831095 2026] [:error] [pid 64998:tid 65010] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Fri Apr 24 03:15:18.160551 2026] [:error] [pid 64998:tid 65023] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Fri Apr 24 03:15:18.460249 2026] [:error] [pid 64998:tid 65013] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/xminie.php
[Fri Apr 24 03:15:18.760266 2026] [:error] [pid 64998:tid 65005] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Apr 24 03:15:19.059730 2026] [:error] [pid 64998:tid 65022] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/x=34.php
[Fri Apr 24 03:15:19.379103 2026] [:error] [pid 64998:tid 65004] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/insta.php
[Fri Apr 24 03:15:19.739350 2026] [:error] [pid 64998:tid 65026] [client 158.158.114.84:24913] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Fri Apr 24 03:15:20.028778 2026] [:error] [pid 64998:tid 65017] [client 158.158.114.84:24913] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "aepvyIV5EysYcTLjmwhb1gAAAc8"]
[Fri Apr 24 03:15:20.955162 2026] [:error] [pid 65000:tid 65032] [client 158.158.114.84:26038] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "aepvyL6vRb9j6psK2Za0YAAAAgM"]
[Fri Apr 24 03:15:22.430130 2026] [:error] [pid 42972:tid 43020] [client 158.158.114.84:6275] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "aepvysOAb-3sOknsk4fg5AAAAEQ"]
[Fri Apr 24 03:15:24.076801 2026] [:error] [pid 42973:tid 43060] [client 158.158.114.84:24919] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "aepvzG6I0QqmmmLTHE2ZIgAAAJE"]
[Fri Apr 24 03:15:25.143450 2026] [:error] [pid 59700:tid 59704] [client 158.158.114.84:59843] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aepvzZXyGZJFeAIDWtmJbQAAAUI"]
[Fri Apr 24 03:15:27.243851 2026] [:error] [pid 25635:tid 25655] [client 158.158.114.84:39308] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aepvz8Rxv6UsgRGKB3JY2AAAARA"]
[Fri Apr 24 03:15:29.968404 2026] [:error] [pid 42973:tid 43051] [client 158.158.114.84:24940] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aepv0W6I0QqmmmLTHE2ZKAAAAIg"]
[Fri Apr 24 03:15:31.501355 2026] [:error] [pid 43083:tid 43096] [client 158.158.114.84:28553] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "aepv0zC5hrvNXosL83K6OgAAAMs"]
[Fri Apr 24 03:15:33.044786 2026] [:error] [pid 59700:tid 59717] [client 158.158.114.84:19351] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxcs.php"] [unique_id "aepv1ZXyGZJFeAIDWtmJgAAAAU8"]
[Fri Apr 24 03:15:34.826870 2026] [:error] [pid 64967:tid 64973] [client 158.158.114.84:19371] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxcs.php"] [unique_id "aepv1oAV4GfOOdX8QzqjoQAAAYQ"]
[Fri Apr 24 03:15:37.304533 2026] [:error] [pid 42973:tid 43061] [client 158.158.114.84:6283] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxcs.php"] [unique_id "aepv2W6I0QqmmmLTHE2ZLwAAAJI"]
[Fri Apr 24 03:15:39.130001 2026] [:error] [pid 42973:tid 43045] [client 158.158.114.84:14917] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxcs.php"] [unique_id "aepv226I0QqmmmLTHE2ZNgAAAII"]
[Fri Apr 24 03:15:41.319890 2026] [:error] [pid 42973:tid 43059] [client 158.158.114.84:52269] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "aepv3W6I0QqmmmLTHE2ZPAAAAJA"]
[Fri Apr 24 03:15:45.072307 2026] [:error] [pid 64998:tid 65018] [client 158.158.114.84:26798] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "aepv4YV5EysYcTLjmwhcAwAAAdA"]
[Fri Apr 24 03:15:47.567047 2026] [:error] [pid 65000:tid 65040] [client 158.158.114.84:24895] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "aepv476vRb9j6psK2Za0gwAAAgc"]
[Fri Apr 24 03:15:51.329024 2026] [:error] [pid 65000:tid 65055] [client 158.158.114.84:6436] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "aepv576vRb9j6psK2Za0mAAAAhY"]
[Fri Apr 24 03:15:55.005771 2026] [:error] [pid 42972:tid 43029] [client 158.158.114.84:15244] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kz.php"] [unique_id "aepv68OAb-3sOknsk4fhEAAAAE0"]
[Fri Apr 24 03:15:58.588816 2026] [:error] [pid 64998:tid 65025] [client 158.158.114.84:36946] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kz.php"] [unique_id "aepv7oV5EysYcTLjmwhcTAAAAdc"]
[Fri Apr 24 03:16:00.148713 2026] [:error] [pid 64998:tid 65013] [client 158.158.114.84:20860] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kz.php"] [unique_id "aepv8IV5EysYcTLjmwhcTgAAAcs"]
[Fri Apr 24 03:16:02.608317 2026] [:error] [pid 64998:tid 65013] [client 158.158.114.84:19803] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kz.php"] [unique_id "aepv8oV5EysYcTLjmwhcWQAAAcs"]
[Fri Apr 24 03:16:06.539946 2026] [:error] [pid 64998:tid 65008] [client 158.158.114.84:26389] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wmore1.php"] [unique_id "aepv9oV5EysYcTLjmwhcYAAAAcY"]
[Fri Apr 24 03:16:08.331684 2026] [:error] [pid 65000:tid 65030] [client 158.158.114.84:12658] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wmore1.php"] [unique_id "aepv-L6vRb9j6psK2Za06wAAAgE"]
[Fri Apr 24 03:16:10.318873 2026] [:error] [pid 42973:tid 43060] [client 158.158.114.84:19777] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wmore1.php"] [unique_id "aepv-m6I0QqmmmLTHE2ZVgAAAJE"]
[Fri Apr 24 03:16:12.460395 2026] [:error] [pid 42972:tid 43026] [client 158.158.114.84:23142] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wmore1.php"] [unique_id "aepv_MOAb-3sOknsk4fhSgAAAEo"]
[Fri Apr 24 03:16:13.899973 2026] [:error] [pid 42973:tid 43061] [client 158.158.114.84:14944] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aepv_W6I0QqmmmLTHE2ZXwAAAJI"]
[Fri Apr 24 03:16:14.541459 2026] [:error] [pid 59700:tid 59703] [client 158.158.114.84:24886] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aepv_pXyGZJFeAIDWtmJlgAAAUE"]
[Fri Apr 24 03:16:15.491965 2026] [:error] [pid 42973:tid 43051] [client 158.158.114.84:14137] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aepv_26I0QqmmmLTHE2ZZAAAAIg"]
[Fri Apr 24 03:16:16.217055 2026] [:error] [pid 43083:tid 43090] [client 158.158.114.84:12611] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aepwADC5hrvNXosL83K6XAAAAMU"]
[Fri Apr 24 03:16:17.107793 2026] [:error] [pid 65000:tid 65040] [client 158.158.114.84:11829] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "aepwAb6vRb9j6psK2Za0-QAAAgc"]
[Fri Apr 24 03:16:18.043589 2026] [:error] [pid 43083:tid 43093] [client 158.158.114.84:26388] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "aepwAjC5hrvNXosL83K6YQAAAMg"]
[Fri Apr 24 03:16:19.567952 2026] [:error] [pid 25635:tid 25640] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Apr 24 03:16:19.813147 2026] [:error] [pid 25635:tid 25650] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Fri Apr 24 03:16:20.056596 2026] [:error] [pid 25635:tid 25652] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/file-kikikoko.php
[Fri Apr 24 03:16:20.307870 2026] [:error] [pid 25635:tid 25651] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Fri Apr 24 03:16:20.550619 2026] [:error] [pid 25635:tid 25662] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/ganja.php
[Fri Apr 24 03:16:20.795840 2026] [:error] [pid 25635:tid 25658] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Apr 24 03:16:21.443951 2026] [:error] [pid 25635:tid 25649] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/sad821.php
[Fri Apr 24 03:16:21.707811 2026] [:error] [pid 25635:tid 25659] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8210.php
[Fri Apr 24 03:16:21.961287 2026] [:error] [pid 25635:tid 25660] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Fri Apr 24 03:16:22.203951 2026] [:error] [pid 25635:tid 25656] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/man.php
[Fri Apr 24 03:16:22.449665 2026] [:error] [pid 25635:tid 25654] [client 158.158.114.84:14122] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Fri Apr 24 03:16:22.688711 2026] [:error] [pid 25635:tid 25643] [client 158.158.114.84:14122] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aepwBsRxv6UsgRGKB3JZAQAAAQQ"]
[Fri Apr 24 03:16:24.014171 2026] [:error] [pid 64998:tid 65003] [client 158.158.114.84:30353] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aepwCIV5EysYcTLjmwhcigAAAcE"]
[Fri Apr 24 03:16:25.154224 2026] [:error] [pid 64998:tid 65016] [client 158.158.114.84:26382] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aepwCYV5EysYcTLjmwhclQAAAc4"]
[Fri Apr 24 03:16:26.648201 2026] [:error] [pid 64998:tid 65016] [client 158.158.114.84:26400] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "aepwCoV5EysYcTLjmwhcmgAAAc4"]
[Fri Apr 24 03:16:27.547819 2026] [:error] [pid 25635:tid 25648] [client 158.158.114.84:30407] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aepwC8Rxv6UsgRGKB3JZAgAAAQk"]
[Fri Apr 24 03:16:29.294081 2026] [:error] [pid 42973:tid 43066] [client 158.158.114.84:15688] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aepwDW6I0QqmmmLTHE2ZdAAAAJc"]
[Fri Apr 24 03:16:30.278335 2026] [:error] [pid 64967:tid 64984] [client 158.158.114.84:16846] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aepwDoAV4GfOOdX8QzqjugAAAY8"]
[Fri Apr 24 03:16:32.467657 2026] [:error] [pid 42972:tid 43022] [client 158.158.114.84:15737] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wps.php"] [unique_id "aepwEMOAb-3sOknsk4fhhQAAAEY"]
[Fri Apr 24 03:16:34.301700 2026] [:error] [pid 65000:tid 65054] [client 158.158.114.84:28664] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aepwEr6vRb9j6psK2Za1HwAAAhU"]
[Fri Apr 24 03:16:35.695422 2026] [:error] [pid 65000:tid 65040] [client 158.158.114.84:19042] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aepwE76vRb9j6psK2Za1IwAAAgc"]
[Fri Apr 24 03:16:37.343737 2026] [:error] [pid 42972:tid 43026] [client 158.158.114.84:26094] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aepwFcOAb-3sOknsk4fhlwAAAEo"]
[Fri Apr 24 03:16:39.015122 2026] [:error] [pid 65000:tid 65040] [client 158.158.114.84:26841] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "aepwF76vRb9j6psK2Za1NgAAAgc"]
[Fri Apr 24 03:16:41.340412 2026] [:error] [pid 64998:tid 65002] [client 158.158.114.84:26073] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "aepwGYV5EysYcTLjmwhc0gAAAcA"]
[Fri Apr 24 03:16:42.474655 2026] [:error] [pid 42973:tid 43059] [client 158.158.114.84:10327] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "aepwGm6I0QqmmmLTHE2ZgwAAAJA"]
[Fri Apr 24 03:16:43.336129 2026] [:error] [pid 42973:tid 43063] [client 158.158.114.84:6483] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "aepwG26I0QqmmmLTHE2ZhAAAAJQ"]
[Fri Apr 24 03:16:44.158723 2026] [:error] [pid 42973:tid 43048] [client 158.158.114.84:19050] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "aepwHG6I0QqmmmLTHE2ZigAAAIU"]
[Fri Apr 24 03:16:47.778666 2026] [:error] [pid 65000:tid 65038] [client 158.158.114.84:6505] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aepwH76vRb9j6psK2Za1QQAAAgU"]
[Fri Apr 24 03:16:50.660537 2026] [:error] [pid 65000:tid 65057] [client 158.158.114.84:34844] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aepwIr6vRb9j6psK2Za1RQAAAhg"]
[Fri Apr 24 03:16:54.208943 2026] [:error] [pid 64998:tid 65010] [client 158.158.114.84:11997] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aepwJoV5EysYcTLjmwhc9QAAAcg"]
[Fri Apr 24 03:16:56.099846 2026] [:error] [pid 42973:tid 43063] [client 158.158.114.84:31624] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "aepwKG6I0QqmmmLTHE2ZoQAAAJQ"]
[Fri Apr 24 03:16:57.318307 2026] [:error] [pid 42973:tid 43048] [client 158.158.114.84:31687] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "aepwKW6I0QqmmmLTHE2ZowAAAIU"]
[Fri Apr 24 03:16:59.228563 2026] [:error] [pid 42972:tid 43018] [client 158.158.114.84:6157] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "aepwK8OAb-3sOknsk4fhvAAAAEI"]
[Fri Apr 24 03:17:01.531858 2026] [:error] [pid 42971:tid 43002] [client 158.158.114.84:6152] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "aepwLTEP2_5RswrH8bFbpgAAABA"]
[Fri Apr 24 03:17:04.108081 2026] [:error] [pid 59700:tid 59702] [client 158.158.114.84:23685] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "aepwMJXyGZJFeAIDWtmJvAAAAUA"]
[Fri Apr 24 03:17:05.498525 2026] [:error] [pid 65000:tid 65048] [client 158.158.114.84:31700] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "aepwMb6vRb9j6psK2Za1ZgAAAg8"]
[Fri Apr 24 03:17:08.647512 2026] [:error] [pid 42973:tid 43062] [client 158.158.114.84:52205] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "aepwNG6I0QqmmmLTHE2ZrQAAAJM"]
[Fri Apr 24 03:17:12.150335 2026] [:error] [pid 65000:tid 65045] [client 158.158.114.84:23708] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "aepwOL6vRb9j6psK2Za1eQAAAgw"]
[Fri Apr 24 03:17:16.193967 2026] [:error] [pid 65000:tid 65044] [client 158.158.114.84:18959] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dass.php"] [unique_id "aepwPL6vRb9j6psK2Za1hgAAAgs"]
[Fri Apr 24 03:17:18.395841 2026] [:error] [pid 59700:tid 59712] [client 158.158.114.84:31654] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aepwPpXyGZJFeAIDWtmJxgAAAUo"]
[Fri Apr 24 03:17:20.849113 2026] [:error] [pid 43083:tid 43098] [client 158.158.114.84:16057] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws66.php"] [unique_id "aepwQDC5hrvNXosL83K6gwAAAM0"]
[Fri Apr 24 03:17:23.692277 2026] [:error] [pid 59700:tid 59705] [client 158.158.114.84:36909] File does not exist: /usr/local/apache/htdocs/suspended-page/ws66.php
[Fri Apr 24 03:17:23.957767 2026] [:error] [pid 59700:tid 59722] [client 158.158.114.84:36909] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Apr 24 03:17:24.228337 2026] [:error] [pid 59700:tid 59718] [client 158.158.114.84:36909] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Fri Apr 24 03:17:24.491843 2026] [:error] [pid 59700:tid 59704] [client 158.158.114.84:36909] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Fri Apr 24 03:17:24.755254 2026] [:error] [pid 59700:tid 59702] [client 158.158.114.84:36909] [client 158.158.114.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "aepwRJXyGZJFeAIDWtmJ1wAAAUA"]
[Fri Apr 24 03:17:27.874991 2026] [:error] [pid 64967:tid 64973] [client 158.158.114.84:52211] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Apr 24 03:17:28.116941 2026] [:error] [pid 64967:tid 64982] [client 158.158.114.84:52211] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Fri Apr 24 03:17:28.360378 2026] [:error] [pid 64967:tid 64987] [client 158.158.114.84:52211] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Apr 24 03:17:28.604912 2026] [:error] [pid 64967:tid 64984] [client 158.158.114.84:52211] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Fri Apr 24 03:17:28.858533 2026] [:error] [pid 64967:tid 64990] [client 158.158.114.84:52211] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Fri Apr 24 03:17:29.101027 2026] [:error] [pid 64967:tid 64988] [client 158.158.114.84:52211] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Apr 24 03:17:29.344174 2026] [:error] [pid 64967:tid 64976] [client 158.158.114.84:52211] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Fri Apr 24 03:17:29.583839 2026] [:error] [pid 64967:tid 64993] [client 158.158.114.84:52211] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aepwSYAV4GfOOdX8Qzqj2wAAAZg"]
[Fri Apr 24 03:17:31.136495 2026] [:error] [pid 64967:tid 64989] [client 158.158.114.84:24134] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aepwS4AV4GfOOdX8Qzqj3gAAAZQ"]
[Fri Apr 24 03:17:33.337287 2026] [:error] [pid 42971:tid 43001] [client 158.158.114.84:22728] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aepwTTEP2_5RswrH8bFbuQAAAA8"]
[Fri Apr 24 03:17:34.125737 2026] [:error] [pid 64998:tid 65009] [client 158.158.114.84:36886] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aepwToV5EysYcTLjmwhdRQAAAcc"]
[Fri Apr 24 03:17:35.111435 2026] [:error] [pid 64998:tid 65016] [client 158.158.114.84:22773] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aepwT4V5EysYcTLjmwhdSQAAAc4"]
[Fri Apr 24 03:17:36.949764 2026] [:error] [pid 59700:tid 59709] [client 158.158.114.84:17484] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aepwUJXyGZJFeAIDWtmJ2wAAAUc"]
[Fri Apr 24 03:17:39.626719 2026] [:error] [pid 64998:tid 65009] [client 158.158.114.84:13795] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aepwU4V5EysYcTLjmwhdVgAAAcc"]
[Fri Apr 24 03:17:42.416692 2026] [:error] [pid 65000:tid 65054] [client 158.158.114.84:12270] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "aepwVr6vRb9j6psK2Za1nAAAAhU"]
[Fri Apr 24 03:17:45.083043 2026] [:error] [pid 42973:tid 43053] [client 158.158.114.84:13761] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aepwWW6I0QqmmmLTHE2ZxQAAAIo"]
[Fri Apr 24 03:17:46.077101 2026] [:error] [pid 42973:tid 43051] [client 158.158.114.84:29360] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aepwWm6I0QqmmmLTHE2ZzQAAAIg"]
[Fri Apr 24 03:17:48.264305 2026] [:error] [pid 42972:tid 43033] [client 158.158.114.84:12116] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aepwXMOAb-3sOknsk4fh5wAAAFE"]
[Fri Apr 24 03:17:50.105585 2026] [:error] [pid 65000:tid 65040] [client 158.158.114.84:29337] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "aepwXr6vRb9j6psK2Za1owAAAgc"]
[Fri Apr 24 03:17:51.199661 2026] [:error] [pid 64967:tid 64979] [client 158.158.114.84:29317] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wglum1.php"] [unique_id "aepwX4AV4GfOOdX8QzqkBAAAAYo"]
[Fri Apr 24 03:17:52.262167 2026] [:error] [pid 65000:tid 65038] [client 158.158.114.84:29343] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wglum1.php"] [unique_id "aepwYL6vRb9j6psK2Za1qQAAAgU"]
[Fri Apr 24 03:17:53.084064 2026] [:error] [pid 42971:tid 43007] [client 158.158.114.84:29319] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wglum1.php"] [unique_id "aepwYTEP2_5RswrH8bFbxAAAABU"]
[Fri Apr 24 03:17:54.431320 2026] [:error] [pid 64998:tid 65012] [client 158.158.114.84:12282] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wglum1.php"] [unique_id "aepwYoV5EysYcTLjmwhdeQAAAco"]
[Fri Apr 24 03:17:56.092203 2026] [:error] [pid 42973:tid 43063] [client 158.158.114.84:12243] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "aepwZG6I0QqmmmLTHE2Z1QAAAJQ"]
[Fri Apr 24 03:17:57.711359 2026] [:error] [pid 64998:tid 65011] [client 158.158.114.84:22708] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "aepwZYV5EysYcTLjmwhdhgAAAck"]
[Fri Apr 24 03:18:00.182911 2026] [:error] [pid 64967:tid 64993] [client 158.158.114.84:6748] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "aepwaIAV4GfOOdX8QzqkBwAAAZg"]
[Fri Apr 24 03:18:01.581760 2026] [:error] [pid 65000:tid 65043] [client 158.158.114.84:6743] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ng.php"] [unique_id "aepwab6vRb9j6psK2Za1uAAAAgo"]
[Fri Apr 24 03:18:02.919183 2026] [:error] [pid 64967:tid 64979] [client 158.158.114.84:58925] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "aepwaoAV4GfOOdX8QzqkCAAAAYo"]
[Fri Apr 24 03:18:04.255194 2026] [:error] [pid 65000:tid 65056] [client 158.158.114.84:12290] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "aepwbL6vRb9j6psK2Za1wQAAAhc"]
[Fri Apr 24 03:18:05.941297 2026] [:error] [pid 65000:tid 65043] [client 158.158.114.84:7132] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "aepwbb6vRb9j6psK2Za1xwAAAgo"]
[Fri Apr 24 03:18:08.445317 2026] [:error] [pid 64998:tid 65026] [client 158.158.114.84:31956] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "aepwcIV5EysYcTLjmwhdnAAAAdg"]
[Fri Apr 24 03:18:10.811820 2026] [:error] [pid 42972:tid 43028] [client 158.158.114.84:28214] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xynz.php"] [unique_id "aepwcsOAb-3sOknsk4fh-wAAAEw"]
[Fri Apr 24 03:18:14.029912 2026] [:error] [pid 42971:tid 42993] [client 158.158.114.84:6241] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xynz.php"] [unique_id "aepwdjEP2_5RswrH8bFbywAAAAc"]
[Fri Apr 24 03:18:15.779765 2026] [:error] [pid 42973:tid 43055] [client 158.158.114.84:18235] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xynz.php"] [unique_id "aepwd26I0QqmmmLTHE2Z5wAAAIw"]
[Fri Apr 24 03:18:17.051213 2026] [:error] [pid 59700:tid 59721] [client 158.158.114.84:18207] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xynz.php"] [unique_id "aepweZXyGZJFeAIDWtmKDwAAAVM"]
[Fri Apr 24 03:18:18.533570 2026] [:error] [pid 42972:tid 43021] [client 158.158.114.84:18203] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aepwesOAb-3sOknsk4fiBQAAAEU"]
[Fri Apr 24 03:18:20.306979 2026] [:error] [pid 64998:tid 65005] [client 158.158.114.84:29769] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aepwfIV5EysYcTLjmwhdoQAAAcM"]
[Fri Apr 24 03:18:21.846582 2026] [:error] [pid 64967:tid 64983] [client 158.158.114.84:12532] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aepwfYAV4GfOOdX8QzqkHgAAAY4"]
[Fri Apr 24 03:18:23.464604 2026] [:error] [pid 59700:tid 59716] [client 158.158.114.84:11603] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aepwf5XyGZJFeAIDWtmKFgAAAU4"]
[Fri Apr 24 03:18:25.028164 2026] [:error] [pid 46953:tid 46975] [client 158.158.114.84:29814] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/press.php"] [unique_id "aepwgUnlpdHh-P6wKbqJ2gAAAlM"]
[Fri Apr 24 03:18:29.137839 2026] [:error] [pid 64998:tid 65002] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Fri Apr 24 03:18:30.592191 2026] [:error] [pid 64998:tid 65013] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Fri Apr 24 03:18:30.862027 2026] [:error] [pid 64998:tid 65024] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Fri Apr 24 03:18:31.106274 2026] [:error] [pid 64998:tid 65008] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Fri Apr 24 03:18:31.382924 2026] [:error] [pid 64998:tid 65017] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 24 03:18:31.628636 2026] [:error] [pid 64998:tid 65005] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/view.php
[Fri Apr 24 03:18:31.919267 2026] [:error] [pid 64998:tid 65016] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Fri Apr 24 03:18:32.163163 2026] [:error] [pid 64998:tid 65015] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Apr 24 03:18:32.426608 2026] [:error] [pid 64998:tid 65012] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Apr 24 03:18:32.670164 2026] [:error] [pid 64998:tid 65010] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Fri Apr 24 03:18:32.940517 2026] [:error] [pid 64998:tid 65021] [client 158.158.114.84:30772] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Apr 24 03:18:33.182293 2026] [:error] [pid 64998:tid 65018] [client 158.158.114.84:30772] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "aepwiYV5EysYcTLjmwhdtgAAAdA"]
[Fri Apr 24 03:18:41.871562 2026] [:error] [pid 43083:tid 43091] [client 158.158.114.84:12395] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "aepwkTC5hrvNXosL83K6qQAAAMY"]
[Fri Apr 24 03:18:46.070505 2026] [:error] [pid 42972:tid 43030] [client 158.158.114.84:12519] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "aepwlsOAb-3sOknsk4fiMwAAAE4"]
[Fri Apr 24 03:18:49.764330 2026] [:error] [pid 42972:tid 43023] [client 158.158.114.84:14503] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "aepwmcOAb-3sOknsk4fiPwAAAEc"]
[Fri Apr 24 03:18:52.548324 2026] [:error] [pid 65000:tid 65043] [client 158.158.114.84:6912] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "aepwnL6vRb9j6psK2Za2CQAAAgo"]
[Fri Apr 24 03:18:53.742931 2026] [:error] [pid 65000:tid 65038] [client 158.158.114.84:14510] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "aepwnb6vRb9j6psK2Za2DgAAAgU"]
[Fri Apr 24 03:18:54.813300 2026] [:error] [pid 65000:tid 65029] [client 158.158.114.84:14480] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws82.php"] [unique_id "aepwnr6vRb9j6psK2Za2FQAAAgA"]
[Fri Apr 24 03:18:55.947658 2026] [:error] [pid 25635:tid 25639] [client 158.158.114.84:21579] [client 158.158.114.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aepwn8Rxv6UsgRGKB3JZRQAAAQA"]
[Fri Apr 24 03:18:57.100935 2026] [:error] [pid 64998:tid 65017] [client 158.158.114.84:7054] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "aepwoYV5EysYcTLjmwhd8gAAAc8"]
[Fri Apr 24 03:18:58.584337 2026] [:error] [pid 64998:tid 65008] [client 158.158.114.84:12068] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "aepwooV5EysYcTLjmwhd-QAAAcY"]
[Fri Apr 24 03:19:00.300459 2026] [:error] [pid 42972:tid 43038] [client 158.158.114.84:7055] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "aepwpMOAb-3sOknsk4fiVwAAAFY"]
[Fri Apr 24 03:19:03.101660 2026] [:error] [pid 42972:tid 43023] [client 158.158.114.84:18671] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/layout.php"] [unique_id "aepwp8OAb-3sOknsk4fiWgAAAEc"]
[Fri Apr 24 03:19:04.993426 2026] [:error] [pid 42972:tid 43019] [client 158.158.114.84:32172] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/layout.php"] [unique_id "aepwqMOAb-3sOknsk4fiXAAAAEM"]
[Fri Apr 24 03:19:08.313841 2026] [:error] [pid 65000:tid 65032] [client 158.158.114.84:29703] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/layout.php"] [unique_id "aepwrL6vRb9j6psK2Za2IQAAAgM"]
[Fri Apr 24 03:19:11.703147 2026] [:error] [pid 43083:tid 43093] [client 158.158.114.84:12696] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/layout.php"] [unique_id "aepwrzC5hrvNXosL83K6tAAAAMg"]
[Fri Apr 24 03:19:15.524052 2026] [:error] [pid 42972:tid 43035] [client 158.158.114.84:6341] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "aepws8OAb-3sOknsk4fibAAAAFM"]
[Fri Apr 24 03:19:17.410749 2026] [:error] [pid 42973:tid 43062] [client 158.158.114.84:53831] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "aepwtW6I0QqmmmLTHE2aEwAAAJM"]
[Fri Apr 24 03:19:18.670843 2026] [:error] [pid 42973:tid 43049] [client 158.158.114.84:6996] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "aepwtm6I0QqmmmLTHE2aFQAAAIY"]
[Fri Apr 24 03:19:20.159430 2026] [:error] [pid 42971:tid 42991] [client 158.158.114.84:58862] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws85.php"] [unique_id "aepwuDEP2_5RswrH8bFb_AAAAAU"]
[Fri Apr 24 03:19:24.507449 2026] [:error] [pid 64998:tid 65020] [client 158.158.114.84:49293] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "aepwvIV5EysYcTLjmwheUQAAAdI"]
[Fri Apr 24 03:19:29.708904 2026] [:error] [pid 65000:tid 65049] [client 158.158.114.84:53881] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "aepwwb6vRb9j6psK2Za2LwAAAhA"]
[Fri Apr 24 03:19:40.059140 2026] [:error] [pid 65000:tid 65044] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/state.php
[Fri Apr 24 03:19:40.303111 2026] [:error] [pid 65000:tid 65038] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Fri Apr 24 03:19:40.546399 2026] [:error] [pid 65000:tid 65051] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Fri Apr 24 03:19:40.816443 2026] [:error] [pid 65000:tid 65047] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/mifta.php
[Fri Apr 24 03:19:41.102025 2026] [:error] [pid 65000:tid 65030] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Fri Apr 24 03:19:41.346163 2026] [:error] [pid 65000:tid 65043] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Fri Apr 24 03:19:41.588922 2026] [:error] [pid 65000:tid 65056] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Fri Apr 24 03:19:41.832287 2026] [:error] [pid 65000:tid 65057] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Fri Apr 24 03:19:42.102477 2026] [:error] [pid 65000:tid 65040] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Fri Apr 24 03:19:42.370385 2026] [:error] [pid 65000:tid 65032] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Fri Apr 24 03:19:42.614447 2026] [:error] [pid 65000:tid 65039] [client 158.158.114.84:53844] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Apr 24 03:19:42.855546 2026] [:error] [pid 65000:tid 65041] [client 158.158.114.84:53844] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maxro.php"] [unique_id "aepwzr6vRb9j6psK2Za2TgAAAgg"]
[Fri Apr 24 03:19:48.618028 2026] [:error] [pid 59700:tid 59704] [client 158.158.114.84:53825] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/maxro.php"] [unique_id "aepw1JXyGZJFeAIDWtmKYgAAAUI"]
[Fri Apr 24 03:20:03.233132 2026] [:error] [pid 65000:tid 65041] [client 158.158.114.84:14477] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "aepw476vRb9j6psK2Za2dgAAAgg"]
[Fri Apr 24 03:20:08.728988 2026] [:error] [pid 65000:tid 65049] [client 158.158.114.84:17836] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "aepw6L6vRb9j6psK2Za2kQAAAhA"]
[Fri Apr 24 03:20:11.858601 2026] [:error] [pid 65000:tid 65054] [client 158.158.114.84:12418] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "aepw676vRb9j6psK2Za2pQAAAhU"]
[Fri Apr 24 03:20:13.611992 2026] [:error] [pid 65000:tid 65037] [client 158.158.114.84:24510] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a7.php"] [unique_id "aepw7b6vRb9j6psK2Za2rgAAAgQ"]
[Fri Apr 24 03:20:14.369981 2026] [:error] [pid 64998:tid 65018] [client 158.158.114.84:14959] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "aepw7oV5EysYcTLjmwhenwAAAdA"]
[Fri Apr 24 03:20:15.060878 2026] [:error] [pid 65000:tid 65047] [client 158.158.114.84:11891] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "aepw776vRb9j6psK2Za2swAAAg4"]
[Fri Apr 24 03:20:16.731666 2026] [:error] [pid 65000:tid 65048] [client 158.158.114.84:31987] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "aepw8L6vRb9j6psK2Za2vgAAAg8"]
[Fri Apr 24 03:20:17.621883 2026] [:error] [pid 65000:tid 65040] [client 158.158.114.84:6244] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "aepw8b6vRb9j6psK2Za2wgAAAgc"]
[Fri Apr 24 03:20:18.354004 2026] [:error] [pid 25635:tid 25663] [client 158.158.114.84:24462] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aepw8sRxv6UsgRGKB3JZbgAAARg"]
[Fri Apr 24 03:20:20.198308 2026] [:error] [pid 43083:tid 43105] [client 158.158.114.84:38037] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aepw9DC5hrvNXosL83K62AAAANQ"]
[Fri Apr 24 03:20:25.998960 2026] [:error] [pid 42973:tid 43053] [client 158.158.114.84:28172] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aepw-W6I0QqmmmLTHE2aoQAAAIo"]
[Fri Apr 24 03:20:32.141521 2026] [:error] [pid 42971:tid 43001] [client 158.158.114.84:16816] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa.php"] [unique_id "aepxADEP2_5RswrH8bFcGgAAAA8"]
[Fri Apr 24 03:20:34.999683 2026] [:error] [pid 64998:tid 65009] [client 158.158.114.84:11944] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/areak1.php"] [unique_id "aepxAoV5EysYcTLjmwhesgAAAcc"]
[Fri Apr 24 03:20:37.246471 2026] [:error] [pid 42972:tid 43031] [client 158.158.114.84:6745] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/areak1.php"] [unique_id "aepxBcOAb-3sOknsk4fiwQAAAE8"]
[Fri Apr 24 03:20:39.232876 2026] [:error] [pid 64998:tid 65009] [client 158.158.114.84:38060] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/areak1.php"] [unique_id "aepxB4V5EysYcTLjmwhewwAAAcc"]
[Fri Apr 24 03:20:40.879558 2026] [:error] [pid 59700:tid 59706] [client 158.158.114.84:17156] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/areak1.php"] [unique_id "aepxCJXyGZJFeAIDWtmKfAAAAUQ"]
[Fri Apr 24 03:20:44.080401 2026] [:error] [pid 65000:tid 65031] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/sallu.php
[Fri Apr 24 03:20:44.346301 2026] [:error] [pid 65000:tid 65041] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny2.php
[Fri Apr 24 03:20:44.610598 2026] [:error] [pid 65000:tid 65056] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Fri Apr 24 03:20:44.923141 2026] [:error] [pid 65000:tid 65053] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/gz.php
[Fri Apr 24 03:20:45.190576 2026] [:error] [pid 65000:tid 65044] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 24 03:20:45.454704 2026] [:error] [pid 65000:tid 65037] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Fri Apr 24 03:20:45.817269 2026] [:error] [pid 65000:tid 65038] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Fri Apr 24 03:20:46.288071 2026] [:error] [pid 65000:tid 65043] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/ws68.php
[Fri Apr 24 03:20:46.553171 2026] [:error] [pid 65000:tid 65042] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Fri Apr 24 03:20:46.991383 2026] [:error] [pid 65000:tid 65052] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Fri Apr 24 03:20:47.264045 2026] [:error] [pid 65000:tid 65047] [client 158.158.114.84:53396] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Fri Apr 24 03:20:47.816494 2026] [:error] [pid 65000:tid 65041] [client 158.158.114.84:53396] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aepxD76vRb9j6psK2Za2-wAAAgg"]
[Fri Apr 24 03:20:49.015324 2026] [:error] [pid 42971:tid 42996] [client 158.158.114.84:12123] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aepxETEP2_5RswrH8bFcJAAAAAo"]
[Fri Apr 24 03:20:49.744870 2026] [:error] [pid 64967:tid 64987] [client 158.158.114.84:36889] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aepxEYAV4GfOOdX8QzqkcAAAAZI"]
[Fri Apr 24 03:20:51.810604 2026] [:error] [pid 64998:tid 65007] [client 158.158.114.84:22693] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "aepxE4V5EysYcTLjmwheyAAAAcU"]
[Fri Apr 24 03:20:52.692298 2026] [:error] [pid 46953:tid 46966] [client 158.158.114.84:17479] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aepxFEnlpdHh-P6wKbqKJwAAAko"]
[Fri Apr 24 03:20:53.661319 2026] [:error] [pid 59700:tid 59716] [client 158.158.114.84:16004] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aepxFZXyGZJFeAIDWtmKigAAAU4"]
[Fri Apr 24 03:20:54.372637 2026] [:error] [pid 65000:tid 65043] [client 158.158.114.84:25291] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aepxFr6vRb9j6psK2Za3AQAAAgo"]
[Fri Apr 24 03:20:55.347339 2026] [:error] [pid 64967:tid 64989] [client 158.158.114.84:13815] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "aepxF4AV4GfOOdX8QzqkcQAAAZQ"]
[Fri Apr 24 03:20:56.479259 2026] [:error] [pid 65000:tid 65052] [client 158.158.114.84:28967] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "aepxGL6vRb9j6psK2Za3AwAAAhM"]
[Fri Apr 24 03:20:58.194839 2026] [:error] [pid 65000:tid 65032] [client 158.158.114.84:17512] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "aepxGr6vRb9j6psK2Za3BgAAAgM"]
[Fri Apr 24 03:21:00.356550 2026] [:error] [pid 42972:tid 43039] [client 158.158.114.84:16464] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "aepxHMOAb-3sOknsk4fi2wAAAFc"]
[Fri Apr 24 03:21:01.553797 2026] [:error] [pid 42971:tid 43009] [client 158.158.114.84:52263] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws84.php"] [unique_id "aepxHTEP2_5RswrH8bFcKwAAABc"]
[Fri Apr 24 03:21:03.060508 2026] [:error] [pid 42973:tid 43053] [client 158.158.114.84:31616] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws61.php"] [unique_id "aepxH26I0QqmmmLTHE2arQAAAIo"]
[Fri Apr 24 03:21:05.810699 2026] [:error] [pid 64998:tid 65019] [client 158.158.114.84:22395] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws61.php"] [unique_id "aepxIYV5EysYcTLjmwhe5AAAAdE"]
[Fri Apr 24 03:21:09.242966 2026] [:error] [pid 42973:tid 43051] [client 158.158.114.84:14087] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws61.php"] [unique_id "aepxJW6I0QqmmmLTHE2atwAAAIg"]
[Fri Apr 24 03:21:11.810340 2026] [:error] [pid 42972:tid 43021] [client 158.158.114.84:24919] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws61.php"] [unique_id "aepxJ8OAb-3sOknsk4fi5QAAAEU"]
[Fri Apr 24 03:21:14.811461 2026] [:error] [pid 25635:tid 25649] [client 158.158.114.84:12940] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp-image.php"] [unique_id "aepxKsRxv6UsgRGKB3JZfQAAAQo"]
[Fri Apr 24 03:21:16.441168 2026] [:error] [pid 64998:tid 65017] [client 158.158.114.84:19336] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp-image.php"] [unique_id "aepxLIV5EysYcTLjmwhe9QAAAc8"]
[Fri Apr 24 03:21:18.036571 2026] [:error] [pid 42971:tid 42999] [client 158.158.114.84:10394] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp-image.php"] [unique_id "aepxLjEP2_5RswrH8bFcLgAAAA0"]
[Fri Apr 24 03:21:19.592793 2026] [:error] [pid 64998:tid 65020] [client 158.158.114.84:24847] [client 158.158.114.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp-image.php"] [unique_id "aepxL4V5EysYcTLjmwhfDQAAAdI"]
[Fri Apr 24 07:44:29.852417 2026] [:error] [pid 19101:tid 19160] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Fri Apr 24 07:44:30.091756 2026] [:error] [pid 19101:tid 19147] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Apr 24 07:44:30.330944 2026] [:error] [pid 19101:tid 19161] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Fri Apr 24 07:44:30.575815 2026] [:error] [pid 19101:tid 19141] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Fri Apr 24 07:44:30.817619 2026] [:error] [pid 19101:tid 19148] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Fri Apr 24 07:44:31.062508 2026] [:error] [pid 19101:tid 19146] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Fri Apr 24 07:44:31.547842 2026] [:error] [pid 19101:tid 19137] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Apr 24 07:44:31.786669 2026] [:error] [pid 19101:tid 19152] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Fri Apr 24 07:44:32.027977 2026] [:error] [pid 19101:tid 19148] [client 20.216.186.228:6705] File does not exist: /usr/local/apache/htdocs/suspended-page/bkyac.php
[Fri Apr 24 07:44:32.263573 2026] [:error] [pid 19101:tid 19140] [client 20.216.186.228:6705] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aequ4GAHj9bEvrTgbO3_tgAAAEM"]
[Fri Apr 24 07:44:33.957738 2026] [:error] [pid 19101:tid 19157] [client 20.216.186.228:24050] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aequ4WAHj9bEvrTgbO3_ygAAAFQ"]
[Fri Apr 24 07:44:35.899895 2026] [:error] [pid 19101:tid 19138] [client 20.216.186.228:25985] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aequ42AHj9bEvrTgbO3_1wAAAEE"]
[Fri Apr 24 07:44:36.965841 2026] [:error] [pid 19102:tid 19181] [client 20.216.186.228:16225] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wziar1.php"] [unique_id "aequ5ADSgrbLEZbkqD4CvgAAAJE"]
[Fri Apr 24 07:44:37.588734 2026] [:error] [pid 19101:tid 19155] [client 20.216.186.228:6610] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aequ5WAHj9bEvrTgbO3_4gAAAFI"]
[Fri Apr 24 07:44:39.152687 2026] [:error] [pid 52129:tid 52156] [client 20.216.186.228:24782] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aequ5-KCZKf8_u2LKiDQqgAAARc"]
[Fri Apr 24 07:44:41.513414 2026] [:error] [pid 52129:tid 52156] [client 20.216.186.228:24811] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aequ6eKCZKf8_u2LKiDQvwAAARc"]
[Fri Apr 24 07:44:43.514100 2026] [:error] [pid 52129:tid 52149] [client 20.216.186.228:21264] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aequ6-KCZKf8_u2LKiDQwgAAARA"]
[Fri Apr 24 07:44:44.836758 2026] [:error] [pid 19101:tid 19150] [client 20.216.186.228:16910] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aequ7GAHj9bEvrTgbO0AAAAAAE0"]
[Fri Apr 24 07:44:45.781699 2026] [:error] [pid 52129:tid 52134] [client 20.216.186.228:2586] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aequ7eKCZKf8_u2LKiDQ1gAAAQE"]
[Fri Apr 24 07:44:47.218372 2026] [:error] [pid 19102:tid 19188] [client 20.216.186.228:8388] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aequ7wDSgrbLEZbkqD4DDQAAAJg"]
[Fri Apr 24 07:44:49.478215 2026] [:error] [pid 52129:tid 52134] [client 20.216.186.228:10342] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7logs.php"] [unique_id "aequ8eKCZKf8_u2LKiDQ6gAAAQE"]
[Fri Apr 24 07:44:51.951570 2026] [:error] [pid 19101:tid 19141] [client 20.216.186.228:10324] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aequ82AHj9bEvrTgbO0AGQAAAEQ"]
[Fri Apr 24 07:44:53.392271 2026] [:error] [pid 19101:tid 19150] [client 20.216.186.228:22739] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aequ9WAHj9bEvrTgbO0AKwAAAE0"]
[Fri Apr 24 07:44:54.608688 2026] [:error] [pid 19102:tid 19164] [client 20.216.186.228:24195] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aequ9gDSgrbLEZbkqD4DJQAAAIA"]
[Fri Apr 24 07:44:56.806556 2026] [:error] [pid 19101:tid 19141] [client 20.216.186.228:11786] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aequ-GAHj9bEvrTgbO0AQgAAAEQ"]
[Fri Apr 24 07:44:57.770140 2026] [:error] [pid 19200:tid 19214] [client 20.216.186.228:42622] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aequ-TQ--M3-tsKAnhHrVgAAAMY"]
[Fri Apr 24 07:44:59.158194 2026] [:error] [pid 52129:tid 52145] [client 20.216.186.228:21558] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aequ--KCZKf8_u2LKiDRIQAAAQw"]
[Fri Apr 24 07:45:00.154304 2026] [:error] [pid 52129:tid 52139] [client 20.216.186.228:6381] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aequ_OKCZKf8_u2LKiDRLAAAAQY"]
[Fri Apr 24 07:45:02.111781 2026] [:error] [pid 19102:tid 19182] [client 20.216.186.228:26583] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "aequ_gDSgrbLEZbkqD4DMAAAAJI"]
[Fri Apr 24 07:45:03.832250 2026] [:error] [pid 19100:tid 19112] [client 20.216.186.228:8334] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aequ_7F_hzQs4Cqbifc3SAAAAAM"]
[Fri Apr 24 07:45:04.798658 2026] [:error] [pid 19100:tid 19129] [client 20.216.186.228:23272] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aeqvALF_hzQs4Cqbifc3VAAAABM"]
[Fri Apr 24 07:45:05.989181 2026] [:error] [pid 19102:tid 19168] [client 20.216.186.228:2296] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aeqvAQDSgrbLEZbkqD4DUgAAAIQ"]
[Fri Apr 24 07:45:07.658611 2026] [:error] [pid 19100:tid 19111] [client 20.216.186.228:21542] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "aeqvA7F_hzQs4Cqbifc3YwAAAAI"]
[Fri Apr 24 07:45:08.850942 2026] [:error] [pid 52129:tid 52143] [client 20.216.186.228:26555] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lb.php"] [unique_id "aeqvBOKCZKf8_u2LKiDRbQAAAQo"]
[Fri Apr 24 07:45:10.887165 2026] [:error] [pid 52129:tid 52152] [client 20.216.186.228:16964] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lb.php"] [unique_id "aeqvBuKCZKf8_u2LKiDRkwAAARM"]
[Fri Apr 24 07:45:14.970640 2026] [:error] [pid 19200:tid 19223] [client 20.216.186.228:2449] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lb.php"] [unique_id "aeqvCjQ--M3-tsKAnhHrngAAAM8"]
[Fri Apr 24 07:45:17.862014 2026] [:error] [pid 52129:tid 52151] [client 20.216.186.228:19952] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lb.php"] [unique_id "aeqvDeKCZKf8_u2LKiDRxgAAARI"]
[Fri Apr 24 07:45:19.947787 2026] [:error] [pid 52129:tid 52134] [client 20.216.186.228:23458] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "aeqvD-KCZKf8_u2LKiDRzgAAAQE"]
[Fri Apr 24 07:45:21.040075 2026] [:error] [pid 52129:tid 52150] [client 20.216.186.228:18425] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "aeqvEeKCZKf8_u2LKiDR1QAAARE"]
[Fri Apr 24 07:45:22.570727 2026] [:error] [pid 52129:tid 52152] [client 20.216.186.228:17000] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "aeqvEuKCZKf8_u2LKiDR9AAAARM"]
[Fri Apr 24 07:45:23.821607 2026] [:error] [pid 19101:tid 19145] [client 20.216.186.228:7176] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "aeqvE2AHj9bEvrTgbO0AtQAAAEg"]
[Fri Apr 24 07:45:24.892025 2026] [:error] [pid 19100:tid 19131] [client 20.216.186.228:7176] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aeqvFLF_hzQs4Cqbifc3ggAAABU"]
[Fri Apr 24 07:45:25.745843 2026] [:error] [pid 19100:tid 19120] [client 20.216.186.228:17449] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aeqvFbF_hzQs4Cqbifc3hgAAAAo"]
[Fri Apr 24 07:45:26.746163 2026] [:error] [pid 19102:tid 19178] [client 20.216.186.228:26619] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aeqvFgDSgrbLEZbkqD4D0QAAAI4"]
[Fri Apr 24 07:45:28.272919 2026] [:error] [pid 19100:tid 19122] [client 20.216.186.228:23270] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mh.php"] [unique_id "aeqvGLF_hzQs4Cqbifc3jQAAAAw"]
[Fri Apr 24 07:45:29.925345 2026] [:error] [pid 19200:tid 19217] [client 20.216.186.228:17470] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fone1.php"] [unique_id "aeqvGTQ--M3-tsKAnhHsIgAAAMk"]
[Fri Apr 24 07:45:31.979956 2026] [:error] [pid 19200:tid 19229] [client 20.216.186.228:8341] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fone1.php"] [unique_id "aeqvGzQ--M3-tsKAnhHsLgAAANU"]
[Fri Apr 24 07:45:32.902735 2026] [:error] [pid 19101:tid 19148] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Fri Apr 24 07:45:33.168884 2026] [:error] [pid 19101:tid 19158] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Fri Apr 24 07:45:33.434563 2026] [:error] [pid 19101:tid 19161] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Fri Apr 24 07:45:33.702582 2026] [:error] [pid 19101:tid 19147] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Apr 24 07:45:33.974935 2026] [:error] [pid 19101:tid 19153] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Fri Apr 24 07:45:34.243992 2026] [:error] [pid 19101:tid 19154] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Fri Apr 24 07:45:34.528748 2026] [:error] [pid 19101:tid 19157] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 24 07:45:35.059280 2026] [:error] [pid 19101:tid 19150] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/bfil.php
[Fri Apr 24 07:45:35.329115 2026] [:error] [pid 19101:tid 19144] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Fri Apr 24 07:45:35.596463 2026] [:error] [pid 19101:tid 19139] [client 20.216.186.228:7179] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Fri Apr 24 07:45:35.858159 2026] [:error] [pid 19101:tid 19145] [client 20.216.186.228:7179] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeqvH2AHj9bEvrTgbO0A_QAAAEg"]
[Fri Apr 24 07:45:37.807346 2026] [:error] [pid 19102:tid 19186] [client 20.216.186.228:23245] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeqvIQDSgrbLEZbkqD4D_AAAAJY"]
[Fri Apr 24 07:45:39.468680 2026] [:error] [pid 19100:tid 19127] [client 20.216.186.228:8375] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeqvI7F_hzQs4Cqbifc3vAAAABE"]
[Fri Apr 24 07:45:41.071118 2026] [:error] [pid 52129:tid 52133] [client 20.216.186.228:23464] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "aeqvJeKCZKf8_u2LKiDScgAAAQA"]
[Fri Apr 24 07:45:43.197728 2026] [:error] [pid 19102:tid 19166] [client 20.216.186.228:23255] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amwxl.php"] [unique_id "aeqvJwDSgrbLEZbkqD4EFgAAAII"]
[Fri Apr 24 07:45:44.526671 2026] [:error] [pid 19200:tid 19215] [client 20.216.186.228:8327] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amwxl.php"] [unique_id "aeqvKDQ--M3-tsKAnhHsiwAAAMc"]
[Fri Apr 24 07:45:45.958361 2026] [:error] [pid 19101:tid 19143] [client 20.216.186.228:20753] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amwxl.php"] [unique_id "aeqvKWAHj9bEvrTgbO0BLAAAAEY"]
[Fri Apr 24 07:45:46.586585 2026] [:error] [pid 19102:tid 19167] [client 20.216.186.228:20495] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/amwxl.php"] [unique_id "aeqvKgDSgrbLEZbkqD4EMgAAAIM"]
[Fri Apr 24 07:45:47.468931 2026] [:error] [pid 52129:tid 52155] [client 20.216.186.228:18922] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wmore1.php"] [unique_id "aeqvK-KCZKf8_u2LKiDSiwAAARY"]
[Fri Apr 24 07:45:48.336058 2026] [:error] [pid 19200:tid 19229] [client 20.216.186.228:20523] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wmore1.php"] [unique_id "aeqvLDQ--M3-tsKAnhHslgAAANU"]
[Fri Apr 24 07:45:49.598619 2026] [:error] [pid 19200:tid 19227] [client 20.216.186.228:20533] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wmore1.php"] [unique_id "aeqvLTQ--M3-tsKAnhHsnAAAANM"]
[Fri Apr 24 07:45:50.958138 2026] [:error] [pid 19102:tid 19188] [client 20.216.186.228:20794] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wmore1.php"] [unique_id "aeqvLgDSgrbLEZbkqD4ESQAAAJg"]
[Fri Apr 24 07:45:54.026365 2026] [:error] [pid 19100:tid 19129] [client 20.216.186.228:18894] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/userfuns.php"] [unique_id "aeqvMrF_hzQs4Cqbifc4JwAAABM"]
[Fri Apr 24 07:45:56.019588 2026] [:error] [pid 52129:tid 52155] [client 20.216.186.228:17460] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/userfuns.php"] [unique_id "aeqvNOKCZKf8_u2LKiDSxAAAARY"]
[Fri Apr 24 07:45:58.093951 2026] [:error] [pid 19102:tid 19179] [client 20.216.186.228:13323] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/userfuns.php"] [unique_id "aeqvNgDSgrbLEZbkqD4EbwAAAI8"]
[Fri Apr 24 07:45:59.762965 2026] [:error] [pid 19200:tid 19231] [client 20.216.186.228:12921] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/userfuns.php"] [unique_id "aeqvNzQ--M3-tsKAnhHs1QAAANc"]
[Fri Apr 24 07:46:00.590381 2026] [:error] [pid 19200:tid 19211] [client 20.216.186.228:10258] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "aeqvODQ--M3-tsKAnhHs2QAAAMM"]
[Fri Apr 24 07:46:01.330644 2026] [:error] [pid 52129:tid 52157] [client 20.216.186.228:11860] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "aeqvOeKCZKf8_u2LKiDSzAAAARg"]
[Fri Apr 24 07:46:02.451874 2026] [:error] [pid 19200:tid 19227] [client 20.216.186.228:21762] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "aeqvOjQ--M3-tsKAnhHs5gAAANM"]
[Fri Apr 24 07:46:03.253231 2026] [:error] [pid 52129:tid 52151] [client 20.216.186.228:13339] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/menu.php"] [unique_id "aeqvO-KCZKf8_u2LKiDS0gAAARI"]
[Fri Apr 24 07:46:04.008589 2026] [:error] [pid 19200:tid 19224] [client 20.216.186.228:10293] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aeqvPDQ--M3-tsKAnhHs8AAAANA"]
[Fri Apr 24 07:46:04.610129 2026] [:error] [pid 19100:tid 19112] [client 20.216.186.228:14364] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aeqvPLF_hzQs4Cqbifc4ZAAAAAM"]
[Fri Apr 24 07:46:05.274658 2026] [:error] [pid 19200:tid 19212] [client 20.216.186.228:64878] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aeqvPTQ--M3-tsKAnhHs_wAAAMQ"]
[Fri Apr 24 07:46:06.207579 2026] [:error] [pid 19101:tid 19139] [client 20.216.186.228:2126] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "aeqvPmAHj9bEvrTgbO0BZgAAAEI"]
[Fri Apr 24 07:46:11.281916 2026] [:error] [pid 19200:tid 19222] [client 20.216.186.228:7474] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aeqvQzQ--M3-tsKAnhHtKgAAAM4"]
[Fri Apr 24 07:46:15.375773 2026] [:error] [pid 19102:tid 19179] [client 20.216.186.228:21811] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aeqvRwDSgrbLEZbkqD4ErgAAAI8"]
[Fri Apr 24 07:46:19.289464 2026] [:error] [pid 19102:tid 19177] [client 20.216.186.228:11542] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/saorix1.php"] [unique_id "aeqvSwDSgrbLEZbkqD4EwQAAAI0"]
[Fri Apr 24 07:46:22.417565 2026] [:error] [pid 19101:tid 19154] [client 20.216.186.228:2972] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeqvTmAHj9bEvrTgbO0BmgAAAFE"]
[Fri Apr 24 07:46:24.026331 2026] [:error] [pid 19200:tid 19214] [client 20.216.186.228:24931] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeqvUDQ--M3-tsKAnhHthQAAAMY"]
[Fri Apr 24 07:46:25.531822 2026] [:error] [pid 52129:tid 52150] [client 20.216.186.228:13159] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeqvUeKCZKf8_u2LKiDTcgAAARE"]
[Fri Apr 24 07:46:27.853611 2026] [:error] [pid 52129:tid 52151] [client 20.216.186.228:21017] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/byypas.php"] [unique_id "aeqvU-KCZKf8_u2LKiDThwAAARI"]
[Fri Apr 24 07:46:28.742744 2026] [:error] [pid 52129:tid 52157] [client 20.216.186.228:46788] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rip.php"] [unique_id "aeqvVOKCZKf8_u2LKiDTkAAAARg"]
[Fri Apr 24 07:46:30.037169 2026] [:error] [pid 52129:tid 52152] [client 20.216.186.228:6334] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rip.php"] [unique_id "aeqvVuKCZKf8_u2LKiDTlAAAARM"]
[Fri Apr 24 07:46:30.938962 2026] [:error] [pid 19100:tid 19128] [client 20.216.186.228:8663] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rip.php"] [unique_id "aeqvVrF_hzQs4Cqbifc4wwAAABI"]
[Fri Apr 24 07:46:31.727123 2026] [:error] [pid 19102:tid 19168] [client 20.216.186.228:22758] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/rip.php"] [unique_id "aeqvVwDSgrbLEZbkqD4FHwAAAIQ"]
[Fri Apr 24 07:46:32.533620 2026] [:error] [pid 19100:tid 19125] [client 20.216.186.228:22888] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aeqvWLF_hzQs4Cqbifc40AAAAA8"]
[Fri Apr 24 07:46:33.707276 2026] [:error] [pid 52129:tid 52136] [client 20.216.186.228:24205] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aeqvWeKCZKf8_u2LKiDTnwAAAQM"]
[Fri Apr 24 07:46:34.953808 2026] [:error] [pid 52129:tid 52141] [client 20.216.186.228:22743] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/gptsh.php"] [unique_id "aeqvWuKCZKf8_u2LKiDTqQAAAQg"]
[Fri Apr 24 07:46:36.324625 2026] [:error] [pid 19102:tid 19179] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Fri Apr 24 07:46:36.564077 2026] [:error] [pid 19102:tid 19186] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Fri Apr 24 07:46:36.804331 2026] [:error] [pid 19102:tid 19174] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Apr 24 07:46:37.046624 2026] [:error] [pid 19102:tid 19170] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Apr 24 07:46:37.699937 2026] [:error] [pid 19102:tid 19167] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Apr 24 07:46:37.942738 2026] [:error] [pid 19102:tid 19164] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Fri Apr 24 07:46:38.181635 2026] [:error] [pid 19102:tid 19182] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Fri Apr 24 07:46:38.420827 2026] [:error] [pid 19102:tid 19174] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri Apr 24 07:46:38.910607 2026] [:error] [pid 19102:tid 19181] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Fri Apr 24 07:46:39.149571 2026] [:error] [pid 19102:tid 19165] [client 20.216.186.228:22748] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Fri Apr 24 07:46:39.385628 2026] [:error] [pid 19102:tid 19178] [client 20.216.186.228:22748] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aeqvXwDSgrbLEZbkqD4FYwAAAI4"]
[Fri Apr 24 07:46:41.893011 2026] [:error] [pid 19200:tid 19228] [client 20.216.186.228:22716] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aeqvYTQ--M3-tsKAnhHuAwAAANQ"]
[Fri Apr 24 07:46:43.325739 2026] [:error] [pid 52129:tid 52134] [client 20.216.186.228:22864] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aeqvY-KCZKf8_u2LKiDTzQAAAQE"]
[Fri Apr 24 07:46:45.175991 2026] [:error] [pid 19102:tid 19188] [client 20.216.186.228:25515] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "aeqvZQDSgrbLEZbkqD4FkAAAAJg"]
[Fri Apr 24 07:46:47.033801 2026] [:error] [pid 19100:tid 19125] [client 20.216.186.228:6730] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeqvZ7F_hzQs4Cqbifc5CwAAAA8"]
[Fri Apr 24 07:46:48.151613 2026] [:error] [pid 19101:tid 19156] [client 20.216.186.228:6549] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeqvaGAHj9bEvrTgbO0B5gAAAFM"]
[Fri Apr 24 07:46:49.183330 2026] [:error] [pid 19102:tid 19185] [client 20.216.186.228:24505] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeqvaQDSgrbLEZbkqD4FpgAAAJU"]
[Fri Apr 24 07:46:50.932629 2026] [:error] [pid 52129:tid 52151] [client 20.216.186.228:10805] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp5.php"] [unique_id "aeqvauKCZKf8_u2LKiDUHAAAARI"]
[Fri Apr 24 07:46:52.980709 2026] [:error] [pid 52129:tid 52139] [client 20.216.186.228:13891] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/yuzuru1.php"] [unique_id "aeqvbOKCZKf8_u2LKiDUNwAAAQY"]
[Fri Apr 24 07:46:53.998702 2026] [:error] [pid 19101:tid 19148] [client 20.216.186.228:23699] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/yuzuru1.php"] [unique_id "aeqvbWAHj9bEvrTgbO0CCAAAAEs"]
[Fri Apr 24 07:46:56.890377 2026] [:error] [pid 19200:tid 19229] [client 20.216.186.228:19894] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/yuzuru1.php"] [unique_id "aeqvcDQ--M3-tsKAnhHuLAAAANU"]
[Fri Apr 24 07:46:58.533333 2026] [:error] [pid 19102:tid 19173] [client 20.216.186.228:20417] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/yuzuru1.php"] [unique_id "aeqvcgDSgrbLEZbkqD4F5gAAAIk"]
[Fri Apr 24 07:47:00.007926 2026] [:error] [pid 52129:tid 52143] [client 20.216.186.228:23694] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeqvdOKCZKf8_u2LKiDUdAAAAQo"]
[Fri Apr 24 07:47:01.283799 2026] [:error] [pid 19102:tid 19182] [client 20.216.186.228:42607] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeqvdQDSgrbLEZbkqD4F8gAAAJI"]
[Fri Apr 24 07:47:05.096502 2026] [:error] [pid 19101:tid 19157] [client 20.216.186.228:12563] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeqveWAHj9bEvrTgbO0CKQAAAFQ"]
[Fri Apr 24 07:47:05.959585 2026] [:error] [pid 19102:tid 19172] [client 20.216.186.228:46727] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file61.php"] [unique_id "aeqveQDSgrbLEZbkqD4F_gAAAIg"]
[Fri Apr 24 07:47:07.501281 2026] [:error] [pid 52129:tid 52142] [client 20.216.186.228:24281] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "aeqve-KCZKf8_u2LKiDUmQAAAQk"]
[Fri Apr 24 07:47:08.618004 2026] [:error] [pid 19100:tid 19132] [client 20.216.186.228:11377] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "aeqvfLF_hzQs4Cqbifc5RAAAABY"]
[Fri Apr 24 07:47:09.650493 2026] [:error] [pid 52129:tid 52137] [client 20.216.186.228:12590] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "aeqvfeKCZKf8_u2LKiDUoAAAAQQ"]
[Fri Apr 24 07:47:11.215087 2026] [:error] [pid 19102:tid 19167] [client 20.216.186.228:22267] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Cap.php"] [unique_id "aeqvfwDSgrbLEZbkqD4GIQAAAIM"]
[Fri Apr 24 07:47:16.359479 2026] [:error] [pid 19100:tid 19131] [client 20.216.186.228:42561] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aeqvhLF_hzQs4Cqbifc5aAAAABU"]
[Fri Apr 24 07:47:22.022083 2026] [:error] [pid 52129:tid 52134] [client 20.216.186.228:11376] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aeqviuKCZKf8_u2LKiDU6AAAAQE"]
[Fri Apr 24 07:47:24.502489 2026] [:error] [pid 52129:tid 52140] [client 20.216.186.228:21222] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tfm.php"] [unique_id "aeqvjOKCZKf8_u2LKiDVBgAAAQc"]
[Fri Apr 24 07:47:26.987399 2026] [:error] [pid 52129:tid 52145] [client 20.216.186.228:22213] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aeqvjuKCZKf8_u2LKiDVGgAAAQw"]
[Fri Apr 24 07:47:30.152564 2026] [:error] [pid 52129:tid 52140] [client 20.216.186.228:22225] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aeqvkuKCZKf8_u2LKiDVNQAAAQc"]
[Fri Apr 24 07:47:33.916014 2026] [:error] [pid 19102:tid 19170] [client 20.216.186.228:22210] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aeqvlQDSgrbLEZbkqD4GZAAAAIY"]
[Fri Apr 24 07:47:35.934307 2026] [:error] [pid 52129:tid 52141] [client 20.216.186.228:23507] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "aeqvl-KCZKf8_u2LKiDVZwAAAQg"]
[Fri Apr 24 07:47:37.238109 2026] [:error] [pid 19200:tid 19230] [client 20.216.186.228:24749] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aeqvmTQ--M3-tsKAnhHvJQAAANY"]
[Fri Apr 24 07:47:38.511840 2026] [:error] [pid 19100:tid 19127] [client 20.216.186.228:16676] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/t00l.php"] [unique_id "aeqvmrF_hzQs4Cqbifc56gAAABE"]
[Fri Apr 24 07:47:40.810583 2026] [:error] [pid 19100:tid 19118] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Fri Apr 24 07:47:41.061100 2026] [:error] [pid 19100:tid 19130] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/casp1.php
[Fri Apr 24 07:47:41.311017 2026] [:error] [pid 19100:tid 19113] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Fri Apr 24 07:47:41.560553 2026] [:error] [pid 19100:tid 19131] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Fri Apr 24 07:47:41.808854 2026] [:error] [pid 19100:tid 19132] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Fri Apr 24 07:47:42.072876 2026] [:error] [pid 19100:tid 19123] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Fri Apr 24 07:47:42.327306 2026] [:error] [pid 19100:tid 19120] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Fri Apr 24 07:47:42.582254 2026] [:error] [pid 19100:tid 19121] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Fri Apr 24 07:47:42.828645 2026] [:error] [pid 19100:tid 19109] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Apr 24 07:47:43.077268 2026] [:error] [pid 19100:tid 19128] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Fri Apr 24 07:47:43.326573 2026] [:error] [pid 19100:tid 19118] [client 20.216.186.228:2599] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Fri Apr 24 07:47:43.571830 2026] [:error] [pid 19100:tid 19127] [client 20.216.186.228:2599] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeqvn7F_hzQs4Cqbifc6EwAAABE"]
[Fri Apr 24 07:47:45.846586 2026] [:error] [pid 52129:tid 52139] [client 20.216.186.228:20829] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeqvoeKCZKf8_u2LKiDVyQAAAQY"]
[Fri Apr 24 07:47:47.412185 2026] [:error] [pid 19200:tid 19215] [client 20.216.186.228:14929] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeqvozQ--M3-tsKAnhHvYwAAAMc"]
[Fri Apr 24 07:47:50.209955 2026] [:error] [pid 19200:tid 19213] [client 20.216.186.228:20837] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/8573.php"] [unique_id "aeqvpjQ--M3-tsKAnhHvfAAAAMU"]
[Fri Apr 24 07:47:54.413516 2026] [:error] [pid 19200:tid 19216] [client 20.216.186.228:15109] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeqvqjQ--M3-tsKAnhHvrAAAAMg"]
[Fri Apr 24 07:48:00.097442 2026] [:error] [pid 19102:tid 19183] [client 20.216.186.228:2785] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sadcut1.php"] [unique_id "aeqvsADSgrbLEZbkqD4G6AAAAJM"]
[Fri Apr 24 07:48:07.713696 2026] [:error] [pid 19200:tid 19229] [client 20.216.186.228:23777] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeqvtzQ--M3-tsKAnhHv8gAAANU"]
[Fri Apr 24 07:48:08.746948 2026] [:error] [pid 52129:tid 52151] [client 20.216.186.228:23539] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeqvuOKCZKf8_u2LKiDWRgAAARI"]
[Fri Apr 24 07:48:09.369515 2026] [:error] [pid 19200:tid 19232] [client 20.216.186.228:10360] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeqvuTQ--M3-tsKAnhHv_QAAANg"]
[Fri Apr 24 07:48:10.521045 2026] [:error] [pid 52129:tid 52149] [client 20.216.186.228:13845] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/666.php"] [unique_id "aeqvuuKCZKf8_u2LKiDWUwAAARA"]
[Fri Apr 24 07:48:13.095922 2026] [:error] [pid 52129:tid 52137] [client 20.216.186.228:13844] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeqvveKCZKf8_u2LKiDWaQAAAQQ"]
[Fri Apr 24 07:48:15.814554 2026] [:error] [pid 19102:tid 19185] [client 20.216.186.228:26034] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeqvvwDSgrbLEZbkqD4HIQAAAJU"]
[Fri Apr 24 07:48:17.908019 2026] [:error] [pid 19102:tid 19175] [client 20.216.186.228:2768] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeqvwQDSgrbLEZbkqD4HLwAAAIs"]
[Fri Apr 24 07:48:20.977104 2026] [:error] [pid 52129:tid 52147] [client 20.216.186.228:23503] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xwx1.php"] [unique_id "aeqvxOKCZKf8_u2LKiDWnAAAAQ4"]
[Fri Apr 24 07:48:23.906237 2026] [:error] [pid 19200:tid 19223] [client 20.216.186.228:14153] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aeqvxzQ--M3-tsKAnhHwXgAAAM8"]
[Fri Apr 24 07:48:25.724044 2026] [:error] [pid 52129:tid 52154] [client 20.216.186.228:24682] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aeqvyeKCZKf8_u2LKiDWvwAAARU"]
[Fri Apr 24 07:48:28.126712 2026] [:error] [pid 19102:tid 19175] [client 20.216.186.228:16705] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aeqvzADSgrbLEZbkqD4HTwAAAIs"]
[Fri Apr 24 07:48:30.346697 2026] [:error] [pid 19200:tid 19214] [client 20.216.186.228:21122] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/prosellers8.php"] [unique_id "aeqvzjQ--M3-tsKAnhHweQAAAMY"]
[Fri Apr 24 07:48:33.425918 2026] [:error] [pid 19200:tid 19224] [client 20.216.186.228:10536] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aeqv0TQ--M3-tsKAnhHwlwAAANA"]
[Fri Apr 24 07:48:35.017785 2026] [:error] [pid 19101:tid 19158] [client 20.216.186.228:21067] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aeqv02AHj9bEvrTgbO0DcwAAAFU"]
[Fri Apr 24 07:48:36.277296 2026] [:error] [pid 19100:tid 19129] [client 20.216.186.228:21828] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aeqv1LF_hzQs4Cqbifc62gAAABM"]
[Fri Apr 24 07:48:37.985550 2026] [:error] [pid 19102:tid 19168] [client 20.216.186.228:10536] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/shop.php"] [unique_id "aeqv1QDSgrbLEZbkqD4HfgAAAIQ"]
[Fri Apr 24 07:48:39.623158 2026] [:error] [pid 19100:tid 19120] [client 20.216.186.228:21830] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aeqv17F_hzQs4Cqbifc65gAAAAo"]
[Fri Apr 24 07:48:42.007935 2026] [:error] [pid 19101:tid 19154] [client 20.216.186.228:21843] [client 20.216.186.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ww.php"] [unique_id "aeqv2mAHj9bEvrTgbO0DgwAAAFE"]
[Fri Apr 24 07:48:43.342259 2026] [:error] [pid 19200:tid 19220] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Fri Apr 24 07:48:43.628711 2026] [:error] [pid 19200:tid 19219] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/fsjzs.php
[Fri Apr 24 07:48:43.894851 2026] [:error] [pid 19200:tid 19222] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Fri Apr 24 07:48:44.160961 2026] [:error] [pid 19200:tid 19214] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Fri Apr 24 07:48:44.503958 2026] [:error] [pid 19200:tid 19221] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Apr 24 07:48:44.808655 2026] [:error] [pid 19200:tid 19228] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Fri Apr 24 07:48:45.076889 2026] [:error] [pid 19200:tid 19230] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Apr 24 07:48:45.343773 2026] [:error] [pid 19200:tid 19210] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/ai.php
[Fri Apr 24 07:48:46.140406 2026] [:error] [pid 19200:tid 19232] [client 20.216.186.228:27046] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Fri Apr 24 20:25:11.601639 2026] [:error] [pid 4177:tid 4191] [client 195.178.110.241:47592] [client 195.178.110.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aethJ32asKnvdrSe0x4AvQAAAYY"]
[Sat Apr 25 00:10:25.603290 2026] [:error] [pid 42852:tid 42858] [client 151.243.143.47:33948] [client 151.243.143.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aeuV8TMEwxhhak_EhMJltAAAAkM"]
[Sat Apr 25 00:10:25.605987 2026] [:error] [pid 42852:tid 42859] [client 151.243.143.47:33962] [client 151.243.143.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "aeuV8TMEwxhhak_EhMJltQAAAkQ"]
[Sat Apr 25 00:53:35.155026 2026] [:error] [pid 42755:tid 42757] [client 45.45.237.225:49952] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "aeugD9H7__k0j6aa6039cwAAAIA"]
[Sat Apr 25 00:53:35.155436 2026] [:error] [pid 42791:tid 42799] [client 45.45.237.225:49936] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aeugD7KmN9doraCEWKXj8gAAAcQ"]
[Sat Apr 25 01:38:11.427521 2026] [:error] [pid 42792:tid 42836] [client 20.89.236.85:1726] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Apr 25 01:38:11.550759 2026] [:error] [pid 42792:tid 42835] [client 20.89.236.85:1726] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Apr 25 01:38:11.797699 2026] [:error] [pid 42792:tid 42842] [client 20.89.236.85:1726] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Apr 25 01:38:11.921192 2026] [:error] [pid 42792:tid 42843] [client 20.89.236.85:1726] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Apr 25 01:38:12.195558 2026] [:error] [pid 42792:tid 42832] [client 20.89.236.85:1726] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat Apr 25 01:38:12.318341 2026] [:error] [pid 42792:tid 42845] [client 20.89.236.85:1726] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Apr 25 01:38:12.443576 2026] [:error] [pid 42792:tid 42838] [client 20.89.236.85:1726] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Apr 25 01:38:12.812518 2026] [:error] [pid 42792:tid 42833] [client 20.89.236.85:1726] [client 20.89.236.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "aeuqhNNi9qR4GtafpfHekAAAAgs"]
[Sat Apr 25 01:38:13.294172 2026] [:error] [pid 42792:tid 42828] [client 20.89.236.85:1551] [client 20.89.236.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "aeuqhdNi9qR4GtafpfHekgAAAgY"]
[Sat Apr 25 01:38:13.776890 2026] [:error] [pid 14989:tid 15014] [client 20.89.236.85:1189] [client 20.89.236.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "aeuqhXhRYjsAsZTO4EOhPwAAABc"]
[Sat Apr 25 01:38:14.325579 2026] [:error] [pid 14989:tid 15002] [client 20.89.236.85:1157] [client 20.89.236.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "aeuqhnhRYjsAsZTO4EOhQgAAAAs"]
[Sat Apr 25 03:32:24.904988 2026] [:error] [pid 40829:tid 40841] [client 52.139.225.142:1362] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Apr 25 03:32:24.996373 2026] [:error] [pid 40829:tid 40856] [client 52.139.225.142:1362] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Apr 25 03:32:25.183830 2026] [:error] [pid 40829:tid 40855] [client 52.139.225.142:1362] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Apr 25 03:32:25.277130 2026] [:error] [pid 40829:tid 40848] [client 52.139.225.142:1362] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Apr 25 03:32:25.461308 2026] [:error] [pid 40829:tid 40857] [client 52.139.225.142:1362] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat Apr 25 03:32:25.581200 2026] [:error] [pid 40829:tid 40851] [client 52.139.225.142:1362] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Apr 25 03:32:25.674653 2026] [:error] [pid 40829:tid 40840] [client 52.139.225.142:1362] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Apr 25 03:32:25.955136 2026] [:error] [pid 40829:tid 40853] [client 52.139.225.142:1362] [client 52.139.225.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "aevFSX9aBLbh2KXOloORRwAAABQ"]
[Sat Apr 25 03:32:26.360719 2026] [:error] [pid 40831:tid 40891] [client 52.139.225.142:1776] [client 52.139.225.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "aevFSsC1ApXgo_VIxksjswAAAII"]
[Sat Apr 25 03:32:26.738493 2026] [:error] [pid 40830:tid 40872] [client 52.139.225.142:1397] [client 52.139.225.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "aevFSmbs17K4x2MIwqGBmQAAAEo"]
[Sat Apr 25 03:32:27.139563 2026] [:error] [pid 40829:tid 40842] [client 52.139.225.142:1368] [client 52.139.225.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "aevFS39aBLbh2KXOloORSgAAAAk"]
[Sun Apr 26 00:53:22.350016 2026] [:error] [pid 59896:tid 59906] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Apr 26 00:53:22.814821 2026] [:error] [pid 59896:tid 59903] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Apr 26 00:53:23.139880 2026] [:error] [pid 59896:tid 59901] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Apr 26 00:53:24.098844 2026] [:error] [pid 59896:tid 59908] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Apr 26 00:53:24.361433 2026] [:error] [pid 59896:tid 59921] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Apr 26 00:53:24.838769 2026] [:error] [pid 59896:tid 59922] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Apr 26 00:53:25.212323 2026] [:error] [pid 59896:tid 59924] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 26 00:53:25.939008 2026] [:error] [pid 59896:tid 59906] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Apr 26 00:53:26.513066 2026] [:error] [pid 59896:tid 59900] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Apr 26 00:53:27.146507 2026] [:error] [pid 59896:tid 59910] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Apr 26 00:53:27.455939 2026] [:error] [pid 59896:tid 59902] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Apr 26 00:53:27.766183 2026] [:error] [pid 59896:tid 59904] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Apr 26 00:53:27.988790 2026] [:error] [pid 59896:tid 59909] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Apr 26 00:53:28.274321 2026] [:error] [pid 59896:tid 59920] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Apr 26 00:53:28.598459 2026] [:error] [pid 59896:tid 59924] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Apr 26 00:53:28.820273 2026] [:error] [pid 59896:tid 59906] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Apr 26 00:53:29.129624 2026] [:error] [pid 59896:tid 59900] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Apr 26 00:53:29.371760 2026] [:error] [pid 59896:tid 59901] [client 45.131.195.208:56811] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Sun Apr 26 00:53:34.936078 2026] [:error] [pid 59896:tid 59916] [client 45.131.195.208:56811] [client 45.131.195.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aezxjrLLzhtkd-OXUgBFfAAAAFA"]
[Sun Apr 26 01:26:28.876414 2026] [:error] [pid 3212:tid 3232] [client 212.47.78.126:50358] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "aez5RPg-28TY8_YLtUe51AAAARI"]
[Sun Apr 26 01:26:29.454500 2026] [:error] [pid 59985:tid 59997] [client 212.47.78.126:62809] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "aez5RQF_zDvEhKvyTH78MgAAAAo"]
[Sun Apr 26 03:18:39.340792 2026] [:error] [pid 59897:tid 59932] [client 20.207.194.44:2588] File does not exist: /usr/local/apache/htdocs/suspended-page/php8.php
[Sun Apr 26 03:18:39.481787 2026] [:error] [pid 59897:tid 59927] [client 20.207.194.44:2588] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 26 03:18:39.622633 2026] [:error] [pid 59897:tid 59950] [client 20.207.194.44:2588] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Apr 26 03:18:39.762874 2026] [:error] [pid 59897:tid 59933] [client 20.207.194.44:2588] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Sun Apr 26 03:18:39.903641 2026] [:error] [pid 59897:tid 59948] [client 20.207.194.44:2588] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Apr 26 03:18:40.187156 2026] [:error] [pid 59897:tid 59941] [client 20.207.194.44:2588] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Apr 26 03:18:40.327849 2026] [:error] [pid 59897:tid 59944] [client 20.207.194.44:2588] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Apr 26 03:18:40.610148 2026] [:error] [pid 59897:tid 59949] [client 20.207.194.44:2588] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sun Apr 26 03:18:40.888700 2026] [:error] [pid 59897:tid 59930] [client 20.207.194.44:2588] [client 20.207.194.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae0TkPBrrkdzpEbmK4fdzAAAAIM"]
[Sun Apr 26 03:18:41.490633 2026] [:error] [pid 3212:tid 3217] [client 20.207.194.44:8552] [client 20.207.194.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae0Tkfg-28TY8_YLtUf8aQAAAQM"]
[Sun Apr 26 03:18:42.060820 2026] [:error] [pid 59898:tid 59976] [client 20.207.194.44:2601] [client 20.207.194.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae0Tkh-4vImxb0kbdzf4vwAAANY"]
[Sun Apr 26 03:18:42.641002 2026] [:error] [pid 3212:tid 3232] [client 20.207.194.44:2605] [client 20.207.194.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae0Tkvg-28TY8_YLtUf8bgAAARI"]
[Sun Apr 26 04:08:43.838295 2026] [:error] [pid 43019:tid 43072] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 26 04:08:43.956064 2026] [:error] [pid 43019:tid 43058] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Apr 26 04:08:44.073893 2026] [:error] [pid 43019:tid 43049] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Apr 26 04:08:44.191190 2026] [:error] [pid 43019:tid 43069] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Apr 26 04:08:44.336862 2026] [:error] [pid 43019:tid 43053] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sun Apr 26 04:08:44.454300 2026] [:error] [pid 43019:tid 43051] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Apr 26 04:08:44.582193 2026] [:error] [pid 43019:tid 43061] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sun Apr 26 04:08:44.832086 2026] [:error] [pid 43019:tid 43050] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Apr 26 04:08:44.950111 2026] [:error] [pid 43019:tid 43065] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Sun Apr 26 04:08:45.070593 2026] [:error] [pid 43019:tid 43056] [client 52.253.104.46:4699] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Apr 26 04:08:45.184986 2026] [:error] [pid 43019:tid 43070] [client 52.253.104.46:4699] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ae0fTfM3RgXHb-QK8j4NtgAAAFU"]
[Sun Apr 26 04:08:45.916763 2026] [:error] [pid 43112:tid 43136] [client 52.253.104.46:4694] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ae0fTR4HreKc4xJmUlMFmAAAANY"]
[Sun Apr 26 04:08:46.426856 2026] [:error] [pid 43019:tid 43055] [client 52.253.104.46:4744] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ae0fTvM3RgXHb-QK8j4NtwAAAEY"]
[Sun Apr 26 04:08:46.886218 2026] [:error] [pid 43019:tid 43057] [client 52.253.104.46:4673] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ae0fTvM3RgXHb-QK8j4NuAAAAEg"]
[Sun Apr 26 08:09:42.701297 2026] [:error] [pid 13197:tid 13251] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Apr 26 08:09:43.006811 2026] [:error] [pid 13197:tid 13238] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Sun Apr 26 08:09:43.306733 2026] [:error] [pid 13197:tid 13248] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Sun Apr 26 08:09:43.596537 2026] [:error] [pid 13197:tid 13236] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/.sghb.php
[Sun Apr 26 08:09:44.012440 2026] [:error] [pid 13197:tid 13244] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/zoko.php
[Sun Apr 26 08:09:44.318330 2026] [:error] [pid 13197:tid 13254] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/solo1.php
[Sun Apr 26 08:09:44.695711 2026] [:error] [pid 13197:tid 13253] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/locales.php
[Sun Apr 26 08:09:44.977629 2026] [:error] [pid 13197:tid 13249] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sun Apr 26 08:09:45.231814 2026] [:error] [pid 13197:tid 13247] [client 20.203.174.117:60364] File does not exist: /usr/local/apache/htdocs/suspended-page/pucci.php
[Sun Apr 26 08:09:45.761350 2026] [:error] [pid 13197:tid 13233] [client 20.203.174.117:60364] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ae1Xyd3kktFKdSxTrBuXugAAAsI"]
[Sun Apr 26 08:09:46.734007 2026] [:error] [pid 8390:tid 8475] [client 20.203.174.117:60408] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ae1XyoGPtFK_i9p5yxQ2WAAAAJg"]
[Sun Apr 26 08:09:48.121525 2026] [:error] [pid 13197:tid 13235] [client 20.203.174.117:60395] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ae1XzN3kktFKdSxTrBuXvgAAAsQ"]
[Sun Apr 26 08:09:49.369540 2026] [:error] [pid 8390:tid 8452] [client 20.203.174.117:21761] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ae1XzYGPtFK_i9p5yxQ2WgAAAIE"]
[Sun Apr 26 08:09:50.286569 2026] [:error] [pid 8491:tid 8506] [client 20.203.174.117:43467] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1Xziq7I7e6CJooQM2vnwAAAMc"]
[Sun Apr 26 08:09:51.134170 2026] [:error] [pid 8390:tid 8459] [client 20.203.174.117:3496] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1Xz4GPtFK_i9p5yxQ2YgAAAIg"]
[Sun Apr 26 08:09:51.941328 2026] [:error] [pid 22572:tid 22590] [client 20.203.174.117:19988] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1Xz9XOViWCFU-pZzB9agAAAUw"]
[Sun Apr 26 08:09:53.415836 2026] [:error] [pid 13137:tid 13162] [client 20.203.174.117:63894] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1X0d0RB4J0o4h5neHsJAAAAhU"]
[Sun Apr 26 08:09:56.270327 2026] [:error] [pid 8390:tid 8475] [client 20.203.174.117:8796] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ae1X1IGPtFK_i9p5yxQ2rAAAAJg"]
[Sun Apr 26 08:09:58.212571 2026] [:error] [pid 8390:tid 8453] [client 20.203.174.117:26460] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ae1X1oGPtFK_i9p5yxQ2swAAAII"]
[Sun Apr 26 08:09:59.105349 2026] [:error] [pid 22573:tid 22626] [client 20.203.174.117:3494] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ae1X13B3EmQlD4yKUt8uKwAAAZM"]
[Sun Apr 26 08:09:59.829423 2026] [:error] [pid 8390:tid 8460] [client 20.203.174.117:55717] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ae1X14GPtFK_i9p5yxQ2uAAAAIk"]
[Sun Apr 26 08:10:01.110972 2026] [:error] [pid 8385:tid 8441] [client 20.203.174.117:8829] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.admin.php"] [unique_id "ae1X2TOy7_J84Wx3-ox3YQAAAFE"]
[Sun Apr 26 08:10:02.066472 2026] [:error] [pid 22573:tid 22607] [client 20.203.174.117:55738] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.admin.php"] [unique_id "ae1X2nB3EmQlD4yKUt8uNAAAAYE"]
[Sun Apr 26 08:10:03.091867 2026] [:error] [pid 8383:tid 8397] [client 20.203.174.117:28572] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.admin.php"] [unique_id "ae1X29Fa2S3EsATMdWPSJAAAAAA"]
[Sun Apr 26 08:10:04.313730 2026] [:error] [pid 16515:tid 16523] [client 20.203.174.117:3490] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.admin.php"] [unique_id "ae1X3FtDrUmgHSvpuLzRygAAAkU"]
[Sun Apr 26 08:10:05.279066 2026] [:error] [pid 22572:tid 22579] [client 20.203.174.117:55728] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sw.php"] [unique_id "ae1X3dXOViWCFU-pZzB9fQAAAUE"]
[Sun Apr 26 08:10:06.875967 2026] [:error] [pid 8390:tid 8474] [client 20.203.174.117:64343] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sw.php"] [unique_id "ae1X3oGPtFK_i9p5yxQ2wgAAAJc"]
[Sun Apr 26 08:10:07.731907 2026] [:error] [pid 13197:tid 13254] [client 20.203.174.117:60356] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sw.php"] [unique_id "ae1X393kktFKdSxTrBuXwQAAAtY"]
[Sun Apr 26 08:10:08.995344 2026] [:error] [pid 22573:tid 22620] [client 20.203.174.117:63971] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sw.php"] [unique_id "ae1X4HB3EmQlD4yKUt8uNwAAAY0"]
[Sun Apr 26 08:10:10.464311 2026] [:error] [pid 8390:tid 8458] [client 20.203.174.117:21765] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vuln.php"] [unique_id "ae1X4oGPtFK_i9p5yxQ2zQAAAIc"]
[Sun Apr 26 08:10:11.785072 2026] [:error] [pid 8390:tid 8470] [client 20.203.174.117:26432] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vuln.php"] [unique_id "ae1X44GPtFK_i9p5yxQ20wAAAJM"]
[Sun Apr 26 08:10:12.810752 2026] [:error] [pid 8390:tid 8473] [client 20.203.174.117:63918] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vuln.php"] [unique_id "ae1X5IGPtFK_i9p5yxQ21wAAAJY"]
[Sun Apr 26 08:10:13.814647 2026] [:error] [pid 8390:tid 8465] [client 20.203.174.117:19363] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vuln.php"] [unique_id "ae1X5YGPtFK_i9p5yxQ22wAAAI4"]
[Sun Apr 26 08:10:14.630499 2026] [:error] [pid 13137:tid 13140] [client 20.203.174.117:63961] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "ae1X5t0RB4J0o4h5neHsLAAAAgA"]
[Sun Apr 26 08:10:16.396807 2026] [:error] [pid 16515:tid 16527] [client 20.203.174.117:55719] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "ae1X6FtDrUmgHSvpuLzRzAAAAkk"]
[Sun Apr 26 08:10:18.213974 2026] [:error] [pid 16515:tid 16541] [client 20.203.174.117:8786] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "ae1X6ltDrUmgHSvpuLzR0AAAAlc"]
[Sun Apr 26 08:10:19.501497 2026] [:error] [pid 13197:tid 13253] [client 20.203.174.117:55692] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "ae1X693kktFKdSxTrBuXwgAAAtU"]
[Sun Apr 26 08:10:20.733886 2026] [:error] [pid 22573:tid 22624] [client 20.203.174.117:63899] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sxdfrt.php"] [unique_id "ae1X7HB3EmQlD4yKUt8uRwAAAZE"]
[Sun Apr 26 08:10:21.411547 2026] [:error] [pid 22573:tid 22606] [client 20.203.174.117:43488] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sxdfrt.php"] [unique_id "ae1X7XB3EmQlD4yKUt8uSQAAAYA"]
[Sun Apr 26 08:10:22.304091 2026] [:error] [pid 8390:tid 8463] [client 20.203.174.117:19969] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sxdfrt.php"] [unique_id "ae1X7oGPtFK_i9p5yxQ23QAAAIw"]
[Sun Apr 26 08:10:22.974856 2026] [:error] [pid 8390:tid 8474] [client 20.203.174.117:63911] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sxdfrt.php"] [unique_id "ae1X7oGPtFK_i9p5yxQ23wAAAJc"]
[Sun Apr 26 08:10:24.146120 2026] [:error] [pid 8390:tid 8473] [client 20.203.174.117:19348] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "ae1X8IGPtFK_i9p5yxQ24QAAAJY"]
[Sun Apr 26 08:10:25.167311 2026] [:error] [pid 8390:tid 8467] [client 20.203.174.117:64334] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "ae1X8YGPtFK_i9p5yxQ25wAAAJA"]
[Sun Apr 26 08:10:25.985657 2026] [:error] [pid 8390:tid 8453] [client 20.203.174.117:64353] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "ae1X8YGPtFK_i9p5yxQ26QAAAII"]
[Sun Apr 26 08:10:26.591420 2026] [:error] [pid 8390:tid 8470] [client 20.203.174.117:19334] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "ae1X8oGPtFK_i9p5yxQ26wAAAJM"]
[Sun Apr 26 08:10:27.478680 2026] [:error] [pid 8390:tid 8472] [client 20.203.174.117:8810] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ae1X84GPtFK_i9p5yxQ27AAAAJU"]
[Sun Apr 26 08:10:28.223333 2026] [:error] [pid 8390:tid 8462] [client 20.203.174.117:21764] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ae1X9IGPtFK_i9p5yxQ27QAAAIs"]
[Sun Apr 26 08:10:28.846414 2026] [:error] [pid 22572:tid 22578] [client 20.203.174.117:55724] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ae1X9NXOViWCFU-pZzB9ggAAAUA"]
[Sun Apr 26 08:10:29.650351 2026] [:error] [pid 22573:tid 22618] [client 20.203.174.117:3466] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ae1X9XB3EmQlD4yKUt8uUAAAAYs"]
[Sun Apr 26 08:10:30.497952 2026] [:error] [pid 8390:tid 8459] [client 20.203.174.117:57621] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-bda.php"] [unique_id "ae1X9oGPtFK_i9p5yxQ28QAAAIg"]
[Sun Apr 26 08:10:31.237328 2026] [:error] [pid 22573:tid 22606] [client 20.203.174.117:8751] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-bda.php"] [unique_id "ae1X93B3EmQlD4yKUt8uVAAAAYA"]
[Sun Apr 26 08:10:32.387865 2026] [:error] [pid 8390:tid 8460] [client 20.203.174.117:23819] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-bda.php"] [unique_id "ae1X-IGPtFK_i9p5yxQ29gAAAIk"]
[Sun Apr 26 08:10:33.475498 2026] [:error] [pid 8390:tid 8461] [client 20.203.174.117:64370] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-bda.php"] [unique_id "ae1X-YGPtFK_i9p5yxQ2-AAAAIo"]
[Sun Apr 26 08:10:34.267553 2026] [:error] [pid 13197:tid 13240] [client 20.203.174.117:23868] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bhm.php"] [unique_id "ae1X-t3kktFKdSxTrBuXwwAAAsk"]
[Sun Apr 26 08:10:35.082984 2026] [:error] [pid 16515:tid 16523] [client 20.203.174.117:21807] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bhm.php"] [unique_id "ae1X-1tDrUmgHSvpuLzR1gAAAkU"]
[Sun Apr 26 08:10:36.069054 2026] [:error] [pid 22572:tid 22580] [client 20.203.174.117:63987] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bhm.php"] [unique_id "ae1X_NXOViWCFU-pZzB9hgAAAUI"]
[Sun Apr 26 08:10:37.205524 2026] [:error] [pid 8390:tid 8473] [client 20.203.174.117:57178] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bhm.php"] [unique_id "ae1X_YGPtFK_i9p5yxQ2_gAAAJY"]
[Sun Apr 26 08:10:37.994887 2026] [:error] [pid 8390:tid 8474] [client 20.203.174.117:3518] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "ae1X_YGPtFK_i9p5yxQ2_wAAAJc"]
[Sun Apr 26 08:10:38.931912 2026] [:error] [pid 16574:tid 16621] [client 20.203.174.117:64339] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "ae1X_n5MsX8wRQr99nYAtwAAA00"]
[Sun Apr 26 08:10:39.777478 2026] [:error] [pid 22572:tid 22595] [client 20.203.174.117:57197] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "ae1X_9XOViWCFU-pZzB9iQAAAVE"]
[Sun Apr 26 08:10:41.085378 2026] [:error] [pid 22572:tid 22594] [client 20.203.174.117:8774] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "ae1YAdXOViWCFU-pZzB9igAAAVA"]
[Sun Apr 26 08:10:41.918208 2026] [:error] [pid 22573:tid 22606] [client 20.203.174.117:57632] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "ae1YAXB3EmQlD4yKUt8uXAAAAYA"]
[Sun Apr 26 08:10:42.950059 2026] [:error] [pid 22573:tid 22627] [client 20.203.174.117:3884] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "ae1YAnB3EmQlD4yKUt8uXwAAAZQ"]
[Sun Apr 26 08:10:43.836605 2026] [:error] [pid 22573:tid 22609] [client 20.203.174.117:3865] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "ae1YA3B3EmQlD4yKUt8uZAAAAYM"]
[Sun Apr 26 08:10:45.926873 2026] [:error] [pid 22573:tid 22626] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/ref.php
[Sun Apr 26 08:10:46.166681 2026] [:error] [pid 22573:tid 22624] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xme.php
[Sun Apr 26 08:10:46.432636 2026] [:error] [pid 22573:tid 22610] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sun Apr 26 08:10:46.671656 2026] [:error] [pid 22573:tid 22608] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/ktfow.php
[Sun Apr 26 08:10:46.913416 2026] [:error] [pid 22573:tid 22613] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Sun Apr 26 08:10:47.205412 2026] [:error] [pid 22573:tid 22619] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/Xx.php
[Sun Apr 26 08:10:47.455395 2026] [:error] [pid 22573:tid 22621] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/xmini.php
[Sun Apr 26 08:10:47.698795 2026] [:error] [pid 22573:tid 22615] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/2468.php
[Sun Apr 26 08:10:48.223914 2026] [:error] [pid 22573:tid 22620] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sun Apr 26 08:10:48.462110 2026] [:error] [pid 22573:tid 22622] [client 20.203.174.117:41677] File does not exist: /usr/local/apache/htdocs/suspended-page/amdin.php
[Sun Apr 26 08:10:48.697882 2026] [:error] [pid 22573:tid 22626] [client 20.203.174.117:41677] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/huya.php"] [unique_id "ae1YCHB3EmQlD4yKUt8ueAAAAZM"]
[Sun Apr 26 08:10:49.364807 2026] [:error] [pid 22572:tid 22601] [client 20.203.174.117:4011] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/huya.php"] [unique_id "ae1YCdXOViWCFU-pZzB9sgAAAVc"]
[Sun Apr 26 08:10:50.807160 2026] [:error] [pid 22572:tid 22582] [client 20.203.174.117:54167] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/huya.php"] [unique_id "ae1YCtXOViWCFU-pZzB9tQAAAUQ"]
[Sun Apr 26 08:10:52.742478 2026] [:error] [pid 13137:tid 13147] [client 20.203.174.117:58775] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/huya.php"] [unique_id "ae1YDN0RB4J0o4h5neHsQgAAAgc"]
[Sun Apr 26 08:10:53.476733 2026] [:error] [pid 13137:tid 13164] [client 20.203.174.117:22011] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/puc.php"] [unique_id "ae1YDd0RB4J0o4h5neHsRAAAAhc"]
[Sun Apr 26 08:10:55.387392 2026] [:error] [pid 16515:tid 16539] [client 20.203.174.117:60335] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/puc.php"] [unique_id "ae1YD1tDrUmgHSvpuLzR2gAAAlU"]
[Sun Apr 26 08:10:56.177153 2026] [:error] [pid 8390:tid 8460] [client 20.203.174.117:3425] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/puc.php"] [unique_id "ae1YEIGPtFK_i9p5yxQ3DAAAAIk"]
[Sun Apr 26 08:10:57.073639 2026] [:error] [pid 8390:tid 8453] [client 20.203.174.117:22065] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/puc.php"] [unique_id "ae1YEYGPtFK_i9p5yxQ3DwAAAII"]
[Sun Apr 26 08:10:57.984523 2026] [:error] [pid 8390:tid 8468] [client 20.203.174.117:33308] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "ae1YEYGPtFK_i9p5yxQ3EgAAAJE"]
[Sun Apr 26 08:10:59.128737 2026] [:error] [pid 13137:tid 13152] [client 20.203.174.117:21978] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "ae1YE90RB4J0o4h5neHsSQAAAgs"]
[Sun Apr 26 08:10:59.990451 2026] [:error] [pid 13197:tid 13237] [client 20.203.174.117:8320] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "ae1YE93kktFKdSxTrBuXxwAAAsY"]
[Sun Apr 26 08:11:00.828569 2026] [:error] [pid 13137:tid 13155] [client 20.203.174.117:61844] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "ae1YFN0RB4J0o4h5neHsTQAAAg4"]
[Sun Apr 26 08:11:02.129347 2026] [:error] [pid 13137:tid 13148] [client 20.203.174.117:64785] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ewp.php"] [unique_id "ae1YFt0RB4J0o4h5neHsTwAAAgg"]
[Sun Apr 26 08:11:04.387884 2026] [:error] [pid 8390:tid 8471] [client 20.203.174.117:64821] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ewp.php"] [unique_id "ae1YGIGPtFK_i9p5yxQ3IAAAAJQ"]
[Sun Apr 26 08:11:07.625108 2026] [:error] [pid 8390:tid 8458] [client 20.203.174.117:33305] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ewp.php"] [unique_id "ae1YG4GPtFK_i9p5yxQ3LgAAAIc"]
[Sun Apr 26 08:11:09.105377 2026] [:error] [pid 16515:tid 16522] [client 20.203.174.117:34966] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ewp.php"] [unique_id "ae1YHVtDrUmgHSvpuLzR3AAAAkQ"]
[Sun Apr 26 08:11:10.659529 2026] [:error] [pid 22573:tid 22616] [client 20.203.174.117:18534] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "ae1YHnB3EmQlD4yKUt8ukAAAAYk"]
[Sun Apr 26 08:11:12.134764 2026] [:error] [pid 22573:tid 22622] [client 20.203.174.117:35000] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "ae1YIHB3EmQlD4yKUt8ukQAAAY8"]
[Sun Apr 26 08:11:12.950296 2026] [:error] [pid 8390:tid 8475] [client 20.203.174.117:31337] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "ae1YIIGPtFK_i9p5yxQ3RQAAAJg"]
[Sun Apr 26 08:11:13.999244 2026] [:error] [pid 8390:tid 8471] [client 20.203.174.117:28100] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "ae1YIYGPtFK_i9p5yxQ3SwAAAJQ"]
[Sun Apr 26 08:11:16.407355 2026] [:error] [pid 8390:tid 8472] [client 20.203.174.117:25821] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ae1YJIGPtFK_i9p5yxQ3VwAAAJU"]
[Sun Apr 26 08:11:17.264931 2026] [:error] [pid 8390:tid 8465] [client 20.203.174.117:25822] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ae1YJYGPtFK_i9p5yxQ3XQAAAI4"]
[Sun Apr 26 08:11:18.592504 2026] [:error] [pid 13197:tid 13234] [client 20.203.174.117:18513] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ae1YJt3kktFKdSxTrBuXyAAAAsM"]
[Sun Apr 26 08:11:20.510026 2026] [:error] [pid 22573:tid 22619] [client 20.203.174.117:10028] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ae1YKHB3EmQlD4yKUt8ulgAAAYw"]
[Sun Apr 26 08:11:22.363117 2026] [:error] [pid 22573:tid 22612] [client 20.203.174.117:25807] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "ae1YKnB3EmQlD4yKUt8umAAAAYY"]
[Sun Apr 26 08:11:24.339049 2026] [:error] [pid 22572:tid 22581] [client 20.203.174.117:18533] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "ae1YLNXOViWCFU-pZzB9wwAAAUM"]
[Sun Apr 26 08:11:25.268611 2026] [:error] [pid 22573:tid 22617] [client 20.203.174.117:18514] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "ae1YLXB3EmQlD4yKUt8unQAAAYo"]
[Sun Apr 26 08:11:26.063272 2026] [:error] [pid 22573:tid 22616] [client 20.203.174.117:21764] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "ae1YLnB3EmQlD4yKUt8ungAAAYk"]
[Sun Apr 26 08:11:28.008113 2026] [:error] [pid 13137:tid 13157] [client 20.203.174.117:25795] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "ae1YMN0RB4J0o4h5neHsZAAAAhA"]
[Sun Apr 26 08:11:28.695163 2026] [:error] [pid 22573:tid 22631] [client 20.203.174.117:58002] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "ae1YMHB3EmQlD4yKUt8unwAAAZg"]
[Sun Apr 26 08:11:29.893963 2026] [:error] [pid 22573:tid 22610] [client 20.203.174.117:25806] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "ae1YMXB3EmQlD4yKUt8uowAAAYQ"]
[Sun Apr 26 08:11:31.136309 2026] [:error] [pid 16515:tid 16529] [client 20.203.174.117:64317] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lupo.php"] [unique_id "ae1YM1tDrUmgHSvpuLzR3gAAAks"]
[Sun Apr 26 08:11:32.019164 2026] [:error] [pid 8390:tid 8459] [client 20.203.174.117:56697] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "ae1YNIGPtFK_i9p5yxQ3aQAAAIg"]
[Sun Apr 26 08:11:33.388039 2026] [:error] [pid 8390:tid 8471] [client 20.203.174.117:3126] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "ae1YNYGPtFK_i9p5yxQ3awAAAJQ"]
[Sun Apr 26 08:11:37.244139 2026] [:error] [pid 8390:tid 8451] [client 20.203.174.117:29925] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "ae1YOYGPtFK_i9p5yxQ3dQAAAIA"]
[Sun Apr 26 08:11:39.057374 2026] [:error] [pid 8390:tid 8470] [client 20.203.174.117:29901] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/awa.php"] [unique_id "ae1YO4GPtFK_i9p5yxQ3eAAAAJM"]
[Sun Apr 26 08:11:40.265280 2026] [:error] [pid 8390:tid 8467] [client 20.203.174.117:64307] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "ae1YPIGPtFK_i9p5yxQ3ewAAAJA"]
[Sun Apr 26 08:11:42.572050 2026] [:error] [pid 22572:tid 22592] [client 20.203.174.117:30230] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "ae1YPtXOViWCFU-pZzB9ywAAAU4"]
[Sun Apr 26 08:11:43.769216 2026] [:error] [pid 8385:tid 8448] [client 20.203.174.117:29892] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "ae1YPzOy7_J84Wx3-ox3cwAAAFg"]
[Sun Apr 26 08:11:45.608677 2026] [:error] [pid 8383:tid 8421] [client 20.203.174.117:18375] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/popo.php"] [unique_id "ae1YQdFa2S3EsATMdWPSLQAAABg"]
[Sun Apr 26 08:11:48.728886 2026] [:error] [pid 22572:tid 22591] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Sun Apr 26 08:11:49.111958 2026] [:error] [pid 22572:tid 22599] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Sun Apr 26 08:11:49.467502 2026] [:error] [pid 22572:tid 22583] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sun Apr 26 08:11:49.943876 2026] [:error] [pid 22572:tid 22594] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Sun Apr 26 08:11:50.213859 2026] [:error] [pid 22572:tid 22601] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sun Apr 26 08:11:50.470825 2026] [:error] [pid 22572:tid 22586] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Sun Apr 26 08:11:50.723377 2026] [:error] [pid 22572:tid 22593] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Sun Apr 26 08:11:50.977955 2026] [:error] [pid 22572:tid 22597] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sun Apr 26 08:11:51.219815 2026] [:error] [pid 22572:tid 22602] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sun Apr 26 08:11:51.520510 2026] [:error] [pid 22572:tid 22578] [client 20.203.174.117:7990] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Apr 26 08:11:51.888839 2026] [:error] [pid 22572:tid 22598] [client 20.203.174.117:7990] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "ae1YR9XOViWCFU-pZzB93QAAAVQ"]
[Sun Apr 26 08:11:53.590144 2026] [:error] [pid 8390:tid 8470] [client 20.203.174.117:45031] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "ae1YSYGPtFK_i9p5yxQ3iwAAAJM"]
[Sun Apr 26 08:11:54.726439 2026] [:error] [pid 8390:tid 8458] [client 20.203.174.117:56725] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "ae1YSoGPtFK_i9p5yxQ3jwAAAIc"]
[Sun Apr 26 08:11:55.624694 2026] [:error] [pid 8390:tid 8456] [client 20.203.174.117:45017] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "ae1YS4GPtFK_i9p5yxQ3kQAAAIU"]
[Sun Apr 26 08:11:56.652561 2026] [:error] [pid 22573:tid 22608] [client 20.203.174.117:62985] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "ae1YTHB3EmQlD4yKUt8urgAAAYI"]
[Sun Apr 26 08:11:57.619307 2026] [:error] [pid 22573:tid 22628] [client 20.203.174.117:7999] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "ae1YTXB3EmQlD4yKUt8urwAAAZU"]
[Sun Apr 26 08:11:58.371013 2026] [:error] [pid 8383:tid 8401] [client 20.203.174.117:45006] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "ae1YTtFa2S3EsATMdWPSMAAAAAQ"]
[Sun Apr 26 08:11:59.148700 2026] [:error] [pid 22573:tid 22630] [client 20.203.174.117:14633] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3.php"] [unique_id "ae1YT3B3EmQlD4yKUt8usQAAAZc"]
[Sun Apr 26 08:11:59.921533 2026] [:error] [pid 8383:tid 8410] [client 20.203.174.117:45012] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "ae1YT9Fa2S3EsATMdWPSMQAAAA0"]
[Sun Apr 26 08:12:01.137297 2026] [:error] [pid 22572:tid 22596] [client 20.203.174.117:14655] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "ae1YUdXOViWCFU-pZzB94QAAAVI"]
[Sun Apr 26 08:12:03.063712 2026] [:error] [pid 13137:tid 13160] [client 20.203.174.117:18863] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "ae1YU90RB4J0o4h5neHsfgAAAhM"]
[Sun Apr 26 08:12:04.459091 2026] [:error] [pid 22573:tid 22631] [client 20.203.174.117:61542] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4.php"] [unique_id "ae1YVHB3EmQlD4yKUt8utgAAAZg"]
[Sun Apr 26 08:12:05.473134 2026] [:error] [pid 16515:tid 16533] [client 20.203.174.117:56214] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "ae1YVVtDrUmgHSvpuLzR6QAAAk8"]
[Sun Apr 26 08:12:08.235435 2026] [:error] [pid 8385:tid 8428] [client 20.203.174.117:21927] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "ae1YWDOy7_J84Wx3-ox3dwAAAEQ"]
[Sun Apr 26 08:12:09.140488 2026] [:error] [pid 8390:tid 8470] [client 20.203.174.117:7988] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "ae1YWYGPtFK_i9p5yxQ3nwAAAJM"]
[Sun Apr 26 08:12:09.988697 2026] [:error] [pid 22572:tid 22600] [client 20.203.174.117:43534] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/5.php"] [unique_id "ae1YWdXOViWCFU-pZzB96wAAAVY"]
[Sun Apr 26 08:12:11.545882 2026] [:error] [pid 13137:tid 13163] [client 20.203.174.117:63026] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6.php"] [unique_id "ae1YW90RB4J0o4h5neHshwAAAhY"]
[Sun Apr 26 08:12:13.342044 2026] [:error] [pid 8385:tid 8433] [client 20.203.174.117:21903] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6.php"] [unique_id "ae1YXTOy7_J84Wx3-ox3eQAAAEk"]
[Sun Apr 26 08:12:14.739391 2026] [:error] [pid 8390:tid 8473] [client 20.203.174.117:60009] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6.php"] [unique_id "ae1YXoGPtFK_i9p5yxQ3pQAAAJY"]
[Sun Apr 26 08:12:15.628219 2026] [:error] [pid 13137:tid 13149] [client 20.203.174.117:45023] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6.php"] [unique_id "ae1YX90RB4J0o4h5neHskAAAAgk"]
[Sun Apr 26 08:12:16.348306 2026] [:error] [pid 8390:tid 8460] [client 20.203.174.117:56209] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "ae1YYIGPtFK_i9p5yxQ3qgAAAIk"]
[Sun Apr 26 08:12:16.932891 2026] [:error] [pid 8390:tid 8466] [client 20.203.174.117:18827] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "ae1YYIGPtFK_i9p5yxQ3qwAAAI8"]
[Sun Apr 26 08:12:17.648545 2026] [:error] [pid 8385:tid 8430] [client 20.203.174.117:7964] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "ae1YYTOy7_J84Wx3-ox3egAAAEY"]
[Sun Apr 26 08:12:18.563787 2026] [:error] [pid 22572:tid 22579] [client 20.203.174.117:7938] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/9.php"] [unique_id "ae1YYtXOViWCFU-pZzB9-QAAAUE"]
[Sun Apr 26 08:12:19.216666 2026] [:error] [pid 8390:tid 8468] [client 20.203.174.117:7952] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "ae1YY4GPtFK_i9p5yxQ3rwAAAJE"]
[Sun Apr 26 08:12:20.077606 2026] [:error] [pid 8385:tid 8446] [client 20.203.174.117:61513] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "ae1YZDOy7_J84Wx3-ox3fQAAAFY"]
[Sun Apr 26 08:12:20.816819 2026] [:error] [pid 8390:tid 8456] [client 20.203.174.117:63015] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "ae1YZIGPtFK_i9p5yxQ3sAAAAIU"]
[Sun Apr 26 08:12:21.911406 2026] [:error] [pid 16574:tid 16613] [client 20.203.174.117:21922] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/10.php"] [unique_id "ae1YZX5MsX8wRQr99nYAvQAAA0k"]
[Sun Apr 26 08:12:23.380756 2026] [:error] [pid 8390:tid 8469] [client 20.203.174.117:42086] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "ae1YZ4GPtFK_i9p5yxQ3uAAAAJI"]
[Sun Apr 26 08:12:24.236557 2026] [:error] [pid 8390:tid 8459] [client 20.203.174.117:7977] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "ae1YaIGPtFK_i9p5yxQ3uwAAAIg"]
[Sun Apr 26 08:12:25.525747 2026] [:error] [pid 8390:tid 8456] [client 20.203.174.117:58429] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "ae1YaYGPtFK_i9p5yxQ3vQAAAIU"]
[Sun Apr 26 08:12:26.291859 2026] [:error] [pid 8390:tid 8474] [client 20.203.174.117:18421] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "ae1YaoGPtFK_i9p5yxQ3vwAAAJc"]
[Sun Apr 26 08:12:27.154014 2026] [:error] [pid 22573:tid 22628] [client 20.203.174.117:20452] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/nastar.php"] [unique_id "ae1Ya3B3EmQlD4yKUt8uxwAAAZU"]
[Sun Apr 26 08:12:28.978814 2026] [:error] [pid 8390:tid 8468] [client 20.203.174.117:64289] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/nastar.php"] [unique_id "ae1YbIGPtFK_i9p5yxQ3wwAAAJE"]
[Sun Apr 26 08:12:29.708341 2026] [:error] [pid 16515:tid 16531] [client 20.203.174.117:18423] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/nastar.php"] [unique_id "ae1YbVtDrUmgHSvpuLzR7gAAAk0"]
[Sun Apr 26 08:12:30.991887 2026] [:error] [pid 8491:tid 8520] [client 20.203.174.117:7937] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/nastar.php"] [unique_id "ae1Ybiq7I7e6CJooQM2vsgAAANU"]
[Sun Apr 26 08:12:31.881994 2026] [:error] [pid 8390:tid 8463] [client 20.203.174.117:59977] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "ae1Yb4GPtFK_i9p5yxQ3xwAAAIw"]
[Sun Apr 26 08:12:32.931577 2026] [:error] [pid 8390:tid 8456] [client 20.203.174.117:59976] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "ae1YcIGPtFK_i9p5yxQ3ygAAAIU"]
[Sun Apr 26 08:12:35.347980 2026] [:error] [pid 13137:tid 13144] [client 20.203.174.117:60001] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "ae1Yc90RB4J0o4h5neHslAAAAgQ"]
[Sun Apr 26 08:12:36.348059 2026] [:error] [pid 8383:tid 8400] [client 20.203.174.117:18395] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35_S.php"] [unique_id "ae1YdNFa2S3EsATMdWPSNwAAAAM"]
[Sun Apr 26 08:12:37.843873 2026] [:error] [pid 13137:tid 13160] [client 20.203.174.117:18424] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "ae1Ydd0RB4J0o4h5neHsmQAAAhM"]
[Sun Apr 26 08:12:39.406313 2026] [:error] [pid 13137:tid 13154] [client 20.203.174.117:20436] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "ae1Yd90RB4J0o4h5neHsnQAAAg0"]
[Sun Apr 26 08:12:40.845091 2026] [:error] [pid 16515:tid 16518] [client 20.203.174.117:14593] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "ae1YeFtDrUmgHSvpuLzR8AAAAkA"]
[Sun Apr 26 08:12:42.722676 2026] [:error] [pid 8390:tid 8469] [client 20.203.174.117:60006] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "ae1YeoGPtFK_i9p5yxQ31wAAAJI"]
[Sun Apr 26 08:12:43.921043 2026] [:error] [pid 22572:tid 22586] [client 20.203.174.117:14616] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "ae1Ye9XOViWCFU-pZzB9-wAAAUg"]
[Sun Apr 26 08:12:45.361309 2026] [:error] [pid 8390:tid 8458] [client 20.203.174.117:18828] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "ae1YfYGPtFK_i9p5yxQ32gAAAIc"]
[Sun Apr 26 08:12:46.815879 2026] [:error] [pid 8390:tid 8457] [client 20.203.174.117:42241] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "ae1YfoGPtFK_i9p5yxQ33wAAAIY"]
[Sun Apr 26 08:12:48.723546 2026] [:error] [pid 8390:tid 8470] [client 20.203.174.117:42296] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/111.php"] [unique_id "ae1YgIGPtFK_i9p5yxQ35AAAAJM"]
[Sun Apr 26 08:12:50.149709 2026] [:error] [pid 8390:tid 8471] [client 20.203.174.117:58393] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp1.php"] [unique_id "ae1YgoGPtFK_i9p5yxQ36AAAAJQ"]
[Sun Apr 26 08:12:51.351981 2026] [:error] [pid 22573:tid 22617] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Sun Apr 26 08:12:51.591762 2026] [:error] [pid 22573:tid 22623] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Sun Apr 26 08:12:51.871907 2026] [:error] [pid 22573:tid 22611] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Sun Apr 26 08:12:52.409699 2026] [:error] [pid 22573:tid 22619] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Sun Apr 26 08:12:52.817322 2026] [:error] [pid 22573:tid 22607] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Sun Apr 26 08:12:53.121559 2026] [:error] [pid 22573:tid 22608] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Apr 26 08:12:53.439111 2026] [:error] [pid 22573:tid 22629] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Sun Apr 26 08:12:53.712486 2026] [:error] [pid 22573:tid 22621] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/fine.php
[Sun Apr 26 08:12:54.004480 2026] [:error] [pid 22573:tid 22609] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Sun Apr 26 08:12:54.245916 2026] [:error] [pid 22573:tid 22622] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Sun Apr 26 08:12:54.510815 2026] [:error] [pid 22573:tid 22606] [client 20.203.174.117:58381] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 26 08:12:55.991189 2026] [:error] [pid 22573:tid 22606] [client 20.203.174.117:58381] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "ae1Yh3B3EmQlD4yKUt8u6AAAAYA"]
[Sun Apr 26 08:12:56.617662 2026] [:error] [pid 22573:tid 22623] [client 20.203.174.117:18858] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "ae1YiHB3EmQlD4yKUt8u6gAAAZA"]
[Sun Apr 26 08:12:58.557104 2026] [:error] [pid 8390:tid 8467] [client 20.203.174.117:59974] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "ae1YioGPtFK_i9p5yxQ4KwAAAJA"]
[Sun Apr 26 08:12:59.582401 2026] [:error] [pid 8390:tid 8457] [client 20.203.174.117:62979] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "ae1Yi4GPtFK_i9p5yxQ4LAAAAIY"]
[Sun Apr 26 08:13:02.962519 2026] [:error] [pid 8390:tid 8454] [client 20.203.174.117:43579] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "ae1YjoGPtFK_i9p5yxQ4MwAAAIM"]
[Sun Apr 26 08:13:03.957369 2026] [:error] [pid 8390:tid 8451] [client 20.203.174.117:58424] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "ae1Yj4GPtFK_i9p5yxQ4OAAAAIA"]
[Sun Apr 26 08:13:04.874078 2026] [:error] [pid 13137:tid 13160] [client 20.203.174.117:42254] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "ae1YkN0RB4J0o4h5neHssgAAAhM"]
[Sun Apr 26 08:13:07.057256 2026] [:error] [pid 22573:tid 22619] [client 20.203.174.117:20427] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fe5.php"] [unique_id "ae1Yk3B3EmQlD4yKUt8u9gAAAYw"]
[Sun Apr 26 08:13:08.097775 2026] [:error] [pid 13137:tid 13146] [client 20.203.174.117:18391] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "ae1YlN0RB4J0o4h5neHstAAAAgY"]
[Sun Apr 26 08:13:11.786613 2026] [:error] [pid 22572:tid 22591] [client 20.203.174.117:58385] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "ae1Yl9XOViWCFU-pZzB-BQAAAU0"]
[Sun Apr 26 08:13:14.150022 2026] [:error] [pid 22572:tid 22587] [client 20.203.174.117:56192] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "ae1YmtXOViWCFU-pZzB-BwAAAUk"]
[Sun Apr 26 08:13:16.910076 2026] [:error] [pid 8385:tid 8440] [client 20.203.174.117:56229] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "ae1YnDOy7_J84Wx3-ox3mgAAAFA"]
[Sun Apr 26 08:13:19.010144 2026] [:error] [pid 22572:tid 22597] [client 20.203.174.117:45446] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "ae1Yn9XOViWCFU-pZzB-CgAAAVM"]
[Sun Apr 26 08:13:20.225625 2026] [:error] [pid 16574:tid 16610] [client 20.203.174.117:56218] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "ae1YoH5MsX8wRQr99nYAwQAAA0Y"]
[Sun Apr 26 08:13:24.853089 2026] [:error] [pid 8390:tid 8458] [client 20.203.174.117:18818] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "ae1YpIGPtFK_i9p5yxQ4awAAAIc"]
[Sun Apr 26 08:13:25.969756 2026] [:error] [pid 22573:tid 22611] [client 20.203.174.117:42074] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "ae1YpXB3EmQlD4yKUt8vAQAAAYU"]
[Sun Apr 26 08:13:26.610580 2026] [:error] [pid 13197:tid 13256] [client 20.203.174.117:3721] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "ae1Ypt3kktFKdSxTrBuX5wAAAtg"]
[Sun Apr 26 08:13:27.677642 2026] [:error] [pid 13137:tid 13161] [client 20.203.174.117:56231] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "ae1Yp90RB4J0o4h5neHsugAAAhQ"]
[Sun Apr 26 08:13:28.898878 2026] [:error] [pid 16515:tid 16531] [client 20.203.174.117:59968] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "ae1YqFtDrUmgHSvpuLzSEAAAAk0"]
[Sun Apr 26 08:13:31.054846 2026] [:error] [pid 16515:tid 16535] [client 20.203.174.117:20458] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "ae1Yq1tDrUmgHSvpuLzSEgAAAlE"]
[Sun Apr 26 08:13:32.673077 2026] [:error] [pid 8385:tid 8446] [client 20.203.174.117:45052] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "ae1YrDOy7_J84Wx3-ox3pAAAAFY"]
[Sun Apr 26 08:13:34.118574 2026] [:error] [pid 13137:tid 13144] [client 20.203.174.117:3770] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "ae1Yrt0RB4J0o4h5neHsvwAAAgQ"]
[Sun Apr 26 08:13:35.467814 2026] [:error] [pid 22573:tid 22623] [client 20.203.174.117:39715] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "ae1Yr3B3EmQlD4yKUt8vEAAAAZA"]
[Sun Apr 26 08:13:39.344530 2026] [:error] [pid 13137:tid 13161] [client 20.203.174.117:18829] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "ae1Ys90RB4J0o4h5neHsyAAAAhQ"]
[Sun Apr 26 08:13:44.899322 2026] [:error] [pid 13137:tid 13143] [client 20.203.174.117:17617] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "ae1YuN0RB4J0o4h5neHszQAAAgM"]
[Sun Apr 26 08:13:46.033327 2026] [:error] [pid 16515:tid 16532] [client 20.203.174.117:17631] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "ae1YultDrUmgHSvpuLzSIQAAAk4"]
[Sun Apr 26 08:13:46.919893 2026] [:error] [pid 8383:tid 8401] [client 20.203.174.117:54873] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "ae1YutFa2S3EsATMdWPSPgAAAAQ"]
[Sun Apr 26 08:13:48.028145 2026] [:error] [pid 22573:tid 22625] [client 20.203.174.117:58382] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a2.php"] [unique_id "ae1YvHB3EmQlD4yKUt8vLwAAAZI"]
[Sun Apr 26 08:13:49.231523 2026] [:error] [pid 16515:tid 16519] [client 20.203.174.117:39694] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ae1YvVtDrUmgHSvpuLzSIgAAAkE"]
[Sun Apr 26 08:13:50.074066 2026] [:error] [pid 8385:tid 8448] [client 20.203.174.117:39727] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ae1YvjOy7_J84Wx3-ox3qgAAAFg"]
[Sun Apr 26 08:13:51.280005 2026] [:error] [pid 16574:tid 16616] [client 20.203.174.117:45477] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ae1Yv35MsX8wRQr99nYA0QAAA0s"]
[Sun Apr 26 08:13:52.052487 2026] [:error] [pid 22573:tid 22608] [client 20.203.174.117:39690] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ae1YwHB3EmQlD4yKUt8vMwAAAYI"]
[Sun Apr 26 08:13:52.962306 2026] [:error] [pid 22572:tid 22596] [client 20.203.174.117:3581] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "ae1YwNXOViWCFU-pZzB-EgAAAVI"]
[Sun Apr 26 08:13:53.773279 2026] [:error] [pid 22572:tid 22583] [client 20.203.174.117:3525] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "ae1YwdXOViWCFU-pZzB-FwAAAUU"]
[Sun Apr 26 08:13:54.732608 2026] [:error] [pid 22572:tid 22602] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Apr 26 08:13:55.221504 2026] [:error] [pid 22572:tid 22592] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Sun Apr 26 08:13:55.462488 2026] [:error] [pid 22572:tid 22598] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Sun Apr 26 08:13:55.702905 2026] [:error] [pid 22572:tid 22581] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Sun Apr 26 08:13:55.952627 2026] [:error] [pid 22572:tid 22585] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sun Apr 26 08:13:56.235587 2026] [:error] [pid 22572:tid 22595] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Apr 26 08:13:56.476617 2026] [:error] [pid 22572:tid 22600] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Apr 26 08:13:56.732543 2026] [:error] [pid 22572:tid 22588] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Apr 26 08:13:57.233741 2026] [:error] [pid 22572:tid 22580] [client 20.203.174.117:20422] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sun Apr 26 08:13:57.489017 2026] [:error] [pid 22572:tid 22596] [client 20.203.174.117:20422] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "ae1YxdXOViWCFU-pZzB-KAAAAVI"]
[Sun Apr 26 08:13:58.389098 2026] [:error] [pid 16574:tid 16623] [client 20.203.174.117:42291] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "ae1Yxn5MsX8wRQr99nYA1wAAA04"]
[Sun Apr 26 08:13:59.366514 2026] [:error] [pid 16515:tid 16527] [client 20.203.174.117:42289] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "ae1Yx1tDrUmgHSvpuLzSJgAAAkk"]
[Sun Apr 26 08:14:00.168717 2026] [:error] [pid 8383:tid 8399] [client 20.203.174.117:60031] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "ae1YyNFa2S3EsATMdWPSQgAAAAI"]
[Sun Apr 26 08:14:00.979451 2026] [:error] [pid 8385:tid 8427] [client 20.203.174.117:3523] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae1YyDOy7_J84Wx3-ox3rAAAAEM"]
[Sun Apr 26 08:14:01.800390 2026] [:error] [pid 8390:tid 8457] [client 20.203.174.117:65166] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae1YyYGPtFK_i9p5yxQ4nAAAAIY"]
[Sun Apr 26 08:14:02.575699 2026] [:error] [pid 8390:tid 8459] [client 20.203.174.117:58373] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae1YyoGPtFK_i9p5yxQ4nwAAAIg"]
[Sun Apr 26 08:14:03.517109 2026] [:error] [pid 8491:tid 8507] [client 20.203.174.117:15034] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae1Yyyq7I7e6CJooQM2v2QAAAMg"]
[Sun Apr 26 08:14:04.553630 2026] [:error] [pid 8385:tid 8444] [client 20.203.174.117:48206] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ae1YzDOy7_J84Wx3-ox3rgAAAFQ"]
[Sun Apr 26 08:14:05.980987 2026] [:error] [pid 8491:tid 8512] [client 20.203.174.117:45480] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ae1YzSq7I7e6CJooQM2v3gAAAM0"]
[Sun Apr 26 08:14:06.655172 2026] [:error] [pid 8383:tid 8400] [client 20.203.174.117:65167] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ae1YztFa2S3EsATMdWPSRgAAAAM"]
[Sun Apr 26 08:14:07.431112 2026] [:error] [pid 13137:tid 13145] [client 20.203.174.117:59983] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ae1Yz90RB4J0o4h5neHs1wAAAgU"]
[Sun Apr 26 08:14:08.061566 2026] [:error] [pid 8385:tid 8445] [client 20.203.174.117:45501] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ae1Y0DOy7_J84Wx3-ox3sAAAAFU"]
[Sun Apr 26 08:14:08.770462 2026] [:error] [pid 8383:tid 8402] [client 20.203.174.117:15004] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ae1Y0NFa2S3EsATMdWPSSAAAAAU"]
[Sun Apr 26 08:14:09.517870 2026] [:error] [pid 8385:tid 8442] [client 20.203.174.117:60014] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ae1Y0TOy7_J84Wx3-ox3sgAAAFI"]
[Sun Apr 26 08:14:10.121344 2026] [:error] [pid 13197:tid 13231] [client 20.203.174.117:48215] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ae1Y0t3kktFKdSxTrBuX-wAAAsA"]
[Sun Apr 26 08:14:10.694872 2026] [:error] [pid 13137:tid 13159] [client 20.203.174.117:20477] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "ae1Y0t0RB4J0o4h5neHs2AAAAhI"]
[Sun Apr 26 08:14:11.436350 2026] [:error] [pid 8491:tid 8500] [client 20.203.174.117:42260] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "ae1Y0yq7I7e6CJooQM2v5gAAAME"]
[Sun Apr 26 08:14:12.052742 2026] [:error] [pid 8390:tid 8465] [client 20.203.174.117:3540] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "ae1Y1IGPtFK_i9p5yxQ4rwAAAI4"]
[Sun Apr 26 08:14:12.762029 2026] [:error] [pid 8491:tid 8499] [client 20.203.174.117:14980] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "ae1Y1Cq7I7e6CJooQM2v6AAAAMA"]
[Sun Apr 26 08:14:13.329944 2026] [:error] [pid 13137:tid 13151] [client 20.203.174.117:3723] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ae1Y1d0RB4J0o4h5neHs2gAAAgo"]
[Sun Apr 26 08:14:13.936874 2026] [:error] [pid 13137:tid 13140] [client 20.203.174.117:54880] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ae1Y1d0RB4J0o4h5neHs2wAAAgA"]
[Sun Apr 26 08:14:14.583006 2026] [:error] [pid 8390:tid 8457] [client 20.203.174.117:17615] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ae1Y1oGPtFK_i9p5yxQ4sgAAAIY"]
[Sun Apr 26 08:14:15.224688 2026] [:error] [pid 13137:tid 13148] [client 20.203.174.117:59973] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ae1Y190RB4J0o4h5neHs3wAAAgg"]
[Sun Apr 26 08:14:15.938918 2026] [:error] [pid 13137:tid 13160] [client 20.203.174.117:20433] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "ae1Y190RB4J0o4h5neHs4AAAAhM"]
[Sun Apr 26 08:14:16.806043 2026] [:error] [pid 8390:tid 8461] [client 20.203.174.117:17602] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "ae1Y2IGPtFK_i9p5yxQ4tQAAAIo"]
[Sun Apr 26 08:14:17.328876 2026] [:error] [pid 8390:tid 8451] [client 20.203.174.117:3733] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "ae1Y2YGPtFK_i9p5yxQ4uAAAAIA"]
[Sun Apr 26 08:14:18.184438 2026] [:error] [pid 8390:tid 8458] [client 20.203.174.117:42266] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "ae1Y2oGPtFK_i9p5yxQ4vQAAAIc"]
[Sun Apr 26 08:14:19.390799 2026] [:error] [pid 8390:tid 8463] [client 20.203.174.117:3732] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ae1Y24GPtFK_i9p5yxQ4wgAAAIw"]
[Sun Apr 26 08:14:20.560114 2026] [:error] [pid 22572:tid 22597] [client 20.203.174.117:65201] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ae1Y3NXOViWCFU-pZzB-LwAAAVM"]
[Sun Apr 26 08:14:21.400189 2026] [:error] [pid 22572:tid 22602] [client 20.203.174.117:54908] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ae1Y3dXOViWCFU-pZzB-MQAAAVg"]
[Sun Apr 26 08:14:22.446089 2026] [:error] [pid 16515:tid 16526] [client 20.203.174.117:58377] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ae1Y3ltDrUmgHSvpuLzSLwAAAkg"]
[Sun Apr 26 08:14:23.246530 2026] [:error] [pid 13137:tid 13153] [client 20.203.174.117:3749] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "ae1Y390RB4J0o4h5neHs4gAAAgw"]
[Sun Apr 26 08:14:24.686956 2026] [:error] [pid 8390:tid 8459] [client 20.203.174.117:3524] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "ae1Y4IGPtFK_i9p5yxQ4yQAAAIg"]
[Sun Apr 26 08:14:25.986057 2026] [:error] [pid 8491:tid 8515] [client 20.203.174.117:3729] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "ae1Y4Sq7I7e6CJooQM2v8gAAANA"]
[Sun Apr 26 08:14:26.801290 2026] [:error] [pid 8491:tid 8516] [client 20.203.174.117:45451] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "ae1Y4iq7I7e6CJooQM2v8wAAANE"]
[Sun Apr 26 08:14:27.466365 2026] [:error] [pid 16574:tid 16609] [client 20.203.174.117:39683] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ae1Y435MsX8wRQr99nYA2wAAA0U"]
[Sun Apr 26 08:14:28.448725 2026] [:error] [pid 16574:tid 16625] [client 20.203.174.117:17605] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ae1Y5H5MsX8wRQr99nYA3AAAA08"]
[Sun Apr 26 08:14:29.445025 2026] [:error] [pid 13137:tid 13159] [client 20.203.174.117:20459] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ae1Y5d0RB4J0o4h5neHs7QAAAhI"]
[Sun Apr 26 08:14:30.696552 2026] [:error] [pid 8390:tid 8467] [client 20.203.174.117:48220] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "ae1Y5oGPtFK_i9p5yxQ4zAAAAJA"]
[Sun Apr 26 08:14:31.850856 2026] [:error] [pid 8385:tid 8441] [client 20.203.174.117:58402] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "ae1Y5zOy7_J84Wx3-ox3wAAAAFE"]
[Sun Apr 26 08:14:32.453870 2026] [:error] [pid 16515:tid 16531] [client 20.203.174.117:3534] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "ae1Y6FtDrUmgHSvpuLzSMgAAAk0"]
[Sun Apr 26 08:14:33.441111 2026] [:error] [pid 8390:tid 8474] [client 20.203.174.117:3760] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "ae1Y6YGPtFK_i9p5yxQ41QAAAJc"]
[Sun Apr 26 08:14:34.368457 2026] [:error] [pid 8390:tid 8472] [client 20.203.174.117:48231] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "ae1Y6oGPtFK_i9p5yxQ42wAAAJU"]
[Sun Apr 26 08:14:35.972969 2026] [:error] [pid 8491:tid 8505] [client 20.203.174.117:43563] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "ae1Y6yq7I7e6CJooQM2wGAAAAMY"]
[Sun Apr 26 08:14:37.530386 2026] [:error] [pid 13137:tid 13159] [client 20.203.174.117:39680] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "ae1Y7d0RB4J0o4h5neHtAQAAAhI"]
[Sun Apr 26 08:14:38.388432 2026] [:error] [pid 13137:tid 13165] [client 20.203.174.117:48237] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "ae1Y7t0RB4J0o4h5neHtCAAAAhg"]
[Sun Apr 26 08:14:39.968890 2026] [:error] [pid 22573:tid 22623] [client 20.203.174.117:14995] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/index.php"] [unique_id "ae1Y73B3EmQlD4yKUt8vagAAAZA"]
[Sun Apr 26 08:14:40.961892 2026] [:error] [pid 13137:tid 13143] [client 20.203.174.117:3759] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "ae1Y8N0RB4J0o4h5neHtHAAAAgM"]
[Sun Apr 26 08:14:42.365752 2026] [:error] [pid 22572:tid 22580] [client 20.203.174.117:56224] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "ae1Y8tXOViWCFU-pZzB-RgAAAUI"]
[Sun Apr 26 08:14:43.332914 2026] [:error] [pid 22572:tid 22597] [client 20.203.174.117:59991] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "ae1Y89XOViWCFU-pZzB-SgAAAVM"]
[Sun Apr 26 08:14:44.767850 2026] [:error] [pid 22573:tid 22622] [client 20.203.174.117:54903] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fff.php"] [unique_id "ae1Y9HB3EmQlD4yKUt8veAAAAY8"]
[Sun Apr 26 08:14:45.881052 2026] [:error] [pid 22572:tid 22585] [client 20.203.174.117:54861] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "ae1Y9dXOViWCFU-pZzB-UQAAAUc"]
[Sun Apr 26 08:14:47.441253 2026] [:error] [pid 16515:tid 16538] [client 20.203.174.117:43583] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "ae1Y91tDrUmgHSvpuLzSOQAAAlQ"]
[Sun Apr 26 08:14:48.238733 2026] [:error] [pid 8385:tid 8431] [client 20.203.174.117:14984] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "ae1Y-DOy7_J84Wx3-ox3yQAAAEc"]
[Sun Apr 26 08:14:49.247356 2026] [:error] [pid 8385:tid 8440] [client 20.203.174.117:3545] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "ae1Y-TOy7_J84Wx3-ox3zwAAAFA"]
[Sun Apr 26 08:14:50.580670 2026] [:error] [pid 16515:tid 16540] [client 20.203.174.117:14615] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "ae1Y-ltDrUmgHSvpuLzSQAAAAlY"]
[Sun Apr 26 08:14:52.331125 2026] [:error] [pid 13137:tid 13163] [client 20.203.174.117:15005] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "ae1Y_N0RB4J0o4h5neHtVAAAAhY"]
[Sun Apr 26 08:14:53.042483 2026] [:error] [pid 8385:tid 8443] [client 20.203.174.117:48252] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "ae1Y_TOy7_J84Wx3-ox31AAAAFM"]
[Sun Apr 26 08:14:54.194623 2026] [:error] [pid 22573:tid 22608] [client 20.203.174.117:7991] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we.php"] [unique_id "ae1Y_nB3EmQlD4yKUt8viQAAAYI"]
[Sun Apr 26 08:14:54.998979 2026] [:error] [pid 22573:tid 22619] [client 20.203.174.117:48195] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "ae1Y_nB3EmQlD4yKUt8vjwAAAYw"]
[Sun Apr 26 08:14:55.649188 2026] [:error] [pid 8390:tid 8456] [client 20.203.174.117:42100] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "ae1Y_4GPtFK_i9p5yxQ5BwAAAIU"]
[Sun Apr 26 08:14:56.313648 2026] [:error] [pid 8491:tid 8505] [client 20.203.174.117:17645] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "ae1ZACq7I7e6CJooQM2wXwAAAMY"]
[Sun Apr 26 08:14:56.838273 2026] [:error] [pid 22573:tid 22621] [client 20.203.174.117:42297] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "ae1ZAHB3EmQlD4yKUt8vmQAAAY4"]
[Sun Apr 26 08:14:57.467818 2026] [:error] [pid 22573:tid 22613] [client 20.203.174.117:3739] File does not exist: /usr/local/apache/htdocs/suspended-page/admin1.php
[Sun Apr 26 08:14:57.966773 2026] [:error] [pid 22573:tid 22628] [client 20.203.174.117:3739] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sun Apr 26 08:14:58.731767 2026] [:error] [pid 22573:tid 22622] [client 20.203.174.117:3739] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Apr 26 08:14:59.244362 2026] [:error] [pid 22573:tid 22606] [client 20.203.174.117:3739] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Sun Apr 26 08:14:59.803189 2026] [:error] [pid 22573:tid 22621] [client 20.203.174.117:3739] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Apr 26 08:15:00.046845 2026] [:error] [pid 22573:tid 22618] [client 20.203.174.117:3739] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Apr 26 08:15:00.284972 2026] [:error] [pid 22573:tid 22611] [client 20.203.174.117:3739] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "ae1ZBHB3EmQlD4yKUt8vrQAAAYU"]
[Sun Apr 26 08:15:00.853502 2026] [:error] [pid 16515:tid 16528] [client 20.203.174.117:20472] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "ae1ZBFtDrUmgHSvpuLzSSgAAAko"]
[Sun Apr 26 08:15:01.462434 2026] [:error] [pid 8390:tid 8458] [client 20.203.174.117:42084] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "ae1ZBYGPtFK_i9p5yxQ5OwAAAIc"]
[Sun Apr 26 08:15:02.112712 2026] [:error] [pid 8390:tid 8469] [client 20.203.174.117:45448] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "ae1ZBoGPtFK_i9p5yxQ5RgAAAJI"]
[Sun Apr 26 08:15:02.854214 2026] [:error] [pid 8390:tid 8464] [client 20.203.174.117:58391] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "ae1ZBoGPtFK_i9p5yxQ5UQAAAI0"]
[Sun Apr 26 08:15:03.749768 2026] [:error] [pid 8390:tid 8465] [client 20.203.174.117:59994] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "ae1ZB4GPtFK_i9p5yxQ5WAAAAI4"]
[Sun Apr 26 08:15:04.467027 2026] [:error] [pid 8390:tid 8459] [client 20.203.174.117:54887] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "ae1ZCIGPtFK_i9p5yxQ5XAAAAIg"]
[Sun Apr 26 08:15:05.027230 2026] [:error] [pid 8390:tid 8466] [client 20.203.174.117:45456] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "ae1ZCYGPtFK_i9p5yxQ5XgAAAI8"]
[Sun Apr 26 08:15:05.683003 2026] [:error] [pid 8491:tid 8507] [client 20.203.174.117:14651] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "ae1ZCSq7I7e6CJooQM2wZQAAAMg"]
[Sun Apr 26 08:15:06.923644 2026] [:error] [pid 13197:tid 13250] [client 20.203.174.117:65163] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "ae1ZCt3kktFKdSxTrBuYBAAAAtI"]
[Sun Apr 26 08:15:08.059200 2026] [:error] [pid 16515:tid 16535] [client 20.203.174.117:65192] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "ae1ZDFtDrUmgHSvpuLzSUQAAAlE"]
[Sun Apr 26 08:15:09.075965 2026] [:error] [pid 22573:tid 22617] [client 20.203.174.117:21901] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "ae1ZDXB3EmQlD4yKUt8vuAAAAYo"]
[Sun Apr 26 08:15:10.010466 2026] [:error] [pid 22572:tid 22598] [client 20.203.174.117:48194] [client 20.203.174.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ae1ZDtXOViWCFU-pZzB-swAAAVQ"]
[Sun Apr 26 08:15:10.810747 2026] [:error] [pid 13197:tid 13231] [client 20.203.174.117:42302] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "ae1ZDt3kktFKdSxTrBuYCQAAAsA"]
[Sun Apr 26 08:15:11.736136 2026] [:error] [pid 22572:tid 22583] [client 20.203.174.117:3746] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "ae1ZD9XOViWCFU-pZzB-vwAAAUU"]
[Sun Apr 26 08:15:12.383223 2026] [:error] [pid 22572:tid 22585] [client 20.203.174.117:54854] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "ae1ZENXOViWCFU-pZzB-xQAAAUc"]
[Sun Apr 26 08:15:13.448323 2026] [:error] [pid 8390:tid 8464] [client 20.203.174.117:42270] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "ae1ZEYGPtFK_i9p5yxQ5fwAAAI0"]
[Sun Apr 26 08:15:14.261832 2026] [:error] [pid 22573:tid 22607] [client 20.203.174.117:3564] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ae1ZEnB3EmQlD4yKUt8vvQAAAYE"]
[Sun Apr 26 08:15:15.130585 2026] [:error] [pid 16515:tid 16525] [client 20.203.174.117:17616] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ae1ZE1tDrUmgHSvpuLzSYAAAAkc"]
[Sun Apr 26 08:15:15.879924 2026] [:error] [pid 16515:tid 16540] [client 20.203.174.117:54852] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ae1ZE1tDrUmgHSvpuLzSZAAAAlY"]
[Sun Apr 26 08:15:16.482088 2026] [:error] [pid 8390:tid 8452] [client 20.203.174.117:60022] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ae1ZFIGPtFK_i9p5yxQ5lwAAAIE"]
[Sun Apr 26 08:15:17.181024 2026] [:error] [pid 8390:tid 8458] [client 20.203.174.117:65157] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1ZFYGPtFK_i9p5yxQ5ngAAAIc"]
[Sun Apr 26 08:15:17.797628 2026] [:error] [pid 22572:tid 22600] [client 20.203.174.117:42255] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1ZFdXOViWCFU-pZzB-3AAAAVY"]
[Sun Apr 26 08:15:18.560799 2026] [:error] [pid 8390:tid 8453] [client 20.203.174.117:59971] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1ZFoGPtFK_i9p5yxQ5sgAAAII"]
[Sun Apr 26 08:15:19.508953 2026] [:error] [pid 22572:tid 22582] [client 20.203.174.117:42264] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1ZF9XOViWCFU-pZzB-4QAAAUQ"]
[Sun Apr 26 08:15:20.380721 2026] [:error] [pid 8390:tid 8452] [client 20.203.174.117:14999] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "ae1ZGIGPtFK_i9p5yxQ5xQAAAIE"]
[Sun Apr 26 08:15:20.943454 2026] [:error] [pid 22573:tid 22631] [client 20.203.174.117:17638] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "ae1ZGHB3EmQlD4yKUt8vwwAAAZg"]
[Sun Apr 26 08:15:21.558751 2026] [:error] [pid 22573:tid 22613] [client 20.203.174.117:17657] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "ae1ZGXB3EmQlD4yKUt8vygAAAYc"]
[Sun Apr 26 08:15:22.086591 2026] [:error] [pid 16515:tid 16542] [client 20.203.174.117:42242] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "ae1ZGltDrUmgHSvpuLzSbQAAAlg"]
[Sun Apr 26 08:15:22.674511 2026] [:error] [pid 22572:tid 22584] [client 20.203.174.117:17603] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dev.php"] [unique_id "ae1ZGtXOViWCFU-pZzB-6QAAAUY"]
[Sun Apr 26 08:15:23.229372 2026] [:error] [pid 13197:tid 13241] [client 20.203.174.117:17641] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dev.php"] [unique_id "ae1ZG93kktFKdSxTrBuYDgAAAso"]
[Sun Apr 26 08:15:24.231413 2026] [:error] [pid 8385:tid 8434] [client 20.203.174.117:14978] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dev.php"] [unique_id "ae1ZHDOy7_J84Wx3-ox3_QAAAEo"]
[Sun Apr 26 08:15:24.999145 2026] [:error] [pid 8390:tid 8466] [client 20.203.174.117:54874] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dev.php"] [unique_id "ae1ZHIGPtFK_i9p5yxQ53QAAAI8"]
[Sun Apr 26 08:15:25.611372 2026] [:error] [pid 22572:tid 22593] [client 20.203.174.117:48205] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ae1ZHdXOViWCFU-pZzB-8AAAAU8"]
[Sun Apr 26 08:15:26.335478 2026] [:error] [pid 13137:tid 13159] [client 20.203.174.117:20416] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ae1ZHt0RB4J0o4h5neHtnAAAAhI"]
[Sun Apr 26 08:15:26.893126 2026] [:error] [pid 13137:tid 13157] [client 20.203.174.117:3559] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ae1ZHt0RB4J0o4h5neHtoAAAAhA"]
[Sun Apr 26 08:15:27.565998 2026] [:error] [pid 8385:tid 8444] [client 20.203.174.117:48192] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ae1ZHzOy7_J84Wx3-ox4AgAAAFQ"]
[Sun Apr 26 08:15:28.187553 2026] [:error] [pid 22573:tid 22615] [client 20.203.174.117:63014] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "ae1ZIHB3EmQlD4yKUt8v3AAAAYg"]
[Sun Apr 26 08:15:28.895760 2026] [:error] [pid 13137:tid 13164] [client 20.203.174.117:54907] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "ae1ZIN0RB4J0o4h5neHtpQAAAhc"]
[Sun Apr 26 08:15:29.504645 2026] [:error] [pid 8390:tid 8456] [client 20.203.174.117:20479] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "ae1ZIYGPtFK_i9p5yxQ5-AAAAIU"]
[Sun Apr 26 08:15:30.131495 2026] [:error] [pid 22573:tid 22621] [client 20.203.174.117:42246] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "ae1ZInB3EmQlD4yKUt8v4wAAAY4"]
[Sun Apr 26 08:15:30.680698 2026] [:error] [pid 22573:tid 22619] [client 20.203.174.117:15033] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "ae1ZInB3EmQlD4yKUt8v5wAAAYw"]
[Sun Apr 26 08:15:31.348491 2026] [:error] [pid 8385:tid 8430] [client 20.203.174.117:45444] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "ae1ZIzOy7_J84Wx3-ox4CQAAAEY"]
[Sun Apr 26 08:15:32.369309 2026] [:error] [pid 8385:tid 8435] [client 20.203.174.117:59979] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "ae1ZJDOy7_J84Wx3-ox4CwAAAEs"]
[Sun Apr 26 08:15:33.345332 2026] [:error] [pid 8390:tid 8461] [client 20.203.174.117:65177] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "ae1ZJYGPtFK_i9p5yxQ6EQAAAIo"]
[Sun Apr 26 08:15:34.550137 2026] [:error] [pid 22573:tid 22629] [client 20.203.174.117:45041] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ae1ZJnB3EmQlD4yKUt8v7AAAAZY"]
[Sun Apr 26 08:15:35.224784 2026] [:error] [pid 16515:tid 16527] [client 20.203.174.117:17642] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ae1ZJ1tDrUmgHSvpuLzSfwAAAkk"]
[Sun Apr 26 08:15:35.969469 2026] [:error] [pid 22573:tid 22624] [client 20.203.174.117:65154] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ae1ZJ3B3EmQlD4yKUt8v8QAAAZE"]
[Sun Apr 26 08:15:36.637893 2026] [:error] [pid 8491:tid 8511] [client 20.203.174.117:3782] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ae1ZKCq7I7e6CJooQM2wqgAAAMw"]
[Sun Apr 26 08:15:37.282671 2026] [:error] [pid 8390:tid 8467] [client 20.203.174.117:48234] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "ae1ZKYGPtFK_i9p5yxQ6JgAAAJA"]
[Sun Apr 26 08:15:37.895447 2026] [:error] [pid 22572:tid 22581] [client 20.203.174.117:59969] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "ae1ZKdXOViWCFU-pZzB_AwAAAUM"]
[Sun Apr 26 08:15:38.451351 2026] [:error] [pid 22573:tid 22623] [client 20.203.174.117:42268] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "ae1ZKnB3EmQlD4yKUt8v-gAAAZA"]
[Sun Apr 26 08:15:39.109639 2026] [:error] [pid 8383:tid 8414] [client 20.203.174.117:3556] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "ae1ZK9Fa2S3EsATMdWPSVgAAABE"]
[Sun Apr 26 08:15:39.946605 2026] [:error] [pid 8491:tid 8501] [client 20.203.174.117:3755] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1ZKyq7I7e6CJooQM2wrAAAAMI"]
[Sun Apr 26 08:15:41.429173 2026] [:error] [pid 16515:tid 16528] [client 20.203.174.117:3789] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1ZLVtDrUmgHSvpuLzShQAAAko"]
[Sun Apr 26 08:15:42.272758 2026] [:error] [pid 13137:tid 13160] [client 20.203.174.117:20463] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1ZLt0RB4J0o4h5neHtyAAAAhM"]
[Sun Apr 26 08:15:42.887715 2026] [:error] [pid 22572:tid 22602] [client 20.203.174.117:3757] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1ZLtXOViWCFU-pZzB_CwAAAVg"]
[Sun Apr 26 08:15:43.613121 2026] [:error] [pid 8385:tid 8426] [client 20.203.174.117:45490] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "ae1ZLzOy7_J84Wx3-ox4HwAAAEI"]
[Sun Apr 26 08:15:44.354825 2026] [:error] [pid 16515:tid 16542] [client 20.203.174.117:3807] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "ae1ZMFtDrUmgHSvpuLzSiwAAAlg"]
[Sun Apr 26 08:15:47.042468 2026] [:error] [pid 8385:tid 8439] [client 20.203.174.117:54882] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "ae1ZMzOy7_J84Wx3-ox4JAAAAE8"]
[Sun Apr 26 08:15:47.679360 2026] [:error] [pid 16515:tid 16530] [client 20.203.174.117:39736] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "ae1ZM1tDrUmgHSvpuLzSlAAAAkw"]
[Sun Apr 26 08:15:48.300873 2026] [:error] [pid 13197:tid 13240] [client 20.203.174.117:65191] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "ae1ZNN3kktFKdSxTrBuYHwAAAsk"]
[Sun Apr 26 08:15:49.116736 2026] [:error] [pid 13197:tid 13233] [client 20.203.174.117:42280] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "ae1ZNd3kktFKdSxTrBuYIQAAAsI"]
[Sun Apr 26 08:15:49.938050 2026] [:error] [pid 22572:tid 22598] [client 20.203.174.117:17627] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "ae1ZNdXOViWCFU-pZzB_EQAAAVQ"]
[Sun Apr 26 08:15:51.048073 2026] [:error] [pid 8390:tid 8455] [client 20.203.174.117:39732] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfashell.php"] [unique_id "ae1ZN4GPtFK_i9p5yxQ6RAAAAIQ"]
[Sun Apr 26 08:15:52.020554 2026] [:error] [pid 13197:tid 13234] [client 20.203.174.117:63021] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ae1ZON3kktFKdSxTrBuYIwAAAsM"]
[Sun Apr 26 08:15:52.684062 2026] [:error] [pid 22572:tid 22578] [client 20.203.174.117:65170] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ae1ZONXOViWCFU-pZzB_GwAAAUA"]
[Sun Apr 26 08:15:53.504476 2026] [:error] [pid 8390:tid 8455] [client 20.203.174.117:20420] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ae1ZOYGPtFK_i9p5yxQ6UwAAAIQ"]
[Sun Apr 26 08:15:54.195528 2026] [:error] [pid 8390:tid 8467] [client 20.203.174.117:59982] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ae1ZOoGPtFK_i9p5yxQ6WAAAAJA"]
[Sun Apr 26 08:15:54.775161 2026] [:error] [pid 22573:tid 22624] [client 20.203.174.117:20453] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "ae1ZOnB3EmQlD4yKUt8wBgAAAZE"]
[Sun Apr 26 08:15:55.434346 2026] [:error] [pid 22573:tid 22627] [client 20.203.174.117:48248] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "ae1ZO3B3EmQlD4yKUt8wCwAAAZQ"]
[Sun Apr 26 08:15:56.034398 2026] [:error] [pid 8390:tid 8463] [client 20.203.174.117:60018] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "ae1ZPIGPtFK_i9p5yxQ6XgAAAIw"]
[Sun Apr 26 08:15:56.796128 2026] [:error] [pid 8390:tid 8460] [client 20.203.174.117:39686] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "ae1ZPIGPtFK_i9p5yxQ6YQAAAIk"]
[Sun Apr 26 08:15:57.344557 2026] [:error] [pid 22573:tid 22624] [client 20.203.174.117:3571] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "ae1ZPXB3EmQlD4yKUt8wFAAAAZE"]
[Sun Apr 26 08:15:57.927293 2026] [:error] [pid 22573:tid 22628] [client 20.203.174.117:54895] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "ae1ZPXB3EmQlD4yKUt8wGQAAAZU"]
[Sun Apr 26 08:15:58.684497 2026] [:error] [pid 8385:tid 8424] [client 20.203.174.117:15032] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "ae1ZPjOy7_J84Wx3-ox4OAAAAEA"]
[Sun Apr 26 08:15:59.300174 2026] [:error] [pid 8390:tid 8457] [client 20.203.174.117:3530] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "ae1ZP4GPtFK_i9p5yxQ6ZgAAAIY"]
[Sun Apr 26 08:15:59.827583 2026] [:error] [pid 8385:tid 8444] [client 20.203.174.117:3815] [client 20.203.174.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/g.php"] [unique_id "ae1ZPzOy7_J84Wx3-ox4OgAAAFQ"]
[Sun Apr 26 08:16:00.367503 2026] [:error] [pid 8390:tid 8455] [client 20.203.174.117:54881] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Apr 26 08:16:00.877120 2026] [:error] [pid 8390:tid 8451] [client 20.203.174.117:54881] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Apr 26 08:16:01.117181 2026] [:error] [pid 8390:tid 8454] [client 20.203.174.117:54881] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Sun Apr 26 08:16:01.370849 2026] [:error] [pid 8390:tid 8464] [client 20.203.174.117:54881] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Sun Apr 26 08:16:01.641532 2026] [:error] [pid 8390:tid 8471] [client 20.203.174.117:54881] File does not exist: /usr/local/apache/htdocs/suspended-page/hypo.php
[Sun Apr 26 08:16:01.881196 2026] [:error] [pid 8390:tid 8474] [client 20.203.174.117:54881] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Sun Apr 26 08:16:02.120552 2026] [:error] [pid 8390:tid 8467] [client 20.203.174.117:54881] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sun Apr 26 08:16:02.623858 2026] [:error] [pid 8390:tid 8457] [client 20.203.174.117:54881] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Apr 26 09:31:49.400894 2026] [:error] [pid 8390:tid 8461] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/file0.php
[Sun Apr 26 09:31:49.659496 2026] [:error] [pid 8390:tid 8464] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/geforce.php
[Sun Apr 26 09:31:49.917742 2026] [:error] [pid 8390:tid 8467] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/t3s.php
[Sun Apr 26 09:31:50.183840 2026] [:error] [pid 8390:tid 8465] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/uwu.php
[Sun Apr 26 09:31:50.456355 2026] [:error] [pid 8390:tid 8470] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/uwa.php
[Sun Apr 26 09:31:50.724579 2026] [:error] [pid 8390:tid 8472] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/crgio.php
[Sun Apr 26 09:31:50.985509 2026] [:error] [pid 8390:tid 8469] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Apr 26 09:31:51.244967 2026] [:error] [pid 8390:tid 8462] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Sun Apr 26 09:31:51.503462 2026] [:error] [pid 8390:tid 8471] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Sun Apr 26 09:31:51.761447 2026] [:error] [pid 8390:tid 8461] [client 74.248.33.118:25276] File does not exist: /usr/local/apache/htdocs/suspended-page/.sghb.php
[Sun Apr 26 09:31:52.024964 2026] [:error] [pid 8390:tid 8454] [client 74.248.33.118:25276] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoko.php"] [unique_id "ae1rCIGPtFK_i9p5yxRhPgAAAIM"]
[Sun Apr 26 09:31:53.604730 2026] [:error] [pid 13137:tid 13155] [client 74.248.33.118:25232] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoko.php"] [unique_id "ae1rCd0RB4J0o4h5neEB0wAAAg4"]
[Sun Apr 26 09:31:55.538288 2026] [:error] [pid 16515:tid 16533] [client 74.248.33.118:59482] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoko.php"] [unique_id "ae1rC1tDrUmgHSvpuLzhcQAAAk8"]
[Sun Apr 26 09:31:57.744671 2026] [:error] [pid 13197:tid 13251] [client 74.248.33.118:33172] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoko.php"] [unique_id "ae1rDd3kktFKdSxTrBugtAAAAtM"]
[Sun Apr 26 09:31:59.103131 2026] [:error] [pid 8383:tid 8399] [client 74.248.33.118:10274] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/solo1.php"] [unique_id "ae1rD9Fa2S3EsATMdWPZtQAAAAI"]
[Sun Apr 26 09:31:59.836062 2026] [:error] [pid 22572:tid 22585] [client 74.248.33.118:10252] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/solo1.php"] [unique_id "ae1rD9XOViWCFU-pZzCVRgAAAUc"]
[Sun Apr 26 09:32:00.695416 2026] [:error] [pid 8491:tid 8519] [client 74.248.33.118:2190] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/solo1.php"] [unique_id "ae1rECq7I7e6CJooQM27GAAAANQ"]
[Sun Apr 26 09:32:01.739578 2026] [:error] [pid 22573:tid 22609] [client 74.248.33.118:2524] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/solo1.php"] [unique_id "ae1rEXB3EmQlD4yKUt9J8QAAAYM"]
[Sun Apr 26 09:32:02.472561 2026] [:error] [pid 16515:tid 16526] [client 74.248.33.118:28635] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/locales.php"] [unique_id "ae1rEltDrUmgHSvpuLzhdgAAAkg"]
[Sun Apr 26 09:32:03.482007 2026] [:error] [pid 8390:tid 8473] [client 74.248.33.118:2516] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/locales.php"] [unique_id "ae1rE4GPtFK_i9p5yxRhYQAAAJY"]
[Sun Apr 26 09:32:04.382162 2026] [:error] [pid 8390:tid 8459] [client 74.248.33.118:33196] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/locales.php"] [unique_id "ae1rFIGPtFK_i9p5yxRhZwAAAIg"]
[Sun Apr 26 09:32:05.083315 2026] [:error] [pid 22573:tid 22617] [client 74.248.33.118:2216] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/locales.php"] [unique_id "ae1rFXB3EmQlD4yKUt9J9wAAAYo"]
[Sun Apr 26 09:32:06.363036 2026] [:error] [pid 8390:tid 8464] [client 74.248.33.118:28610] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "ae1rFoGPtFK_i9p5yxRhbQAAAI0"]
[Sun Apr 26 09:32:07.279524 2026] [:error] [pid 8390:tid 8465] [client 74.248.33.118:33182] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "ae1rF4GPtFK_i9p5yxRhcAAAAI4"]
[Sun Apr 26 09:32:07.931219 2026] [:error] [pid 16515:tid 16527] [client 74.248.33.118:41523] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "ae1rF1tDrUmgHSvpuLzheAAAAkk"]
[Sun Apr 26 09:32:09.643633 2026] [:error] [pid 8385:tid 8443] [client 74.248.33.118:33175] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bgymj.php"] [unique_id "ae1rGTOy7_J84Wx3-oyDwAAAAFM"]
[Sun Apr 26 09:32:11.824841 2026] [:error] [pid 8390:tid 8474] [client 74.248.33.118:25300] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pucci.php"] [unique_id "ae1rG4GPtFK_i9p5yxRhhAAAAJc"]
[Sun Apr 26 09:32:13.220399 2026] [:error] [pid 8390:tid 8453] [client 74.248.33.118:53329] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pucci.php"] [unique_id "ae1rHYGPtFK_i9p5yxRhiwAAAII"]
[Sun Apr 26 09:32:14.872619 2026] [:error] [pid 16515:tid 16530] [client 74.248.33.118:10060] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pucci.php"] [unique_id "ae1rHltDrUmgHSvpuLzhfQAAAkw"]
[Sun Apr 26 09:32:18.074768 2026] [:error] [pid 13137:tid 13147] [client 74.248.33.118:41472] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pucci.php"] [unique_id "ae1rIt0RB4J0o4h5neEB-QAAAgc"]
[Sun Apr 26 09:32:19.606394 2026] [:error] [pid 22573:tid 22623] [client 74.248.33.118:23296] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ae1rI3B3EmQlD4yKUt9KCQAAAZA"]
[Sun Apr 26 09:32:20.323509 2026] [:error] [pid 8385:tid 8430] [client 74.248.33.118:28639] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ae1rJDOy7_J84Wx3-oyDwwAAAEY"]
[Sun Apr 26 09:32:21.551712 2026] [:error] [pid 16515:tid 16522] [client 74.248.33.118:33199] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ae1rJVtDrUmgHSvpuLzhhAAAAkQ"]
[Sun Apr 26 09:32:22.924459 2026] [:error] [pid 16574:tid 16641] [client 74.248.33.118:10086] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ae1rJn5MsX8wRQr99nYIRgAAA1c"]
[Sun Apr 26 09:32:24.328848 2026] [:error] [pid 13137:tid 13155] [client 74.248.33.118:28659] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ae1rKN0RB4J0o4h5neECAwAAAg4"]
[Sun Apr 26 09:32:25.587126 2026] [:error] [pid 22573:tid 22613] [client 74.248.33.118:59673] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ae1rKXB3EmQlD4yKUt9KFwAAAYc"]
[Sun Apr 26 09:32:27.872361 2026] [:error] [pid 8385:tid 8445] [client 74.248.33.118:43748] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ae1rKzOy7_J84Wx3-oyD2gAAAFU"]
[Sun Apr 26 09:32:30.185266 2026] [:error] [pid 13137:tid 13151] [client 74.248.33.118:52991] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ae1rLt0RB4J0o4h5neECCAAAAgo"]
[Sun Apr 26 09:32:31.979980 2026] [:error] [pid 22573:tid 22608] [client 74.248.33.118:53326] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1rL3B3EmQlD4yKUt9KNwAAAYI"]
[Sun Apr 26 09:32:32.841077 2026] [:error] [pid 22572:tid 22587] [client 74.248.33.118:23305] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1rMNXOViWCFU-pZzCVWAAAAUk"]
[Sun Apr 26 09:32:33.829429 2026] [:error] [pid 13137:tid 13165] [client 74.248.33.118:41520] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1rMd0RB4J0o4h5neECCgAAAhg"]
[Sun Apr 26 09:32:35.818035 2026] [:error] [pid 8383:tid 8410] [client 74.248.33.118:59668] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1rM9Fa2S3EsATMdWPZwAAAAA0"]
[Sun Apr 26 09:32:36.906828 2026] [:error] [pid 13137:tid 13148] [client 74.248.33.118:53328] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ae1rNN0RB4J0o4h5neECEQAAAgg"]
[Sun Apr 26 09:32:38.049554 2026] [:error] [pid 22573:tid 22613] [client 74.248.33.118:23311] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ae1rNnB3EmQlD4yKUt9KYAAAAYc"]
[Sun Apr 26 09:32:39.808803 2026] [:error] [pid 22573:tid 22625] [client 74.248.33.118:23341] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ae1rN3B3EmQlD4yKUt9KewAAAZI"]
[Sun Apr 26 09:32:40.891829 2026] [:error] [pid 13197:tid 13240] [client 74.248.33.118:59706] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ae1rON3kktFKdSxTrBugxAAAAsk"]
[Sun Apr 26 09:32:41.625754 2026] [:error] [pid 22573:tid 22610] [client 74.248.33.118:52935] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "ae1rOXB3EmQlD4yKUt9KhwAAAYQ"]
[Sun Apr 26 09:32:42.503076 2026] [:error] [pid 22572:tid 22599] [client 74.248.33.118:34063] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "ae1rOtXOViWCFU-pZzCVfQAAAVU"]
[Sun Apr 26 09:32:43.405714 2026] [:error] [pid 13137:tid 13152] [client 74.248.33.118:2121] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "ae1rO90RB4J0o4h5neECFAAAAgs"]
[Sun Apr 26 09:32:44.425428 2026] [:error] [pid 13197:tid 13233] [client 74.248.33.118:2185] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "ae1rPN3kktFKdSxTrBugxwAAAsI"]
[Sun Apr 26 09:32:45.622647 2026] [:error] [pid 16515:tid 16521] [client 74.248.33.118:33186] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no20.php"] [unique_id "ae1rPVtDrUmgHSvpuLzhjwAAAkM"]
[Sun Apr 26 09:32:47.817336 2026] [:error] [pid 13137:tid 13159] [client 74.248.33.118:10079] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no20.php"] [unique_id "ae1rP90RB4J0o4h5neECGAAAAhI"]
[Sun Apr 26 09:32:52.582665 2026] [:error] [pid 16515:tid 16518] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/no20.php
[Sun Apr 26 09:32:52.850169 2026] [:error] [pid 16515:tid 16526] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-alone.php
[Sun Apr 26 09:32:53.119300 2026] [:error] [pid 16515:tid 16522] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/yasnu.php
[Sun Apr 26 09:32:53.377867 2026] [:error] [pid 16515:tid 16536] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Sun Apr 26 09:32:53.790444 2026] [:error] [pid 16515:tid 16520] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Sun Apr 26 09:32:54.058684 2026] [:error] [pid 16515:tid 16519] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-temp.php
[Sun Apr 26 09:32:54.833874 2026] [:error] [pid 16515:tid 16542] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/class-bda.php
[Sun Apr 26 09:32:55.094132 2026] [:error] [pid 16515:tid 16540] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/bhm.php
[Sun Apr 26 09:32:55.360010 2026] [:error] [pid 16515:tid 16533] [client 74.248.33.118:25325] File does not exist: /usr/local/apache/htdocs/suspended-page/xmu.php
[Sun Apr 26 09:32:55.615294 2026] [:error] [pid 16515:tid 16523] [client 74.248.33.118:25325] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "ae1rR1tDrUmgHSvpuLzhqgAAAkU"]
[Sun Apr 26 09:32:58.501488 2026] [:error] [pid 8491:tid 8518] [client 74.248.33.118:2183] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "ae1rSiq7I7e6CJooQM27RgAAANM"]
[Sun Apr 26 09:32:59.623298 2026] [:error] [pid 8390:tid 8467] [client 74.248.33.118:34051] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "ae1rS4GPtFK_i9p5yxRhrwAAAJA"]
[Sun Apr 26 09:33:00.624258 2026] [:error] [pid 13197:tid 13235] [client 74.248.33.118:23329] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ref.php"] [unique_id "ae1rTN3kktFKdSxTrBugzwAAAsQ"]
[Sun Apr 26 09:33:03.226935 2026] [:error] [pid 16515:tid 16541] [client 74.248.33.118:59682] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xme.php"] [unique_id "ae1rT1tDrUmgHSvpuLzhrwAAAlc"]
[Sun Apr 26 09:33:04.857174 2026] [:error] [pid 22573:tid 22607] [client 74.248.33.118:38486] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xme.php"] [unique_id "ae1rUHB3EmQlD4yKUt9K1wAAAYE"]
[Sun Apr 26 09:33:06.393869 2026] [:error] [pid 8385:tid 8439] [client 74.248.33.118:53317] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xme.php"] [unique_id "ae1rUjOy7_J84Wx3-oyD_QAAAE8"]
[Sun Apr 26 09:33:09.954058 2026] [:error] [pid 22572:tid 22589] [client 74.248.33.118:53319] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xme.php"] [unique_id "ae1rVdXOViWCFU-pZzCVjAAAAUs"]
[Sun Apr 26 09:33:11.618039 2026] [:error] [pid 13137:tid 13153] [client 74.248.33.118:59664] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminer.php"] [unique_id "ae1rV90RB4J0o4h5neECMQAAAgw"]
[Sun Apr 26 09:33:16.834416 2026] [:error] [pid 22573:tid 22620] [client 74.248.33.118:25287] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminer.php"] [unique_id "ae1rXHB3EmQlD4yKUt9K7AAAAY0"]
[Sun Apr 26 09:33:18.618177 2026] [:error] [pid 16515:tid 16530] [client 74.248.33.118:58293] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminer.php"] [unique_id "ae1rXltDrUmgHSvpuLzhtgAAAkw"]
[Sun Apr 26 09:33:19.409141 2026] [:error] [pid 8491:tid 8511] [client 74.248.33.118:16951] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminer.php"] [unique_id "ae1rXyq7I7e6CJooQM27UQAAAMw"]
[Sun Apr 26 09:33:21.365809 2026] [:error] [pid 16515:tid 16535] [client 74.248.33.118:59674] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ktfow.php"] [unique_id "ae1rYVtDrUmgHSvpuLzhvAAAAlE"]
[Sun Apr 26 09:33:23.843268 2026] [:error] [pid 8390:tid 8453] [client 74.248.33.118:23321] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ktfow.php"] [unique_id "ae1rY4GPtFK_i9p5yxRh2AAAAII"]
[Sun Apr 26 09:33:25.808709 2026] [:error] [pid 8390:tid 8465] [client 74.248.33.118:52976] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ktfow.php"] [unique_id "ae1rZYGPtFK_i9p5yxRh3QAAAI4"]
[Sun Apr 26 09:33:27.067920 2026] [:error] [pid 8390:tid 8466] [client 74.248.33.118:25338] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ktfow.php"] [unique_id "ae1rZ4GPtFK_i9p5yxRh4gAAAI8"]
[Sun Apr 26 09:33:28.478191 2026] [:error] [pid 13137:tid 13143] [client 74.248.33.118:10082] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "ae1raN0RB4J0o4h5neECOQAAAgM"]
[Sun Apr 26 09:33:29.504710 2026] [:error] [pid 8390:tid 8459] [client 74.248.33.118:65421] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "ae1raYGPtFK_i9p5yxRh6QAAAIg"]
[Sun Apr 26 09:33:31.660457 2026] [:error] [pid 13137:tid 13141] [client 74.248.33.118:43749] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "ae1ra90RB4J0o4h5neECOwAAAgE"]
[Sun Apr 26 09:33:32.553814 2026] [:error] [pid 8383:tid 8400] [client 74.248.33.118:41492] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "ae1rbNFa2S3EsATMdWPZ2QAAAAM"]
[Sun Apr 26 09:33:33.998125 2026] [:error] [pid 8491:tid 8509] [client 74.248.33.118:23357] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2468.php"] [unique_id "ae1rbSq7I7e6CJooQM27ZQAAAMo"]
[Sun Apr 26 09:33:35.083968 2026] [:error] [pid 8383:tid 8410] [client 74.248.33.118:10284] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2468.php"] [unique_id "ae1rb9Fa2S3EsATMdWPZ3gAAAA0"]
[Sun Apr 26 09:33:36.703872 2026] [:error] [pid 8491:tid 8505] [client 74.248.33.118:25320] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2468.php"] [unique_id "ae1rcCq7I7e6CJooQM27aQAAAMY"]
[Sun Apr 26 09:33:37.915574 2026] [:error] [pid 8491:tid 8520] [client 74.248.33.118:27148] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2468.php"] [unique_id "ae1rcSq7I7e6CJooQM27agAAANU"]
[Sun Apr 26 09:33:39.634770 2026] [:error] [pid 16574:tid 16606] [client 74.248.33.118:2270] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ae1rc35MsX8wRQr99nYIigAAA0I"]
[Sun Apr 26 09:33:41.671958 2026] [:error] [pid 22573:tid 22623] [client 74.248.33.118:65434] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ae1rdXB3EmQlD4yKUt9K9AAAAZA"]
[Sun Apr 26 09:33:42.356377 2026] [:error] [pid 13137:tid 13155] [client 74.248.33.118:47666] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ae1rdt0RB4J0o4h5neECRAAAAg4"]
[Sun Apr 26 09:33:45.289404 2026] [:error] [pid 13137:tid 13140] [client 74.248.33.118:27179] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ae1red0RB4J0o4h5neECTQAAAgA"]
[Sun Apr 26 09:33:47.335495 2026] [:error] [pid 22572:tid 22600] [client 74.248.33.118:27154] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ae1re9XOViWCFU-pZzCVyQAAAVY"]
[Sun Apr 26 09:33:49.126543 2026] [:error] [pid 22573:tid 22617] [client 74.248.33.118:10048] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ae1rfXB3EmQlD4yKUt9LCgAAAYo"]
[Sun Apr 26 09:33:50.861515 2026] [:error] [pid 22572:tid 22582] [client 74.248.33.118:65419] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ae1rftXOViWCFU-pZzCV3gAAAUQ"]
[Sun Apr 26 09:33:53.985127 2026] [:error] [pid 8390:tid 8454] [client 74.248.33.118:47625] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ae1rgYGPtFK_i9p5yxRh8wAAAIM"]
[Sun Apr 26 09:33:55.123329 2026] [:error] [pid 22573:tid 22622] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/amdin.php
[Sun Apr 26 09:33:55.388026 2026] [:error] [pid 22573:tid 22621] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/huya.php
[Sun Apr 26 09:33:55.646549 2026] [:error] [pid 22573:tid 22609] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/puc.php
[Sun Apr 26 09:33:55.911028 2026] [:error] [pid 22573:tid 22624] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Apr 26 09:33:56.174943 2026] [:error] [pid 22573:tid 22631] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Sun Apr 26 09:33:56.437760 2026] [:error] [pid 22573:tid 22616] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Sun Apr 26 09:33:56.725145 2026] [:error] [pid 22573:tid 22623] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sun Apr 26 09:33:56.985572 2026] [:error] [pid 22573:tid 22626] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Sun Apr 26 09:33:57.245885 2026] [:error] [pid 22573:tid 22613] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Sun Apr 26 09:33:57.504296 2026] [:error] [pid 22573:tid 22619] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/awa.php
[Sun Apr 26 09:33:57.761743 2026] [:error] [pid 22573:tid 22618] [client 74.248.33.118:47624] File does not exist: /usr/local/apache/htdocs/suspended-page/popo.php
[Sun Apr 26 09:33:58.025003 2026] [:error] [pid 22573:tid 22625] [client 74.248.33.118:47624] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "ae1rhnB3EmQlD4yKUt9LIQAAAZI"]
[Sun Apr 26 09:34:00.685882 2026] [:error] [pid 22573:tid 22622] [client 74.248.33.118:52984] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "ae1riHB3EmQlD4yKUt9LIgAAAY8"]
[Sun Apr 26 09:34:03.019848 2026] [:error] [pid 22572:tid 22598] [client 74.248.33.118:2158] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "ae1ri9XOViWCFU-pZzCV6AAAAVQ"]
[Sun Apr 26 09:34:04.033372 2026] [:error] [pid 13137:tid 13149] [client 74.248.33.118:2161] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/13.php"] [unique_id "ae1rjN0RB4J0o4h5neECWQAAAgk"]
[Sun Apr 26 09:34:05.647120 2026] [:error] [pid 22572:tid 22579] [client 74.248.33.118:43920] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "ae1rjdXOViWCFU-pZzCV7AAAAUE"]
[Sun Apr 26 09:34:07.184162 2026] [:error] [pid 8385:tid 8439] [client 74.248.33.118:27160] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "ae1rjzOy7_J84Wx3-oyEGAAAAE8"]
[Sun Apr 26 09:34:08.451327 2026] [:error] [pid 16515:tid 16519] [client 74.248.33.118:27145] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "ae1rkFtDrUmgHSvpuLzh0gAAAkE"]
[Sun Apr 26 09:34:09.954997 2026] [:error] [pid 13137:tid 13165] [client 74.248.33.118:10100] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "ae1rkd0RB4J0o4h5neECXwAAAhg"]
[Sun Apr 26 09:34:10.899059 2026] [:error] [pid 16515:tid 16542] [client 74.248.33.118:10083] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "ae1rkltDrUmgHSvpuLzh1wAAAlg"]
[Sun Apr 26 09:34:11.707229 2026] [:error] [pid 13197:tid 13251] [client 74.248.33.118:2295] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "ae1rk93kktFKdSxTrBug6AAAAtM"]
[Sun Apr 26 09:34:12.874553 2026] [:error] [pid 8385:tid 8428] [client 74.248.33.118:2519] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "ae1rlDOy7_J84Wx3-oyEHwAAAEQ"]
[Sun Apr 26 09:34:14.259448 2026] [:error] [pid 8491:tid 8504] [client 74.248.33.118:10075] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "ae1rliq7I7e6CJooQM27gAAAAMU"]
[Sun Apr 26 09:34:16.295399 2026] [:error] [pid 8390:tid 8462] [client 74.248.33.118:60033] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/"] [unique_id "ae1rmIGPtFK_i9p5yxRh_AAAAIs"]
[Sun Apr 26 09:34:17.560139 2026] [:error] [pid 13137:tid 13141] [client 74.248.33.118:47616] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/"] [unique_id "ae1rmd0RB4J0o4h5neECZQAAAgE"]
[Sun Apr 26 09:34:18.514648 2026] [:error] [pid 22572:tid 22598] [client 74.248.33.118:2539] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/"] [unique_id "ae1rmtXOViWCFU-pZzCV9gAAAVQ"]
[Sun Apr 26 09:34:20.242203 2026] [:error] [pid 13137:tid 13162] [client 74.248.33.118:25342] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/"] [unique_id "ae1rnN0RB4J0o4h5neECZgAAAhU"]
[Sun Apr 26 09:34:21.400044 2026] [:error] [pid 22573:tid 22612] [client 74.248.33.118:27183] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "ae1rnXB3EmQlD4yKUt9LLwAAAYY"]
[Sun Apr 26 09:34:23.289202 2026] [:error] [pid 8390:tid 8470] [client 74.248.33.118:25312] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "ae1rn4GPtFK_i9p5yxRiAwAAAJM"]
[Sun Apr 26 09:34:24.221075 2026] [:error] [pid 8385:tid 8440] [client 74.248.33.118:36142] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "ae1roDOy7_J84Wx3-oyEKAAAAFA"]
[Sun Apr 26 09:34:26.615179 2026] [:error] [pid 8390:tid 8462] [client 74.248.33.118:2294] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bthil.php"] [unique_id "ae1rooGPtFK_i9p5yxRiDQAAAIs"]
[Sun Apr 26 09:34:27.799753 2026] [:error] [pid 8390:tid 8454] [client 74.248.33.118:43946] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "ae1ro4GPtFK_i9p5yxRiEAAAAIM"]
[Sun Apr 26 09:34:28.623284 2026] [:error] [pid 22572:tid 22599] [client 74.248.33.118:52983] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "ae1rpNXOViWCFU-pZzCWAAAAAVU"]
[Sun Apr 26 09:34:29.731061 2026] [:error] [pid 22572:tid 22597] [client 74.248.33.118:2173] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "ae1rpdXOViWCFU-pZzCWBQAAAVM"]
[Sun Apr 26 09:34:30.913712 2026] [:error] [pid 22572:tid 22582] [client 74.248.33.118:43936] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell.php"] [unique_id "ae1rptXOViWCFU-pZzCWCgAAAUQ"]
[Sun Apr 26 09:34:32.070813 2026] [:error] [pid 22573:tid 22618] [client 74.248.33.118:58246] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/seo.php"] [unique_id "ae1rqHB3EmQlD4yKUt9LNAAAAYs"]
[Sun Apr 26 09:34:33.357370 2026] [:error] [pid 22573:tid 22621] [client 74.248.33.118:2237] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/seo.php"] [unique_id "ae1rqXB3EmQlD4yKUt9LOgAAAY4"]
[Sun Apr 26 09:34:34.186577 2026] [:error] [pid 22572:tid 22595] [client 74.248.33.118:2554] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/seo.php"] [unique_id "ae1rqtXOViWCFU-pZzCWFAAAAVE"]
[Sun Apr 26 09:34:35.130208 2026] [:error] [pid 22572:tid 22599] [client 74.248.33.118:65431] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/seo.php"] [unique_id "ae1rq9XOViWCFU-pZzCWGQAAAVU"]
[Sun Apr 26 09:34:36.578326 2026] [:error] [pid 22572:tid 22591] [client 74.248.33.118:47679] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "ae1rrNXOViWCFU-pZzCWHgAAAU0"]
[Sun Apr 26 09:34:37.209292 2026] [:error] [pid 22572:tid 22589] [client 74.248.33.118:28631] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "ae1rrdXOViWCFU-pZzCWIwAAAUs"]
[Sun Apr 26 09:34:38.835442 2026] [:error] [pid 8385:tid 8438] [client 74.248.33.118:47658] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "ae1rrjOy7_J84Wx3-oyEOQAAAE4"]
[Sun Apr 26 09:34:39.809251 2026] [:error] [pid 22573:tid 22626] [client 74.248.33.118:65422] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "ae1rr3B3EmQlD4yKUt9LQgAAAZM"]
[Sun Apr 26 09:34:40.693759 2026] [:error] [pid 8390:tid 8469] [client 74.248.33.118:33188] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "ae1rsIGPtFK_i9p5yxRiFgAAAJI"]
[Sun Apr 26 09:34:42.040638 2026] [:error] [pid 13137:tid 13156] [client 74.248.33.118:2532] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "ae1rst0RB4J0o4h5neECbgAAAg8"]
[Sun Apr 26 09:34:44.107422 2026] [:error] [pid 8491:tid 8505] [client 74.248.33.118:38468] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "ae1rtCq7I7e6CJooQM27iAAAAMY"]
[Sun Apr 26 09:34:45.871047 2026] [:error] [pid 8383:tid 8398] [client 74.248.33.118:28667] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/8.php"] [unique_id "ae1rtdFa2S3EsATMdWPZ6gAAAAE"]
[Sun Apr 26 09:34:47.434131 2026] [:error] [pid 8383:tid 8399] [client 74.248.33.118:27139] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "ae1rt9Fa2S3EsATMdWPZ6wAAAAI"]
[Sun Apr 26 09:34:48.594066 2026] [:error] [pid 22573:tid 22622] [client 74.248.33.118:27137] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "ae1ruHB3EmQlD4yKUt9LWQAAAY8"]
[Sun Apr 26 09:34:49.732291 2026] [:error] [pid 16515:tid 16538] [client 74.248.33.118:47647] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "ae1ruVtDrUmgHSvpuLzh7gAAAlQ"]
[Sun Apr 26 09:34:51.084663 2026] [:error] [pid 22573:tid 22628] [client 74.248.33.118:33203] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1.php"] [unique_id "ae1ru3B3EmQlD4yKUt9LYwAAAZU"]
[Sun Apr 26 09:34:52.685266 2026] [:error] [pid 8390:tid 8451] [client 74.248.33.118:52942] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "ae1rvIGPtFK_i9p5yxRiJwAAAIA"]
[Sun Apr 26 09:34:54.391098 2026] [:error] [pid 22573:tid 22625] [client 74.248.33.118:2505] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "ae1rvnB3EmQlD4yKUt9LawAAAZI"]
[Sun Apr 26 09:34:55.558941 2026] [:error] [pid 13137:tid 13154] [client 74.248.33.118:2214] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "ae1rv90RB4J0o4h5neECfwAAAg0"]
[Sun Apr 26 09:34:57.166376 2026] [:error] [pid 13137:tid 13151] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sun Apr 26 09:34:57.502182 2026] [:error] [pid 13137:tid 13164] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Sun Apr 26 09:34:57.805340 2026] [:error] [pid 13137:tid 13143] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Sun Apr 26 09:34:58.095024 2026] [:error] [pid 13137:tid 13140] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Sun Apr 26 09:34:58.377423 2026] [:error] [pid 13137:tid 13153] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Sun Apr 26 09:34:58.634245 2026] [:error] [pid 13137:tid 13145] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Sun Apr 26 09:34:58.900304 2026] [:error] [pid 13137:tid 13162] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Sun Apr 26 09:34:59.158032 2026] [:error] [pid 13137:tid 13161] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Sun Apr 26 09:34:59.674274 2026] [:error] [pid 13137:tid 13160] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Sun Apr 26 09:34:59.935036 2026] [:error] [pid 13137:tid 13159] [client 74.248.33.118:2221] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Sun Apr 26 09:35:00.200517 2026] [:error] [pid 13137:tid 13163] [client 74.248.33.118:2221] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "ae1rxN0RB4J0o4h5neECjwAAAhY"]
[Sun Apr 26 09:35:01.998897 2026] [:error] [pid 13137:tid 13154] [client 74.248.33.118:41476] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "ae1rxd0RB4J0o4h5neECkAAAAg0"]
[Sun Apr 26 09:35:03.681472 2026] [:error] [pid 16515:tid 16535] [client 74.248.33.118:25339] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "ae1rx1tDrUmgHSvpuLzh_wAAAlE"]
[Sun Apr 26 09:35:04.416470 2026] [:error] [pid 22573:tid 22626] [client 74.248.33.118:25313] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ass.php"] [unique_id "ae1ryHB3EmQlD4yKUt9LgAAAAZM"]
[Sun Apr 26 09:35:05.445087 2026] [:error] [pid 13137:tid 13162] [client 74.248.33.118:52947] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ae1ryd0RB4J0o4h5neEClwAAAhU"]
[Sun Apr 26 09:35:06.491176 2026] [:error] [pid 8383:tid 8412] [client 74.248.33.118:2279] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ae1rytFa2S3EsATMdWPZ7gAAAA8"]
[Sun Apr 26 09:35:07.499655 2026] [:error] [pid 16574:tid 16637] [client 74.248.33.118:43906] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ae1ry35MsX8wRQr99nYIsAAAA1U"]
[Sun Apr 26 09:35:08.871280 2026] [:error] [pid 16574:tid 16611] [client 74.248.33.118:2285] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ae1rzH5MsX8wRQr99nYItAAAA0c"]
[Sun Apr 26 09:35:10.500475 2026] [:error] [pid 8491:tid 8512] [client 74.248.33.118:27185] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "ae1rziq7I7e6CJooQM27jgAAAM0"]
[Sun Apr 26 09:35:11.478908 2026] [:error] [pid 8390:tid 8451] [client 74.248.33.118:52981] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "ae1rz4GPtFK_i9p5yxRiQgAAAIA"]
[Sun Apr 26 09:35:12.879850 2026] [:error] [pid 8390:tid 8466] [client 74.248.33.118:25305] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "ae1r0IGPtFK_i9p5yxRiSAAAAI8"]
[Sun Apr 26 09:35:14.015829 2026] [:error] [pid 22572:tid 22579] [client 74.248.33.118:65440] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no18.php"] [unique_id "ae1r0tXOViWCFU-pZzCWOAAAAUE"]
[Sun Apr 26 09:35:15.758269 2026] [:error] [pid 8385:tid 8434] [client 74.248.33.118:2292] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "ae1r0zOy7_J84Wx3-oyEUwAAAEo"]
[Sun Apr 26 09:35:17.341263 2026] [:error] [pid 8390:tid 8453] [client 74.248.33.118:52946] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "ae1r1YGPtFK_i9p5yxRiUQAAAII"]
[Sun Apr 26 09:35:18.674225 2026] [:error] [pid 8390:tid 8464] [client 74.248.33.118:2540] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fine.php"] [unique_id "ae1r1oGPtFK_i9p5yxRiVgAAAI0"]
[Sun Apr 26 09:35:31.085539 2026] [:error] [pid 22572:tid 22590] [client 74.248.33.118:47657] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "ae1r49XOViWCFU-pZzCWSwAAAUw"]
[Sun Apr 26 09:35:32.105191 2026] [:error] [pid 8385:tid 8438] [client 74.248.33.118:60071] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "ae1r5DOy7_J84Wx3-oyEZwAAAE4"]
[Sun Apr 26 09:35:33.166137 2026] [:error] [pid 16515:tid 16541] [client 74.248.33.118:52952] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "ae1r5VtDrUmgHSvpuLziDQAAAlc"]
[Sun Apr 26 09:35:34.150557 2026] [:error] [pid 13137:tid 13152] [client 74.248.33.118:41535] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "ae1r5t0RB4J0o4h5neECuAAAAgs"]
[Sun Apr 26 09:35:34.828621 2026] [:error] [pid 13137:tid 13159] [client 74.248.33.118:52978] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "ae1r5t0RB4J0o4h5neECugAAAhI"]
[Sun Apr 26 09:35:36.135812 2026] [:error] [pid 13137:tid 13155] [client 74.248.33.118:10104] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "ae1r6N0RB4J0o4h5neECwAAAAg4"]
[Sun Apr 26 09:35:37.135508 2026] [:error] [pid 22573:tid 22629] [client 74.248.33.118:2288] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "ae1r6XB3EmQlD4yKUt9LqgAAAZY"]
[Sun Apr 26 09:35:38.249562 2026] [:error] [pid 8385:tid 8442] [client 74.248.33.118:10108] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "ae1r6jOy7_J84Wx3-oyEcQAAAFI"]
[Sun Apr 26 09:35:39.218145 2026] [:error] [pid 8390:tid 8475] [client 74.248.33.118:28609] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ae1r64GPtFK_i9p5yxRicAAAAJg"]
[Sun Apr 26 09:35:40.257422 2026] [:error] [pid 8390:tid 8453] [client 74.248.33.118:43904] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ae1r7IGPtFK_i9p5yxRidwAAAII"]
[Sun Apr 26 09:35:41.384805 2026] [:error] [pid 13137:tid 13140] [client 74.248.33.118:10092] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ae1r7d0RB4J0o4h5neECxAAAAgA"]
[Sun Apr 26 09:35:43.134656 2026] [:error] [pid 22573:tid 22622] [client 74.248.33.118:47677] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ae1r73B3EmQlD4yKUt9LtAAAAY8"]
[Sun Apr 26 09:35:44.285664 2026] [:error] [pid 22573:tid 22629] [client 74.248.33.118:38489] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "ae1r8HB3EmQlD4yKUt9LuwAAAZY"]
[Sun Apr 26 09:35:46.823051 2026] [:error] [pid 13137:tid 13161] [client 74.248.33.118:47669] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "ae1r8t0RB4J0o4h5neECxQAAAhQ"]
[Sun Apr 26 09:35:47.896200 2026] [:error] [pid 13137:tid 13144] [client 74.248.33.118:38516] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "ae1r890RB4J0o4h5neECxwAAAgQ"]
[Sun Apr 26 09:35:50.300511 2026] [:error] [pid 16574:tid 16631] [client 74.248.33.118:2115] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inege.php"] [unique_id "ae1r9n5MsX8wRQr99nYIxQAAA1I"]
[Sun Apr 26 09:35:51.961651 2026] [:error] [pid 22573:tid 22628] [client 74.248.33.118:38499] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "ae1r93B3EmQlD4yKUt9LyQAAAZU"]
[Sun Apr 26 09:35:53.549255 2026] [:error] [pid 8390:tid 8458] [client 74.248.33.118:2222] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "ae1r-YGPtFK_i9p5yxRitwAAAIc"]
[Sun Apr 26 09:35:55.114363 2026] [:error] [pid 16515:tid 16521] [client 74.248.33.118:10099] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "ae1r-1tDrUmgHSvpuLziFwAAAkM"]
[Sun Apr 26 09:35:56.311033 2026] [:error] [pid 22572:tid 22593] [client 74.248.33.118:2122] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uuu.php"] [unique_id "ae1r_NXOViWCFU-pZzCWfgAAAU8"]
[Sun Apr 26 09:35:58.705686 2026] [:error] [pid 8390:tid 8461] [client 74.248.33.118:2157] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/no1.php"] [unique_id "ae1r_oGPtFK_i9p5yxRiyAAAAIo"]
[Sun Apr 26 09:36:00.916801 2026] [:error] [pid 13137:tid 13165] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Sun Apr 26 09:36:01.175721 2026] [:error] [pid 13137:tid 13158] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Sun Apr 26 09:36:01.434160 2026] [:error] [pid 13137:tid 13157] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Sun Apr 26 09:36:01.695095 2026] [:error] [pid 13137:tid 13140] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Sun Apr 26 09:36:01.953653 2026] [:error] [pid 13137:tid 13153] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Apr 26 09:36:02.216493 2026] [:error] [pid 13137:tid 13145] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Apr 26 09:36:03.053043 2026] [:error] [pid 13137:tid 13154] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Sun Apr 26 09:36:03.323589 2026] [:error] [pid 13137:tid 13151] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Sun Apr 26 09:36:03.591904 2026] [:error] [pid 13137:tid 13158] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Sun Apr 26 09:36:03.855079 2026] [:error] [pid 13137:tid 13155] [client 74.248.33.118:2297] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sun Apr 26 09:36:04.110881 2026] [:error] [pid 13137:tid 13140] [client 74.248.33.118:2297] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "ae1sBN0RB4J0o4h5neEC8QAAAgA"]
[Sun Apr 26 09:36:05.874348 2026] [:error] [pid 8390:tid 8465] [client 74.248.33.118:41498] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "ae1sBYGPtFK_i9p5yxRi3QAAAI4"]
[Sun Apr 26 09:36:08.500587 2026] [:error] [pid 8383:tid 8418] [client 74.248.33.118:2135] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "ae1sCNFa2S3EsATMdWPaAQAAABU"]
[Sun Apr 26 09:36:10.103976 2026] [:error] [pid 22572:tid 22602] [client 74.248.33.118:54819] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "ae1sCtXOViWCFU-pZzCWhwAAAVg"]
[Sun Apr 26 09:36:12.098250 2026] [:error] [pid 8390:tid 8460] [client 74.248.33.118:25282] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "ae1sDIGPtFK_i9p5yxRi5gAAAIk"]
[Sun Apr 26 09:36:14.393540 2026] [:error] [pid 8390:tid 8466] [client 74.248.33.118:2265] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "ae1sDoGPtFK_i9p5yxRi6AAAAI8"]
[Sun Apr 26 09:36:15.509486 2026] [:error] [pid 8385:tid 8427] [client 74.248.33.118:2290] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "ae1sDzOy7_J84Wx3-oyEiQAAAEM"]
[Sun Apr 26 09:36:17.175257 2026] [:error] [pid 22572:tid 22592] [client 74.248.33.118:17752] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "ae1sEdXOViWCFU-pZzCWjgAAAU4"]
[Sun Apr 26 09:36:18.294361 2026] [:error] [pid 8390:tid 8462] [client 74.248.33.118:27172] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ae1sEoGPtFK_i9p5yxRi8gAAAIs"]
[Sun Apr 26 09:36:22.206484 2026] [:error] [pid 22573:tid 22621] [client 74.248.33.118:65451] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ae1sFnB3EmQlD4yKUt9L2QAAAY4"]
[Sun Apr 26 09:36:23.743504 2026] [:error] [pid 22573:tid 22611] [client 74.248.33.118:47652] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ae1sF3B3EmQlD4yKUt9L2wAAAYU"]
[Sun Apr 26 09:36:24.551266 2026] [:error] [pid 8385:tid 8433] [client 74.248.33.118:43932] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ae1sGDOy7_J84Wx3-oyEjgAAAEk"]
[Sun Apr 26 09:36:25.565471 2026] [:error] [pid 22573:tid 22606] [client 74.248.33.118:55109] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1sGXB3EmQlD4yKUt9L3QAAAYA"]
[Sun Apr 26 09:36:28.919510 2026] [:error] [pid 13137:tid 13148] [client 74.248.33.118:55120] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1sHN0RB4J0o4h5neEC_gAAAgg"]
[Sun Apr 26 09:36:30.831716 2026] [:error] [pid 8390:tid 8470] [client 74.248.33.118:32640] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1sHoGPtFK_i9p5yxRjDwAAAJM"]
[Sun Apr 26 09:36:31.925899 2026] [:error] [pid 8385:tid 8442] [client 74.248.33.118:56328] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1sHzOy7_J84Wx3-oyEmQAAAFI"]
[Sun Apr 26 09:36:33.184285 2026] [:error] [pid 13197:tid 13252] [client 74.248.33.118:2053] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "ae1sId3kktFKdSxTrBuhIQAAAtQ"]
[Sun Apr 26 09:36:34.286086 2026] [:error] [pid 13197:tid 13255] [client 74.248.33.118:2476] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "ae1sIt3kktFKdSxTrBuhIgAAAtc"]
[Sun Apr 26 09:36:35.012123 2026] [:error] [pid 13137:tid 13158] [client 74.248.33.118:57534] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "ae1sI90RB4J0o4h5neEC_wAAAhE"]
[Sun Apr 26 09:36:35.690039 2026] [:error] [pid 8390:tid 8463] [client 74.248.33.118:43650] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "ae1sI4GPtFK_i9p5yxRjGgAAAIw"]
[Sun Apr 26 09:36:36.741680 2026] [:error] [pid 8390:tid 8456] [client 74.248.33.118:20273] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae1sJIGPtFK_i9p5yxRjIAAAAIU"]
[Sun Apr 26 09:36:38.951606 2026] [:error] [pid 13197:tid 13231] [client 74.248.33.118:40235] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae1sJt3kktFKdSxTrBuhJQAAAsA"]
[Sun Apr 26 09:36:39.862093 2026] [:error] [pid 8390:tid 8475] [client 74.248.33.118:20225] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae1sJ4GPtFK_i9p5yxRjLgAAAJg"]
[Sun Apr 26 09:36:40.911326 2026] [:error] [pid 8390:tid 8467] [client 74.248.33.118:40964] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ae1sKIGPtFK_i9p5yxRjNAAAAJA"]
[Sun Apr 26 09:36:43.270791 2026] [:error] [pid 8385:tid 8436] [client 74.248.33.118:49469] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ae1sKzOy7_J84Wx3-oyEnQAAAEw"]
[Sun Apr 26 09:36:44.759885 2026] [:error] [pid 8383:tid 8403] [client 74.248.33.118:56940] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ae1sLNFa2S3EsATMdWPaBgAAAAY"]
[Sun Apr 26 09:36:46.821874 2026] [:error] [pid 22573:tid 22624] [client 74.248.33.118:59439] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ae1sLnB3EmQlD4yKUt9L8wAAAZE"]
[Sun Apr 26 09:36:49.830061 2026] [:error] [pid 22573:tid 22628] [client 74.248.33.118:47580] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ae1sMXB3EmQlD4yKUt9L-QAAAZU"]
[Sun Apr 26 09:36:52.164107 2026] [:error] [pid 16515:tid 16532] [client 74.248.33.118:2886] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ae1sNFtDrUmgHSvpuLziOgAAAk4"]
[Sun Apr 26 09:36:53.213708 2026] [:error] [pid 22573:tid 22627] [client 74.248.33.118:2575] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ae1sNXB3EmQlD4yKUt9L_QAAAZQ"]
[Sun Apr 26 09:36:56.199327 2026] [:error] [pid 22572:tid 22587] [client 74.248.33.118:2762] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ae1sONXOViWCFU-pZzCWlQAAAUk"]
[Sun Apr 26 09:36:59.459761 2026] [:error] [pid 22572:tid 22601] [client 74.248.33.118:59370] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ae1sO9XOViWCFU-pZzCWnwAAAVc"]
[Sun Apr 26 09:37:01.634419 2026] [:error] [pid 22572:tid 22593] [client 74.248.33.118:55034] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "ae1sPdXOViWCFU-pZzCWpAAAAU8"]
[Sun Apr 26 09:37:04.119214 2026] [:error] [pid 16515:tid 16526] [client 74.248.33.118:29701] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Apr 26 09:37:04.923925 2026] [:error] [pid 16515:tid 16528] [client 74.248.33.118:29701] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sun Apr 26 09:37:05.187569 2026] [:error] [pid 16515:tid 16520] [client 74.248.33.118:29701] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Apr 26 09:37:05.446999 2026] [:error] [pid 16515:tid 16539] [client 74.248.33.118:29701] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Apr 26 09:37:05.709405 2026] [:error] [pid 16515:tid 16535] [client 74.248.33.118:29701] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sun Apr 26 09:37:05.969343 2026] [:error] [pid 16515:tid 16519] [client 74.248.33.118:29701] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Apr 26 09:37:06.485673 2026] [:error] [pid 16515:tid 16530] [client 74.248.33.118:29701] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sun Apr 26 09:37:07.000214 2026] [:error] [pid 16515:tid 16523] [client 74.248.33.118:29701] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "ae1sQltDrUmgHSvpuLziVAAAAkU"]
[Sun Apr 26 09:37:08.968656 2026] [:error] [pid 22572:tid 22580] [client 74.248.33.118:48458] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "ae1sRNXOViWCFU-pZzCWsQAAAUI"]
[Sun Apr 26 09:37:09.914606 2026] [:error] [pid 22573:tid 22615] [client 74.248.33.118:48495] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "ae1sRXB3EmQlD4yKUt9MJQAAAYg"]
[Sun Apr 26 09:37:11.628641 2026] [:error] [pid 8385:tid 8428] [client 74.248.33.118:39790] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/makeasmtp.php"] [unique_id "ae1sRzOy7_J84Wx3-oyEsQAAAEQ"]
[Sun Apr 26 09:37:12.398594 2026] [:error] [pid 8390:tid 8465] [client 74.248.33.118:45291] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin1.php"] [unique_id "ae1sSIGPtFK_i9p5yxRjSwAAAI4"]
[Sun Apr 26 09:37:13.504952 2026] [:error] [pid 8491:tid 8509] [client 74.248.33.118:48680] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin1.php"] [unique_id "ae1sSSq7I7e6CJooQM27twAAAMo"]
[Sun Apr 26 09:37:15.064332 2026] [:error] [pid 22572:tid 22587] [client 74.248.33.118:15173] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin1.php"] [unique_id "ae1sS9XOViWCFU-pZzCWtwAAAUk"]
[Sun Apr 26 09:37:16.151181 2026] [:error] [pid 8390:tid 8468] [client 74.248.33.118:55711] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin1.php"] [unique_id "ae1sTIGPtFK_i9p5yxRjYgAAAJE"]
[Sun Apr 26 09:37:17.285780 2026] [:error] [pid 8390:tid 8461] [client 74.248.33.118:55697] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ae1sTYGPtFK_i9p5yxRjaAAAAIo"]
[Sun Apr 26 09:37:17.964409 2026] [:error] [pid 8385:tid 8446] [client 74.248.33.118:34881] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ae1sTTOy7_J84Wx3-oyEtwAAAFY"]
[Sun Apr 26 09:37:19.422683 2026] [:error] [pid 22572:tid 22593] [client 74.248.33.118:42669] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ae1sT9XOViWCFU-pZzCWuAAAAU8"]
[Sun Apr 26 09:37:20.615498 2026] [:error] [pid 8385:tid 8426] [client 74.248.33.118:21535] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "ae1sUDOy7_J84Wx3-oyEugAAAEI"]
[Sun Apr 26 09:37:21.744811 2026] [:error] [pid 13137:tid 13159] [client 74.248.33.118:49344] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "ae1sUd0RB4J0o4h5neEDFAAAAhI"]
[Sun Apr 26 09:37:26.266960 2026] [:error] [pid 13137:tid 13146] [client 74.248.33.118:42645] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "ae1sVt0RB4J0o4h5neEDGQAAAgY"]
[Sun Apr 26 09:37:31.568136 2026] [:error] [pid 22573:tid 22618] [client 74.248.33.118:60698] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "ae1sW3B3EmQlD4yKUt9MNgAAAYs"]
[Sun Apr 26 09:37:33.483114 2026] [:error] [pid 13137:tid 13149] [client 74.248.33.118:22672] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/BDKR28WP.php"] [unique_id "ae1sXd0RB4J0o4h5neEDIgAAAgk"]
[Sun Apr 26 09:37:34.989977 2026] [:error] [pid 22573:tid 22629] [client 74.248.33.118:32802] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ae1sXnB3EmQlD4yKUt9MQQAAAZY"]
[Sun Apr 26 09:37:36.000038 2026] [:error] [pid 22572:tid 22583] [client 74.248.33.118:49379] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ae1sX9XOViWCFU-pZzCWywAAAUU"]
[Sun Apr 26 09:37:37.739674 2026] [:error] [pid 22573:tid 22612] [client 74.248.33.118:58224] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ae1sYXB3EmQlD4yKUt9MSAAAAYY"]
[Sun Apr 26 09:37:43.176215 2026] [:error] [pid 8390:tid 8470] [client 74.248.33.118:15219] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ae1sZ4GPtFK_i9p5yxRjhwAAAJM"]
[Sun Apr 26 09:37:45.203948 2026] [:error] [pid 22573:tid 22629] [client 74.248.33.118:21560] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/"] [unique_id "ae1saXB3EmQlD4yKUt9MVQAAAZY"]
[Sun Apr 26 09:37:47.016629 2026] [:error] [pid 8491:tid 8509] [client 74.248.33.118:45248] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/"] [unique_id "ae1sayq7I7e6CJooQM27vgAAAMo"]
[Sun Apr 26 09:37:48.769462 2026] [:error] [pid 13197:tid 13240] [client 74.248.33.118:49362] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/"] [unique_id "ae1sbN3kktFKdSxTrBuhNwAAAsk"]
[Sun Apr 26 09:37:50.421568 2026] [:error] [pid 16515:tid 16523] [client 74.248.33.118:58182] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/"] [unique_id "ae1sbltDrUmgHSvpuLzifwAAAkU"]
[Sun Apr 26 09:37:52.754050 2026] [:error] [pid 8390:tid 8454] [client 74.248.33.118:32792] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "ae1scIGPtFK_i9p5yxRjjAAAAIM"]
[Sun Apr 26 09:37:54.519583 2026] [:error] [pid 8385:tid 8443] [client 74.248.33.118:49350] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "ae1scjOy7_J84Wx3-oyEyQAAAFM"]
[Sun Apr 26 09:37:56.306318 2026] [:error] [pid 8390:tid 8468] [client 74.248.33.118:45311] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "ae1sdIGPtFK_i9p5yxRjlQAAAJE"]
[Sun Apr 26 09:37:59.856722 2026] [:error] [pid 8390:tid 8468] [client 74.248.33.118:43932] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "ae1sd4GPtFK_i9p5yxRjngAAAJE"]
[Sun Apr 26 09:38:00.794611 2026] [:error] [pid 16515:tid 16535] [client 74.248.33.118:40476] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ae1seFtDrUmgHSvpuLziiAAAAlE"]
[Sun Apr 26 09:38:03.016546 2026] [:error] [pid 8390:tid 8456] [client 74.248.33.118:58181] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ae1se4GPtFK_i9p5yxRjpQAAAIU"]
[Sun Apr 26 09:38:04.173582 2026] [:error] [pid 22572:tid 22592] [client 74.248.33.118:40452] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ae1sfNXOViWCFU-pZzCW0wAAAU4"]
[Sun Apr 26 09:38:05.777506 2026] [:error] [pid 8491:tid 8508] [client 74.248.33.118:33352] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ae1sfSq7I7e6CJooQM27ywAAAMk"]
[Sun Apr 26 09:38:07.591046 2026] [:error] [pid 8383:tid 8410] [client 74.248.33.118:2426] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Sun Apr 26 09:38:08.125001 2026] [:error] [pid 8383:tid 8421] [client 74.248.33.118:2426] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Apr 26 09:38:08.394502 2026] [:error] [pid 8383:tid 8403] [client 74.248.33.118:2426] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Apr 26 09:38:08.653214 2026] [:error] [pid 8383:tid 8406] [client 74.248.33.118:2426] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Sun Apr 26 09:38:09.177316 2026] [:error] [pid 8383:tid 8402] [client 74.248.33.118:2426] [client 74.248.33.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ae1sgdFa2S3EsATMdWPaIQAAAAU"]
[Sun Apr 26 09:38:12.676276 2026] [:error] [pid 8383:tid 8400] [client 74.248.33.118:45304] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Apr 26 09:38:13.788564 2026] [:error] [pid 8383:tid 8408] [client 74.248.33.118:45304] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sun Apr 26 09:38:14.067866 2026] [:error] [pid 8383:tid 8410] [client 74.248.33.118:45304] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ae1shtFa2S3EsATMdWPaKgAAAA0"]
[Sun Apr 26 09:38:14.966809 2026] [:error] [pid 8390:tid 8460] [client 74.248.33.118:49355] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ae1shoGPtFK_i9p5yxRjsQAAAIk"]
[Sun Apr 26 09:38:15.797679 2026] [:error] [pid 8491:tid 8523] [client 74.248.33.118:2431] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ae1shyq7I7e6CJooQM27zgAAANc"]
[Sun Apr 26 09:38:17.145299 2026] [:error] [pid 16515:tid 16539] [client 74.248.33.118:15178] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ae1siVtDrUmgHSvpuLzinAAAAlU"]
[Sun Apr 26 09:38:18.469415 2026] [:error] [pid 8390:tid 8451] [client 74.248.33.118:42676] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "ae1sioGPtFK_i9p5yxRjugAAAIA"]
[Sun Apr 26 09:38:19.516298 2026] [:error] [pid 8383:tid 8405] [client 74.248.33.118:55798] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "ae1si9Fa2S3EsATMdWPaKwAAAAg"]
[Sun Apr 26 09:38:22.521537 2026] [:error] [pid 13137:tid 13147] [client 74.248.33.118:48697] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "ae1sjt0RB4J0o4h5neEDRwAAAgc"]
[Sun Apr 26 09:38:24.242130 2026] [:error] [pid 13137:tid 13144] [client 74.248.33.118:53765] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/in.php"] [unique_id "ae1skN0RB4J0o4h5neEDTAAAAgQ"]
[Sun Apr 26 09:38:26.814026 2026] [:error] [pid 8390:tid 8471] [client 74.248.33.118:55001] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "ae1skoGPtFK_i9p5yxRjxwAAAJQ"]
[Sun Apr 26 09:38:30.279121 2026] [:error] [pid 8491:tid 8504] [client 74.248.33.118:59362] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "ae1sliq7I7e6CJooQM275AAAAMU"]
[Sun Apr 26 09:38:32.879102 2026] [:error] [pid 13137:tid 13148] [client 74.248.33.118:26297] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "ae1smN0RB4J0o4h5neEDVAAAAgg"]
[Sun Apr 26 09:38:34.037460 2026] [:error] [pid 13137:tid 13165] [client 74.248.33.118:2795] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gssdd.php"] [unique_id "ae1smt0RB4J0o4h5neEDWAAAAhg"]
[Sun Apr 26 09:38:35.680553 2026] [:error] [pid 13197:tid 13238] [client 74.248.33.118:18694] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ae1sm93kktFKdSxTrBuhQgAAAsc"]
[Sun Apr 26 09:38:37.328556 2026] [:error] [pid 22573:tid 22627] [client 74.248.33.118:46197] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ae1snXB3EmQlD4yKUt9MYAAAAZQ"]
[Sun Apr 26 09:38:38.791637 2026] [:error] [pid 8491:tid 8515] [client 74.248.33.118:47604] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ae1sniq7I7e6CJooQM279AAAANA"]
[Sun Apr 26 09:38:39.648570 2026] [:error] [pid 8491:tid 8508] [client 74.248.33.118:18750] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ae1snyq7I7e6CJooQM279QAAAMk"]
[Sun Apr 26 09:38:40.549560 2026] [:error] [pid 8390:tid 8475] [client 74.248.33.118:53295] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "ae1soIGPtFK_i9p5yxRj0gAAAJg"]
[Sun Apr 26 09:38:41.868501 2026] [:error] [pid 8383:tid 8414] [client 74.248.33.118:39134] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "ae1sodFa2S3EsATMdWPaNAAAABE"]
[Sun Apr 26 09:38:43.469570 2026] [:error] [pid 22573:tid 22620] [client 74.248.33.118:46156] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "ae1so3B3EmQlD4yKUt9MawAAAY0"]
[Sun Apr 26 09:38:44.923393 2026] [:error] [pid 13197:tid 13245] [client 74.248.33.118:56889] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bs1.php"] [unique_id "ae1spN3kktFKdSxTrBuhSQAAAs0"]
[Sun Apr 26 09:38:46.565178 2026] [:error] [pid 13197:tid 13255] [client 74.248.33.118:39114] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1spt3kktFKdSxTrBuhTAAAAtc"]
[Sun Apr 26 09:38:47.794622 2026] [:error] [pid 13197:tid 13240] [client 74.248.33.118:2421] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1sp93kktFKdSxTrBuhUQAAAsk"]
[Sun Apr 26 09:38:49.295802 2026] [:error] [pid 8385:tid 8426] [client 74.248.33.118:18749] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1sqTOy7_J84Wx3-oyE5AAAAEI"]
[Sun Apr 26 09:38:50.470721 2026] [:error] [pid 8491:tid 8519] [client 74.248.33.118:18711] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1sqiq7I7e6CJooQM28EAAAANQ"]
[Sun Apr 26 09:38:51.823631 2026] [:error] [pid 13137:tid 13155] [client 74.248.33.118:46192] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "ae1sq90RB4J0o4h5neEDZgAAAg4"]
[Sun Apr 26 09:38:53.316057 2026] [:error] [pid 8390:tid 8463] [client 74.248.33.118:56836] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "ae1srYGPtFK_i9p5yxRj4wAAAIw"]
[Sun Apr 26 09:38:54.561620 2026] [:error] [pid 8390:tid 8473] [client 74.248.33.118:47594] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "ae1sroGPtFK_i9p5yxRj5gAAAJY"]
[Sun Apr 26 09:38:55.311016 2026] [:error] [pid 22573:tid 22625] [client 74.248.33.118:2899] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/axx.php"] [unique_id "ae1sr3B3EmQlD4yKUt9MdwAAAZI"]
[Sun Apr 26 09:38:56.102108 2026] [:error] [pid 22573:tid 22621] [client 74.248.33.118:46187] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ae1ssHB3EmQlD4yKUt9MfQAAAY4"]
[Sun Apr 26 09:38:57.067478 2026] [:error] [pid 8390:tid 8457] [client 74.248.33.118:56918] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ae1ssYGPtFK_i9p5yxRj6gAAAIY"]
[Sun Apr 26 09:38:58.874462 2026] [:error] [pid 22572:tid 22588] [client 74.248.33.118:47605] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ae1sstXOViWCFU-pZzCW8wAAAUo"]
[Sun Apr 26 09:39:00.604006 2026] [:error] [pid 16515:tid 16539] [client 74.248.33.118:2928] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ae1stFtDrUmgHSvpuLzisAAAAlU"]
[Sun Apr 26 09:39:02.432490 2026] [:error] [pid 16515:tid 16536] [client 74.248.33.118:53760] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "ae1stltDrUmgHSvpuLzitAAAAlI"]
[Sun Apr 26 09:39:04.217842 2026] [:error] [pid 22572:tid 22601] [client 74.248.33.118:20936] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "ae1suNXOViWCFU-pZzCW9wAAAVc"]
[Sun Apr 26 09:39:05.965951 2026] [:error] [pid 13197:tid 13240] [client 74.248.33.118:18745] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "ae1sud3kktFKdSxTrBuhbAAAAsk"]
[Sun Apr 26 09:39:07.065020 2026] [:error] [pid 22572:tid 22582] [client 74.248.33.118:56945] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "ae1su9XOViWCFU-pZzCW_AAAAUQ"]
[Sun Apr 26 09:39:09.603936 2026] [:error] [pid 8390:tid 8463] [client 74.248.33.118:14857] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "ae1svYGPtFK_i9p5yxRkDAAAAIw"]
[Sun Apr 26 09:39:11.733642 2026] [:error] [pid 22573:tid 22612] [client 74.248.33.118:41899] [client 74.248.33.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file48.php"] [unique_id "ae1sv3B3EmQlD4yKUt9MlAAAAYY"]
[Sun Apr 26 09:39:13.167683 2026] [:error] [pid 16574:tid 16607] [client 74.248.33.118:39147] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Sun Apr 26 09:39:13.733845 2026] [:error] [pid 16574:tid 16631] [client 74.248.33.118:39147] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Apr 26 09:39:14.019863 2026] [:error] [pid 16574:tid 16614] [client 74.248.33.118:39147] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Sun Apr 26 09:39:14.306004 2026] [:error] [pid 16574:tid 16613] [client 74.248.33.118:39147] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Sun Apr 26 09:39:14.596830 2026] [:error] [pid 16574:tid 16612] [client 74.248.33.118:39147] File does not exist: /usr/local/apache/htdocs/suspended-page/hypo.php
[Sun Apr 26 09:39:15.318843 2026] [:error] [pid 16574:tid 16612] [client 74.248.33.118:39147] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Sun Apr 26 09:39:15.615692 2026] [:error] [pid 16574:tid 16623] [client 74.248.33.118:39147] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sun Apr 26 09:39:16.189768 2026] [:error] [pid 16574:tid 16639] [client 74.248.33.118:39147] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Apr 26 11:34:15.864610 2026] [:error] [pid 8390:tid 8469] [client 20.207.194.44:7245] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Apr 26 11:34:16.151430 2026] [autoindex:error] [pid 8390:tid 8470] [client 20.207.194.44:7245] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 11:34:17.175475 2026] [:error] [pid 8390:tid 8462] [client 20.207.194.44:7245] [client 20.207.194.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/"] [unique_id "ae2HuYGPtFK_i9p5yxSmtAAAAIs"]
[Sun Apr 26 11:34:17.773485 2026] [:error] [pid 8390:tid 8464] [client 20.207.194.44:7251] [client 20.207.194.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/"] [unique_id "ae2HuYGPtFK_i9p5yxSmtQAAAI0"]
[Sun Apr 26 11:34:18.359329 2026] [:error] [pid 22573:tid 22625] [client 20.207.194.44:7314] [client 20.207.194.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/"] [unique_id "ae2HunB3EmQlD4yKUt95dwAAAZI"]
[Sun Apr 26 11:34:18.968932 2026] [:error] [pid 22573:tid 22608] [client 20.207.194.44:7262] [client 20.207.194.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/"] [unique_id "ae2HunB3EmQlD4yKUt95egAAAYI"]
[Sun Apr 26 13:04:27.676809 2026] [:error] [pid 8390:tid 8466] [client 45.45.237.225:46124] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "ae2c24GPtFK_i9p5yxTIvAAAAI8"]
[Sun Apr 26 13:04:28.165247 2026] [:error] [pid 13137:tid 13157] [client 45.45.237.225:45720] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.bak"] [unique_id "ae2c3N0RB4J0o4h5neEvoQAAAhA"]
[Sun Apr 26 13:04:28.174919 2026] [:error] [pid 8383:tid 8400] [client 45.45.237.225:45744] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "ae2c3NFa2S3EsATMdWPsdgAAAAM"]
[Sun Apr 26 13:04:28.178742 2026] [:error] [pid 8383:tid 8397] [client 45.45.237.225:45728] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-config.php"] [unique_id "ae2c3NFa2S3EsATMdWPsdwAAAAA"]
[Sun Apr 26 13:04:28.210988 2026] [:error] [pid 8491:tid 8501] [client 45.45.237.225:45748] [client 45.45.237.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.json"] [unique_id "ae2c3Cq7I7e6CJooQM3WigAAAMI"]
[Sun Apr 26 13:04:28.211114 2026] [:error] [pid 8383:tid 8415] [client 45.45.237.225:45736] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.old"] [unique_id "ae2c3NFa2S3EsATMdWPseAAAABI"]
[Sun Apr 26 13:04:28.222621 2026] [:error] [pid 13197:tid 13237] [client 45.45.237.225:45764] [client 45.45.237.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.js"] [unique_id "ae2c3N3kktFKdSxTrBu2PgAAAsY"]
[Sun Apr 26 13:04:28.223533 2026] [:error] [pid 8383:tid 8417] [client 45.45.237.225:45774] [client 45.45.237.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/config.yml"] [unique_id "ae2c3NFa2S3EsATMdWPseQAAABQ"]
[Sun Apr 26 13:04:28.224292 2026] [:error] [pid 8383:tid 8401] [client 45.45.237.225:45718] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "ae2c3NFa2S3EsATMdWPsegAAAAQ"]
[Sun Apr 26 13:04:28.224911 2026] [:error] [pid 8383:tid 8416] [client 45.45.237.225:45754] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-config.php.bak"] [unique_id "ae2c3NFa2S3EsATMdWPsewAAABM"]
[Sun Apr 26 13:04:28.867672 2026] [:error] [pid 8385:tid 8438] [client 45.45.237.225:45948] [client 45.45.237.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ae2c3DOy7_J84Wx3-oyjBQAAAE4"]
[Sun Apr 26 13:04:28.906720 2026] [:error] [pid 8390:tid 8463] [client 45.45.237.225:45934] [client 45.45.237.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application.yml"] [unique_id "ae2c3IGPtFK_i9p5yxTI0gAAAIw"]
[Sun Apr 26 15:02:46.953897 2026] [:error] [pid 22573:tid 22626] [client 20.205.203.30:11203] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Sun Apr 26 15:02:48.241437 2026] [:error] [pid 22573:tid 22606] [client 20.205.203.30:11203] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sun Apr 26 15:02:48.351669 2026] [:error] [pid 22573:tid 22624] [client 20.205.203.30:11203] [client 20.205.203.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.205.203.30, incrementing ddos counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "ae24mHB3EmQlD4yKUt-0HQAAAZE"]
[Sun Apr 26 15:02:48.355001 2026] [:error] [pid 22573:tid 22624] [client 20.205.203.30:11203] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 26 15:02:48.442370 2026] [:error] [pid 22573:tid 22610] [client 20.205.203.30:11203] [client 20.205.203.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php8.php"] [unique_id "ae24mHB3EmQlD4yKUt-0HwAAAYQ"]
[Sun Apr 26 15:02:48.817399 2026] [:error] [pid 13197:tid 13236] [client 20.205.203.30:12681] [client 20.205.203.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php8.php"] [unique_id "ae24mN3kktFKdSxTrBu-gwAAAsU"]
[Sun Apr 26 15:02:49.201520 2026] [:error] [pid 22573:tid 22615] [client 20.205.203.30:11168] [client 20.205.203.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php8.php"] [unique_id "ae24mXB3EmQlD4yKUt-0IQAAAYg"]
[Sun Apr 26 15:02:49.593359 2026] [:error] [pid 22572:tid 22599] [client 20.205.203.30:11164] [client 20.205.203.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php8.php"] [unique_id "ae24mdXOViWCFU-pZzDrggAAAVU"]
[Mon Apr 27 01:45:29.981163 2026] [:error] [pid 8383:tid 8414] [client 20.255.80.192:3278] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Apr 27 01:45:30.105021 2026] [:error] [pid 8383:tid 8401] [client 20.255.80.192:3278] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Apr 27 01:45:30.350763 2026] [:error] [pid 8383:tid 8415] [client 20.255.80.192:3278] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Apr 27 01:45:30.482194 2026] [:error] [pid 8383:tid 8420] [client 20.255.80.192:3278] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 27 01:45:30.728041 2026] [:error] [pid 8383:tid 8409] [client 20.255.80.192:3278] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Apr 27 01:45:30.851018 2026] [:error] [pid 8383:tid 8421] [client 20.255.80.192:3278] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Apr 27 01:45:30.973338 2026] [:error] [pid 8383:tid 8402] [client 20.255.80.192:3278] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Apr 27 01:45:31.365475 2026] [:error] [pid 8383:tid 8408] [client 20.255.80.192:3278] [client 20.255.80.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae5PO9Fa2S3EsATMdWOwqAAAAAs"]
[Mon Apr 27 01:45:31.854958 2026] [:error] [pid 22572:tid 22591] [client 20.255.80.192:3273] [client 20.255.80.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae5PO9XOViWCFU-pZzBdugAAAU0"]
[Mon Apr 27 01:45:32.359455 2026] [:error] [pid 8390:tid 8460] [client 20.255.80.192:3284] [client 20.255.80.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae5PPIGPtFK_i9p5yxTEdAAAAIk"]
[Mon Apr 27 01:45:32.838998 2026] [:error] [pid 22572:tid 22585] [client 20.255.80.192:3149] [client 20.255.80.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae5PPNXOViWCFU-pZzBduwAAAUc"]
[Mon Apr 27 03:09:18.380093 2026] [:error] [pid 22573:tid 22621] [client 4.193.118.98:6375] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Apr 27 03:09:18.471598 2026] [:error] [pid 22573:tid 22620] [client 4.193.118.98:6375] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Apr 27 03:09:18.654007 2026] [:error] [pid 22573:tid 22606] [client 4.193.118.98:6375] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Apr 27 03:09:18.745547 2026] [:error] [pid 22573:tid 22627] [client 4.193.118.98:6375] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 27 03:09:18.955734 2026] [:error] [pid 22573:tid 22613] [client 4.193.118.98:6375] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Apr 27 03:09:19.054570 2026] [:error] [pid 22573:tid 22618] [client 4.193.118.98:6375] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Apr 27 03:09:19.144469 2026] [:error] [pid 22573:tid 22616] [client 4.193.118.98:6375] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Apr 27 03:09:19.440497 2026] [:error] [pid 22573:tid 22612] [client 4.193.118.98:6375] [client 4.193.118.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae5i33B3EmQlD4yKUt9GkwAAAYY"]
[Mon Apr 27 03:09:19.797709 2026] [:error] [pid 13197:tid 13236] [client 4.193.118.98:6360] [client 4.193.118.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae5i393kktFKdSxTrBv7IQAAAsU"]
[Mon Apr 27 03:09:20.172806 2026] [:error] [pid 16574:tid 16619] [client 4.193.118.98:6370] [client 4.193.118.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae5i4H5MsX8wRQr99nZW5QAAA0w"]
[Mon Apr 27 03:09:20.530618 2026] [:error] [pid 22573:tid 22608] [client 4.193.118.98:6399] [client 4.193.118.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae5i4HB3EmQlD4yKUt9GlAAAAYI"]
[Mon Apr 27 11:58:13.569286 2026] [:error] [pid 55881:tid 55923] [client 20.255.80.192:3100] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Mon Apr 27 11:58:14.079620 2026] [:error] [pid 55881:tid 55932] [client 20.255.80.192:3100] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Mon Apr 27 11:58:14.335569 2026] [:error] [pid 55881:tid 55934] [client 20.255.80.192:3100] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Mon Apr 27 11:58:14.466818 2026] [:error] [pid 55881:tid 55927] [client 20.255.80.192:3100] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Apr 27 11:58:14.595188 2026] [:error] [pid 55881:tid 55928] [client 20.255.80.192:3100] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Mon Apr 27 11:58:14.719752 2026] [:error] [pid 55881:tid 55929] [client 20.255.80.192:3100] [client 20.255.80.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "ae7e1pw4Xkh9-1_nCVigKAAAANE"]
[Mon Apr 27 11:58:15.261789 2026] [:error] [pid 55967:tid 55988] [client 20.255.80.192:3101] [client 20.255.80.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "ae7e15qILaJi17iamABuJwAAABM"]
[Mon Apr 27 11:58:15.755413 2026] [:error] [pid 55882:tid 55959] [client 20.255.80.192:3122] [client 20.255.80.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "ae7e1xT-oLgX4cIe87MlWAAAAVQ"]
[Mon Apr 27 11:58:16.280568 2026] [:error] [pid 55881:tid 55916] [client 20.255.80.192:3223] [client 20.255.80.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "ae7e2Jw4Xkh9-1_nCVigKQAAAMQ"]
[Mon Apr 27 13:44:44.496919 2026] [:error] [pid 62509:tid 62540] [client 4.193.118.98:3330] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Mon Apr 27 13:44:44.895181 2026] [:error] [pid 62509:tid 62514] [client 4.193.118.98:3330] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Mon Apr 27 13:44:45.080321 2026] [:error] [pid 62509:tid 62535] [client 4.193.118.98:3330] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Mon Apr 27 13:44:45.173922 2026] [:error] [pid 62509:tid 62529] [client 4.193.118.98:3330] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Apr 27 13:44:45.265693 2026] [:error] [pid 62509:tid 62518] [client 4.193.118.98:3330] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Mon Apr 27 13:44:45.354511 2026] [:error] [pid 62509:tid 62532] [client 4.193.118.98:3330] [client 4.193.118.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "ae73zdwtbauadMz70GGDAwAAAJA"]
[Mon Apr 27 13:44:45.743082 2026] [:error] [pid 62509:tid 62527] [client 4.193.118.98:4078] [client 4.193.118.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "ae73zdwtbauadMz70GGDBgAAAIs"]
[Mon Apr 27 13:44:46.109541 2026] [:error] [pid 62607:tid 62616] [client 4.193.118.98:4077] [client 4.193.118.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "ae73zoXk80_zcPo33verXAAAAEc"]
[Mon Apr 27 13:44:46.468836 2026] [:error] [pid 62607:tid 62612] [client 4.193.118.98:4038] [client 4.193.118.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "ae73zoXk80_zcPo33verXQAAAEM"]
[Mon Apr 27 22:56:28.192021 2026] [:error] [pid 13464:tid 13481] [client 4.193.121.6:14473] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Apr 27 22:56:28.372643 2026] [:error] [pid 13464:tid 13475] [client 4.193.121.6:14473] [client 4.193.121.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.193.121.6, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ae95HGIEa0q6oQ95zvE3IwAAAcc"]
[Mon Apr 27 22:56:28.468345 2026] [:error] [pid 13464:tid 13480] [client 4.193.121.6:14473] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Mon Apr 27 22:56:28.838702 2026] [:error] [pid 13464:tid 13474] [client 4.193.121.6:14473] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Mon Apr 27 22:56:29.119535 2026] [:error] [pid 13464:tid 13468] [client 4.193.121.6:14473] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Mon Apr 27 22:56:29.208567 2026] [:error] [pid 13464:tid 13479] [client 4.193.121.6:14473] [client 4.193.121.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae95HWIEa0q6oQ95zvE3LQAAAcs"]
[Mon Apr 27 22:56:29.569458 2026] [:error] [pid 31555:tid 31557] [client 4.193.121.6:14514] [client 4.193.121.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae95HbJDZf3DNaSMAJ114wAAAAA"]
[Mon Apr 27 22:56:29.944384 2026] [:error] [pid 13523:tid 13536] [client 4.193.121.6:14523] [client 4.193.121.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae95Heeav51IXKv1ebET0gAAAIs"]
[Mon Apr 27 22:56:30.338349 2026] [:error] [pid 31555:tid 31574] [client 4.193.121.6:14518] [client 4.193.121.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae95HrJDZf3DNaSMAJ115QAAABE"]
[Tue Apr 28 05:07:11.455643 2026] [:error] [pid 14686:tid 14700] [client 20.100.183.137:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 28 05:07:11.719777 2026] [:error] [pid 14686:tid 14706] [client 20.100.183.137:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Apr 28 05:07:12.351389 2026] [:error] [pid 14686:tid 14709] [client 20.100.183.137:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Apr 28 05:07:12.622562 2026] [:error] [pid 14686:tid 14710] [client 20.100.183.137:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 28 05:07:13.155090 2026] [:error] [pid 14686:tid 14691] [client 20.100.183.137:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue Apr 28 05:07:13.419666 2026] [:error] [pid 14686:tid 14701] [client 20.100.183.137:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Apr 28 05:07:13.684554 2026] [:error] [pid 14686:tid 14694] [client 20.100.183.137:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue Apr 28 05:07:14.497460 2026] [:error] [pid 14686:tid 14707] [client 20.100.183.137:14471] [client 20.100.183.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae_QAu-YPF1Xm7uiWQ4enwAAANI"]
[Tue Apr 28 05:07:15.559922 2026] [:error] [pid 14577:tid 14587] [client 20.100.183.137:7213] [client 20.100.183.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae_QAyzBH-jwzlgiBdGqAwAAAAE"]
[Tue Apr 28 05:07:16.653906 2026] [:error] [pid 56602:tid 56613] [client 20.100.183.137:7206] [client 20.100.183.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae_QBPCwhMxzNW_lZSwc6QAAAQk"]
[Tue Apr 28 05:07:17.725910 2026] [:error] [pid 14577:tid 14593] [client 20.100.183.137:13798] [client 20.100.183.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "ae_QBSzBH-jwzlgiBdGqBAAAAAc"]
[Tue Apr 28 06:11:56.116909 2026] [:error] [pid 56602:tid 56605] [client 4.193.121.6:11776] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Apr 28 06:11:56.297982 2026] [:error] [pid 56602:tid 56614] [client 4.193.121.6:11776] [client 4.193.121.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.193.121.6, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ae_fLPCwhMxzNW_lZSw1GAAAAQo"]
[Tue Apr 28 06:11:56.396082 2026] [:error] [pid 56602:tid 56612] [client 4.193.121.6:11776] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Tue Apr 28 06:11:56.785552 2026] [:error] [pid 56602:tid 56610] [client 4.193.121.6:11776] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Tue Apr 28 06:11:57.063073 2026] [:error] [pid 56602:tid 56619] [client 4.193.121.6:11776] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Apr 28 06:11:57.151849 2026] [:error] [pid 56602:tid 56628] [client 4.193.121.6:11776] [client 4.193.121.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae_fLfCwhMxzNW_lZSw1IwAAARg"]
[Tue Apr 28 06:11:57.508249 2026] [:error] [pid 14579:tid 14649] [client 4.193.121.6:11805] [client 4.193.121.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae_fLRrUiOG83qKKuuDx1QAAAIk"]
[Tue Apr 28 06:11:57.879347 2026] [:error] [pid 14577:tid 14602] [client 4.193.121.6:9035] [client 4.193.121.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae_fLSzBH-jwzlgiBdG0IgAAABA"]
[Tue Apr 28 06:11:58.235433 2026] [:error] [pid 14579:tid 14644] [client 4.193.121.6:2374] [client 4.193.121.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae_fLhrUiOG83qKKuuDx1gAAAIQ"]
[Tue Apr 28 14:08:10.045714 2026] [:error] [pid 33776:tid 33812] [client 20.100.183.137:4321] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Apr 28 14:08:11.174044 2026] [:error] [pid 33776:tid 33813] [client 20.100.183.137:4321] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Tue Apr 28 14:08:13.187596 2026] [:error] [pid 33776:tid 33822] [client 20.100.183.137:4321] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Tue Apr 28 14:08:13.451296 2026] [:error] [pid 33776:tid 33827] [client 20.100.183.137:4321] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Apr 28 14:08:13.716679 2026] [:error] [pid 33776:tid 33828] [client 20.100.183.137:4321] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Tue Apr 28 14:08:13.977489 2026] [:error] [pid 33776:tid 33811] [client 20.100.183.137:4321] [client 20.100.183.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "afBOzV-bEJ2CKP3iKAD9cgAAAEM"]
[Tue Apr 28 14:08:15.082352 2026] [:error] [pid 33777:tid 33854] [client 20.100.183.137:22788] [client 20.100.183.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "afBOz7XUCFWqmordGGJNRAAAARM"]
[Tue Apr 28 14:08:16.429092 2026] [:error] [pid 33777:tid 33850] [client 20.100.183.137:22809] [client 20.100.183.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "afBO0LXUCFWqmordGGJNRwAAAQ8"]
[Tue Apr 28 14:08:17.598202 2026] [:error] [pid 33777:tid 33858] [client 20.100.183.137:19730] [client 20.100.183.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/120f9.php"] [unique_id "afBO0bXUCFWqmordGGJNSAAAARc"]
[Tue Apr 28 23:58:46.599331 2026] [:error] [pid 2741:tid 2750] [client 34.11.130.72:35458] [client 34.11.130.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "afDZNvp92FeOz1h6ILwtAAAAAUQ"]
[Wed Apr 29 06:56:26.960500 2026] [:error] [pid 26594:tid 26614] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Wed Apr 29 06:56:28.248143 2026] [:error] [pid 26594:tid 26614] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-x7.php
[Wed Apr 29 06:56:28.461355 2026] [:error] [pid 26594:tid 26620] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Wed Apr 29 06:56:28.676716 2026] [:error] [pid 26594:tid 26597] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/AxAo.php
[Wed Apr 29 06:56:28.867873 2026] [:error] [pid 26594:tid 26599] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/siln.php
[Wed Apr 29 06:56:29.061433 2026] [:error] [pid 26594:tid 26605] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Wed Apr 29 06:56:29.265899 2026] [:error] [pid 26594:tid 26603] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/about3.php
[Wed Apr 29 06:56:29.455144 2026] [:error] [pid 26594:tid 26607] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/raw.php
[Wed Apr 29 06:56:29.670766 2026] [:error] [pid 26594:tid 26596] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/puvil.php
[Wed Apr 29 06:56:29.867487 2026] [:error] [pid 26594:tid 26609] [client 52.230.176.21:51596] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Wed Apr 29 06:56:30.225398 2026] [:error] [pid 26594:tid 26600] [client 52.230.176.21:51596] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tmpls.php"] [unique_id "afE7Hts-37Kay1vO52k39QAAAQQ"]
[Wed Apr 29 06:56:31.590834 2026] [:error] [pid 56756:tid 56814] [client 52.230.176.21:51288] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tmpls.php"] [unique_id "afE7H3Di78vq-l2wwMwRcwAAAFY"]
[Wed Apr 29 06:56:32.658410 2026] [:error] [pid 26594:tid 26611] [client 52.230.176.21:10139] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tmpls.php"] [unique_id "afE7INs-37Kay1vO52k39wAAAQ8"]
[Wed Apr 29 06:56:34.143068 2026] [:error] [pid 56863:tid 56882] [client 52.230.176.21:10187] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tmpls.php"] [unique_id "afE7ImQQTEnvYCOsiwLcdgAAANE"]
[Wed Apr 29 06:56:35.258770 2026] [:error] [pid 26594:tid 26615] [client 52.230.176.21:51608] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3.php"] [unique_id "afE7I9s-37Kay1vO52k3-QAAARM"]
[Wed Apr 29 06:56:36.431722 2026] [:error] [pid 56757:tid 56838] [client 52.230.176.21:51607] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3.php"] [unique_id "afE7JPj76quHaaG1miSWCgAAAJM"]
[Wed Apr 29 06:56:37.637938 2026] [:error] [pid 56755:tid 56766] [client 52.230.176.21:10228] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3.php"] [unique_id "afE7JfdXjiwtyGfj4lxMIAAAAAI"]
[Wed Apr 29 06:56:38.968201 2026] [:error] [pid 56756:tid 56795] [client 52.230.176.21:51284] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/n3.php"] [unique_id "afE7JnDi78vq-l2wwMwRdgAAAEM"]
[Wed Apr 29 06:56:40.449405 2026] [:error] [pid 40313:tid 40318] [client 52.230.176.21:51305] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-aaa.php"] [unique_id "afE7KKpx5sKFuV9bHzpY0QAAAUM"]
[Wed Apr 29 06:56:42.085819 2026] [:error] [pid 56863:tid 56872] [client 52.230.176.21:10120] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-aaa.php"] [unique_id "afE7KmQQTEnvYCOsiwLcggAAAMc"]
[Wed Apr 29 06:56:43.586157 2026] [:error] [pid 40344:tid 40391] [client 52.230.176.21:51285] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-aaa.php"] [unique_id "afE7K5_iiwb4cHXz-JoBTQAAAdA"]
[Wed Apr 29 06:56:44.552190 2026] [:error] [pid 56863:tid 56888] [client 52.230.176.21:10118] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-aaa.php"] [unique_id "afE7LGQQTEnvYCOsiwLcigAAANc"]
[Wed Apr 29 06:56:45.605415 2026] [:error] [pid 40344:tid 40389] [client 52.230.176.21:51585] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afE7LZ_iiwb4cHXz-JoBUgAAAc4"]
[Wed Apr 29 06:56:47.103389 2026] [:error] [pid 56756:tid 56808] [client 52.230.176.21:10136] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afE7L3Di78vq-l2wwMwRegAAAFA"]
[Wed Apr 29 06:56:48.474532 2026] [:error] [pid 40344:tid 40384] [client 52.230.176.21:51622] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afE7MJ_iiwb4cHXz-JoBWQAAAck"]
[Wed Apr 29 06:56:49.570967 2026] [:error] [pid 40344:tid 40390] [client 52.230.176.21:10208] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afE7MZ_iiwb4cHXz-JoBXgAAAc8"]
[Wed Apr 29 06:56:51.501198 2026] [:error] [pid 56756:tid 56802] [client 52.230.176.21:9922] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mo.php"] [unique_id "afE7M3Di78vq-l2wwMwRewAAAEo"]
[Wed Apr 29 06:56:52.641102 2026] [:error] [pid 26594:tid 26605] [client 52.230.176.21:51303] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mo.php"] [unique_id "afE7NNs-37Kay1vO52k3_wAAAQk"]
[Wed Apr 29 06:56:53.962724 2026] [:error] [pid 56863:tid 56888] [client 52.230.176.21:51625] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mo.php"] [unique_id "afE7NWQQTEnvYCOsiwLclgAAANc"]
[Wed Apr 29 06:56:58.019585 2026] [:error] [pid 56757:tid 56834] [client 52.230.176.21:51314] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mo.php"] [unique_id "afE7Ovj76quHaaG1miSWDAAAAI8"]
[Wed Apr 29 06:56:58.890350 2026] [:error] [pid 56756:tid 56810] [client 52.230.176.21:9927] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file5.php"] [unique_id "afE7OnDi78vq-l2wwMwRfQAAAFI"]
[Wed Apr 29 06:57:00.461605 2026] [:error] [pid 40344:tid 40385] [client 52.230.176.21:10203] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file5.php"] [unique_id "afE7PJ_iiwb4cHXz-JoBZQAAAco"]
[Wed Apr 29 06:57:01.263495 2026] [:error] [pid 40344:tid 40395] [client 52.230.176.21:51321] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file5.php"] [unique_id "afE7PZ_iiwb4cHXz-JoBZgAAAdQ"]
[Wed Apr 29 06:57:02.056046 2026] [:error] [pid 40343:tid 40356] [client 52.230.176.21:51319] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file5.php"] [unique_id "afE7PmiaWCZjSxz2ZNtybwAAAYk"]
[Wed Apr 29 06:57:03.517358 2026] [:error] [pid 40343:tid 40366] [client 52.230.176.21:10115] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xrm.php"] [unique_id "afE7P2iaWCZjSxz2ZNtycAAAAZI"]
[Wed Apr 29 06:57:04.665293 2026] [:error] [pid 56757:tid 56839] [client 52.230.176.21:51327] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xrm.php"] [unique_id "afE7QPj76quHaaG1miSWEAAAAJQ"]
[Wed Apr 29 06:57:06.392558 2026] [:error] [pid 40344:tid 40392] [client 52.230.176.21:10202] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xrm.php"] [unique_id "afE7Qp_iiwb4cHXz-JoBbgAAAdE"]
[Wed Apr 29 06:57:07.063828 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:51620] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xrm.php"] [unique_id "afE7Q5_iiwb4cHXz-JoBbwAAAcQ"]
[Wed Apr 29 06:57:08.075846 2026] [:error] [pid 40313:tid 40334] [client 52.230.176.21:10155] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asudo.php"] [unique_id "afE7RKpx5sKFuV9bHzpY2QAAAVM"]
[Wed Apr 29 06:57:08.647450 2026] [:error] [pid 26594:tid 26618] [client 52.230.176.21:51296] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asudo.php"] [unique_id "afE7RNs-37Kay1vO52k4BAAAARY"]
[Wed Apr 29 06:57:09.405783 2026] [:error] [pid 40344:tid 40398] [client 52.230.176.21:51619] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asudo.php"] [unique_id "afE7RZ_iiwb4cHXz-JoBcgAAAdc"]
[Wed Apr 29 06:57:10.309032 2026] [:error] [pid 40344:tid 40384] [client 52.230.176.21:10146] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asudo.php"] [unique_id "afE7Rp_iiwb4cHXz-JoBdQAAAck"]
[Wed Apr 29 06:57:11.279073 2026] [:error] [pid 40344:tid 40388] [client 52.230.176.21:51643] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wdone1.php"] [unique_id "afE7R5_iiwb4cHXz-JoBdwAAAc0"]
[Wed Apr 29 06:57:11.846816 2026] [:error] [pid 40344:tid 40386] [client 52.230.176.21:51595] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wdone1.php"] [unique_id "afE7R5_iiwb4cHXz-JoBeAAAAcs"]
[Wed Apr 29 06:57:13.105604 2026] [:error] [pid 40343:tid 40347] [client 52.230.176.21:10183] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wdone1.php"] [unique_id "afE7SWiaWCZjSxz2ZNtycgAAAYA"]
[Wed Apr 29 06:57:14.113274 2026] [:error] [pid 40344:tid 40380] [client 52.230.176.21:10152] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wdone1.php"] [unique_id "afE7Sp_iiwb4cHXz-JoBfAAAAcU"]
[Wed Apr 29 06:57:14.762836 2026] [:error] [pid 40344:tid 40376] [client 52.230.176.21:51315] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file3.php"] [unique_id "afE7Sp_iiwb4cHXz-JoBfQAAAcE"]
[Wed Apr 29 06:57:15.389732 2026] [:error] [pid 40344:tid 40382] [client 52.230.176.21:51617] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file3.php"] [unique_id "afE7S5_iiwb4cHXz-JoBfwAAAcc"]
[Wed Apr 29 06:57:16.131225 2026] [:error] [pid 40313:tid 40337] [client 52.230.176.21:9920] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file3.php"] [unique_id "afE7TKpx5sKFuV9bHzpY2wAAAVY"]
[Wed Apr 29 06:57:16.781589 2026] [:error] [pid 40344:tid 40396] [client 52.230.176.21:10221] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file3.php"] [unique_id "afE7TJ_iiwb4cHXz-JoBgwAAAdU"]
[Wed Apr 29 06:57:17.966074 2026] [:error] [pid 40344:tid 40386] [client 52.230.176.21:9991] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "afE7TZ_iiwb4cHXz-JoBhQAAAcs"]
[Wed Apr 29 06:57:18.617866 2026] [:error] [pid 40344:tid 40381] [client 52.230.176.21:51316] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "afE7Tp_iiwb4cHXz-JoBhgAAAcY"]
[Wed Apr 29 06:57:19.841357 2026] [:error] [pid 40343:tid 40365] [client 52.230.176.21:10129] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "afE7T2iaWCZjSxz2ZNtycwAAAZE"]
[Wed Apr 29 06:57:20.987431 2026] [:error] [pid 56757:tid 56842] [client 52.230.176.21:51293] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "afE7UPj76quHaaG1miSWEQAAAJc"]
[Wed Apr 29 06:57:21.664272 2026] [:error] [pid 56756:tid 56795] [client 52.230.176.21:10226] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blox.php"] [unique_id "afE7UXDi78vq-l2wwMwRggAAAEM"]
[Wed Apr 29 06:57:22.913181 2026] [:error] [pid 26594:tid 26614] [client 52.230.176.21:51602] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blox.php"] [unique_id "afE7Uts-37Kay1vO52k4CgAAARI"]
[Wed Apr 29 06:57:24.026373 2026] [:error] [pid 56756:tid 56809] [client 52.230.176.21:51586] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blox.php"] [unique_id "afE7VHDi78vq-l2wwMwRgwAAAFE"]
[Wed Apr 29 06:57:24.921317 2026] [:error] [pid 40344:tid 40392] [client 52.230.176.21:51636] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blox.php"] [unique_id "afE7VJ_iiwb4cHXz-JoBiwAAAdE"]
[Wed Apr 29 06:57:25.846036 2026] [:error] [pid 40343:tid 40360] [client 52.230.176.21:51266] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "afE7VWiaWCZjSxz2ZNtydwAAAYw"]
[Wed Apr 29 06:57:26.634309 2026] [:error] [pid 40343:tid 40370] [client 52.230.176.21:51597] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "afE7VmiaWCZjSxz2ZNtyeQAAAZY"]
[Wed Apr 29 06:57:27.410991 2026] [:error] [pid 40313:tid 40327] [client 52.230.176.21:10185] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "afE7V6px5sKFuV9bHzpY3wAAAUw"]
[Wed Apr 29 06:57:27.961262 2026] [:error] [pid 40313:tid 40320] [client 52.230.176.21:51589] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wgift1.php"] [unique_id "afE7V6px5sKFuV9bHzpY4AAAAUU"]
[Wed Apr 29 06:57:28.856606 2026] [:error] [pid 26594:tid 26620] [client 52.230.176.21:51318] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zwso.php"] [unique_id "afE7WNs-37Kay1vO52k4CwAAARg"]
[Wed Apr 29 06:57:30.357088 2026] [:error] [pid 26594:tid 26607] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Apr 29 06:57:30.546177 2026] [:error] [pid 26594:tid 26603] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/gelap.php
[Wed Apr 29 06:57:30.762192 2026] [:error] [pid 26594:tid 26616] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/a1vx.php
[Wed Apr 29 06:57:31.005698 2026] [:error] [pid 26594:tid 26609] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Wed Apr 29 06:57:31.257652 2026] [:error] [pid 26594:tid 26600] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Apr 29 06:57:31.729653 2026] [:error] [pid 26594:tid 26611] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/oylki.php
[Wed Apr 29 06:57:31.920911 2026] [:error] [pid 26594:tid 26612] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/about25.php
[Wed Apr 29 06:57:32.128898 2026] [:error] [pid 26594:tid 26619] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/path.php
[Wed Apr 29 06:57:32.422489 2026] [:error] [pid 26594:tid 26608] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/r4f_1.php
[Wed Apr 29 06:57:32.611713 2026] [:error] [pid 26594:tid 26598] [client 52.230.176.21:51584] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Wed Apr 29 06:57:32.919306 2026] [:error] [pid 26594:tid 26601] [client 52.230.176.21:51584] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/33.php"] [unique_id "afE7XNs-37Kay1vO52k4GgAAAQU"]
[Wed Apr 29 06:57:33.702317 2026] [:error] [pid 56756:tid 56800] [client 52.230.176.21:51322] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/33.php"] [unique_id "afE7XXDi78vq-l2wwMwRhQAAAEg"]
[Wed Apr 29 06:57:34.894157 2026] [:error] [pid 26594:tid 26602] [client 52.230.176.21:51295] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/33.php"] [unique_id "afE7Xts-37Kay1vO52k4GwAAAQY"]
[Wed Apr 29 06:57:35.539260 2026] [:error] [pid 40343:tid 40361] [client 52.230.176.21:10122] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/33.php"] [unique_id "afE7X2iaWCZjSxz2ZNtyfgAAAY0"]
[Wed Apr 29 06:57:36.292807 2026] [:error] [pid 40313:tid 40328] [client 52.230.176.21:9932] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-gr.php"] [unique_id "afE7YKpx5sKFuV9bHzpY4wAAAU0"]
[Wed Apr 29 06:57:37.202523 2026] [:error] [pid 56863:tid 56884] [client 52.230.176.21:51286] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-gr.php"] [unique_id "afE7YWQQTEnvYCOsiwLcrQAAANM"]
[Wed Apr 29 06:57:37.916784 2026] [:error] [pid 40313:tid 40331] [client 52.230.176.21:10216] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-gr.php"] [unique_id "afE7Yapx5sKFuV9bHzpY5AAAAVA"]
[Wed Apr 29 06:57:38.605072 2026] [:error] [pid 56863:tid 56881] [client 52.230.176.21:10144] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-gr.php"] [unique_id "afE7YmQQTEnvYCOsiwLcrwAAANA"]
[Wed Apr 29 06:57:40.054353 2026] [:error] [pid 56863:tid 56875] [client 52.230.176.21:51302] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mans.php"] [unique_id "afE7ZGQQTEnvYCOsiwLcsAAAAMo"]
[Wed Apr 29 06:57:40.787381 2026] [:error] [pid 26594:tid 26616] [client 52.230.176.21:10128] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mans.php"] [unique_id "afE7ZNs-37Kay1vO52k4IAAAARQ"]
[Wed Apr 29 06:57:41.858570 2026] [:error] [pid 56755:tid 56768] [client 52.230.176.21:51647] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mans.php"] [unique_id "afE7ZfdXjiwtyGfj4lxMMwAAAAQ"]
[Wed Apr 29 06:57:43.134171 2026] [:error] [pid 40313:tid 40315] [client 52.230.176.21:51311] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mans.php"] [unique_id "afE7Z6px5sKFuV9bHzpY5gAAAUA"]
[Wed Apr 29 06:57:44.140849 2026] [:error] [pid 56755:tid 56766] [client 52.230.176.21:51590] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file30.php"] [unique_id "afE7aPdXjiwtyGfj4lxMOAAAAAI"]
[Wed Apr 29 06:57:45.632221 2026] [:error] [pid 56756:tid 56808] [client 52.230.176.21:10198] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file30.php"] [unique_id "afE7aXDi78vq-l2wwMwRhwAAAFA"]
[Wed Apr 29 06:57:46.359707 2026] [:error] [pid 56863:tid 56877] [client 52.230.176.21:10166] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file30.php"] [unique_id "afE7amQQTEnvYCOsiwLcsQAAAMw"]
[Wed Apr 29 06:57:46.952189 2026] [:error] [pid 56863:tid 56880] [client 52.230.176.21:9973] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file30.php"] [unique_id "afE7amQQTEnvYCOsiwLcsgAAAM8"]
[Wed Apr 29 06:57:47.706460 2026] [:error] [pid 40344:tid 40391] [client 52.230.176.21:51616] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxin.php"] [unique_id "afE7a5_iiwb4cHXz-JoBkwAAAdA"]
[Wed Apr 29 06:57:49.221418 2026] [:error] [pid 56863:tid 56874] [client 52.230.176.21:51631] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxin.php"] [unique_id "afE7bWQQTEnvYCOsiwLcswAAAMk"]
[Wed Apr 29 06:57:49.657014 2026] [:error] [pid 40344:tid 40376] [client 52.230.176.21:10215] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxin.php"] [unique_id "afE7bZ_iiwb4cHXz-JoBmQAAAcE"]
[Wed Apr 29 06:57:51.389509 2026] [:error] [pid 56863:tid 56878] [client 52.230.176.21:10219] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zxin.php"] [unique_id "afE7b2QQTEnvYCOsiwLctQAAAM0"]
[Wed Apr 29 06:57:52.333455 2026] [:error] [pid 56757:tid 56833] [client 52.230.176.21:10145] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dropdown.php"] [unique_id "afE7cPj76quHaaG1miSWEgAAAI4"]
[Wed Apr 29 06:57:53.912865 2026] [:error] [pid 40343:tid 40355] [client 52.230.176.21:10225] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dropdown.php"] [unique_id "afE7cWiaWCZjSxz2ZNtygAAAAYg"]
[Wed Apr 29 06:57:55.377816 2026] [:error] [pid 40343:tid 40354] [client 52.230.176.21:51269] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dropdown.php"] [unique_id "afE7c2iaWCZjSxz2ZNtyhAAAAYc"]
[Wed Apr 29 06:57:56.618484 2026] [:error] [pid 40343:tid 40362] [client 52.230.176.21:51593] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dropdown.php"] [unique_id "afE7dGiaWCZjSxz2ZNtyhgAAAY4"]
[Wed Apr 29 06:57:57.246683 2026] [:error] [pid 40344:tid 40397] [client 52.230.176.21:10204] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-at.php"] [unique_id "afE7dZ_iiwb4cHXz-JoBoAAAAdY"]
[Wed Apr 29 06:57:58.631787 2026] [:error] [pid 56755:tid 56781] [client 52.230.176.21:10229] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-at.php"] [unique_id "afE7dvdXjiwtyGfj4lxMOwAAABE"]
[Wed Apr 29 06:57:59.149584 2026] [:error] [pid 56863:tid 56889] [client 52.230.176.21:10195] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-at.php"] [unique_id "afE7d2QQTEnvYCOsiwLcuAAAANg"]
[Wed Apr 29 06:58:00.234332 2026] [:error] [pid 56863:tid 56865] [client 52.230.176.21:51629] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-at.php"] [unique_id "afE7eGQQTEnvYCOsiwLcuQAAAMA"]
[Wed Apr 29 06:58:00.842573 2026] [:error] [pid 56863:tid 56884] [client 52.230.176.21:10178] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hk.php"] [unique_id "afE7eGQQTEnvYCOsiwLcugAAANM"]
[Wed Apr 29 06:58:01.724829 2026] [:error] [pid 56756:tid 56813] [client 52.230.176.21:51646] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hk.php"] [unique_id "afE7eXDi78vq-l2wwMwRiAAAAFU"]
[Wed Apr 29 06:58:02.366649 2026] [:error] [pid 56755:tid 56777] [client 52.230.176.21:10234] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hk.php"] [unique_id "afE7evdXjiwtyGfj4lxMPQAAAA0"]
[Wed Apr 29 06:58:03.196040 2026] [:error] [pid 56863:tid 56875] [client 52.230.176.21:51601] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hk.php"] [unique_id "afE7e2QQTEnvYCOsiwLcvwAAAMo"]
[Wed Apr 29 06:58:03.682535 2026] [:error] [pid 40343:tid 40371] [client 52.230.176.21:51310] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lco.php"] [unique_id "afE7e2iaWCZjSxz2ZNtyiQAAAZc"]
[Wed Apr 29 06:58:04.157876 2026] [:error] [pid 56863:tid 56869] [client 52.230.176.21:9931] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lco.php"] [unique_id "afE7fGQQTEnvYCOsiwLcwQAAAMQ"]
[Wed Apr 29 06:58:05.307907 2026] [:error] [pid 40344:tid 40384] [client 52.230.176.21:9451] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lco.php"] [unique_id "afE7fZ_iiwb4cHXz-JoBoQAAAck"]
[Wed Apr 29 06:58:05.845829 2026] [:error] [pid 40343:tid 40353] [client 52.230.176.21:51309] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lco.php"] [unique_id "afE7fWiaWCZjSxz2ZNtyiwAAAYY"]
[Wed Apr 29 06:58:06.758306 2026] [:error] [pid 26594:tid 26602] [client 52.230.176.21:9932] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fun.php"] [unique_id "afE7fts-37Kay1vO52k4JwAAAQY"]
[Wed Apr 29 06:58:07.580574 2026] [:error] [pid 40344:tid 40381] [client 52.230.176.21:10050] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fun.php"] [unique_id "afE7f5_iiwb4cHXz-JoBowAAAcY"]
[Wed Apr 29 06:58:08.140040 2026] [:error] [pid 40344:tid 40377] [client 52.230.176.21:51320] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fun.php"] [unique_id "afE7gJ_iiwb4cHXz-JoBpAAAAcI"]
[Wed Apr 29 06:58:08.873656 2026] [:error] [pid 40343:tid 40355] [client 52.230.176.21:10159] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fun.php"] [unique_id "afE7gGiaWCZjSxz2ZNtyjQAAAYg"]
[Wed Apr 29 06:58:09.625619 2026] [:error] [pid 40344:tid 40389] [client 52.230.176.21:10080] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "afE7gZ_iiwb4cHXz-JoBpgAAAc4"]
[Wed Apr 29 06:58:10.334850 2026] [:error] [pid 56863:tid 56873] [client 52.230.176.21:9953] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "afE7gmQQTEnvYCOsiwLcxgAAAMg"]
[Wed Apr 29 06:58:11.289296 2026] [:error] [pid 56863:tid 56883] [client 52.230.176.21:51614] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "afE7g2QQTEnvYCOsiwLcyAAAANI"]
[Wed Apr 29 06:58:12.316333 2026] [:error] [pid 40343:tid 40368] [client 52.230.176.21:10135] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/0x.php"] [unique_id "afE7hGiaWCZjSxz2ZNtykQAAAZQ"]
[Wed Apr 29 06:58:12.761760 2026] [:error] [pid 56755:tid 56785] [client 52.230.176.21:10174] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/huyaa.php"] [unique_id "afE7hPdXjiwtyGfj4lxMQAAAABU"]
[Wed Apr 29 06:58:13.520119 2026] [:error] [pid 40313:tid 40320] [client 52.230.176.21:10059] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/huyaa.php"] [unique_id "afE7hapx5sKFuV9bHzpY7QAAAUU"]
[Wed Apr 29 06:58:14.415309 2026] [:error] [pid 40313:tid 40326] [client 52.230.176.21:51599] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/huyaa.php"] [unique_id "afE7hqpx5sKFuV9bHzpY7gAAAUs"]
[Wed Apr 29 06:58:14.951084 2026] [:error] [pid 56755:tid 56765] [client 52.230.176.21:9923] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/huyaa.php"] [unique_id "afE7hvdXjiwtyGfj4lxMQQAAAAE"]
[Wed Apr 29 06:58:15.805645 2026] [:error] [pid 56863:tid 56879] [client 52.230.176.21:10239] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/te.php"] [unique_id "afE7h2QQTEnvYCOsiwLczAAAAM4"]
[Wed Apr 29 06:58:16.554452 2026] [:error] [pid 56863:tid 56870] [client 52.230.176.21:10197] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/te.php"] [unique_id "afE7iGQQTEnvYCOsiwLczQAAAMU"]
[Wed Apr 29 06:58:17.368038 2026] [:error] [pid 40343:tid 40371] [client 52.230.176.21:9929] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/te.php"] [unique_id "afE7iWiaWCZjSxz2ZNtykwAAAZc"]
[Wed Apr 29 06:58:17.957780 2026] [:error] [pid 40343:tid 40363] [client 52.230.176.21:9950] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/te.php"] [unique_id "afE7iWiaWCZjSxz2ZNtylAAAAY8"]
[Wed Apr 29 06:58:18.689925 2026] [:error] [pid 56863:tid 56877] [client 52.230.176.21:9430] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "afE7imQQTEnvYCOsiwLc0QAAAMw"]
[Wed Apr 29 06:58:19.750111 2026] [:error] [pid 26594:tid 26606] [client 52.230.176.21:51275] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "afE7i9s-37Kay1vO52k4KAAAAQo"]
[Wed Apr 29 06:58:20.273587 2026] [:error] [pid 56756:tid 56812] [client 52.230.176.21:9869] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "afE7jHDi78vq-l2wwMwRiwAAAFQ"]
[Wed Apr 29 06:58:21.035115 2026] [:error] [pid 56756:tid 56796] [client 52.230.176.21:51638] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "afE7jXDi78vq-l2wwMwRjAAAAEQ"]
[Wed Apr 29 06:58:21.609543 2026] [:error] [pid 40343:tid 40356] [client 52.230.176.21:10179] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-2019.php"] [unique_id "afE7jWiaWCZjSxz2ZNtylgAAAYk"]
[Wed Apr 29 06:58:22.457669 2026] [:error] [pid 40343:tid 40366] [client 52.230.176.21:10207] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-2019.php"] [unique_id "afE7jmiaWCZjSxz2ZNtylwAAAZI"]
[Wed Apr 29 06:58:23.770946 2026] [:error] [pid 56755:tid 56784] [client 52.230.176.21:10218] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-2019.php"] [unique_id "afE7j_dXjiwtyGfj4lxMQgAAABQ"]
[Wed Apr 29 06:58:24.582309 2026] [:error] [pid 56756:tid 56811] [client 52.230.176.21:9413] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-2019.php"] [unique_id "afE7kHDi78vq-l2wwMwRjQAAAFM"]
[Wed Apr 29 06:58:25.752682 2026] [:error] [pid 40343:tid 40348] [client 52.230.176.21:9937] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/X57.php"] [unique_id "afE7kWiaWCZjSxz2ZNtymwAAAYE"]
[Wed Apr 29 06:58:26.849353 2026] [:error] [pid 40343:tid 40364] [client 52.230.176.21:10029] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/X57.php"] [unique_id "afE7kmiaWCZjSxz2ZNtynAAAAZA"]
[Wed Apr 29 06:58:27.694293 2026] [:error] [pid 40343:tid 40372] [client 52.230.176.21:9970] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/X57.php"] [unique_id "afE7k2iaWCZjSxz2ZNtynwAAAZg"]
[Wed Apr 29 06:58:28.349504 2026] [:error] [pid 40343:tid 40370] [client 52.230.176.21:10143] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/X57.php"] [unique_id "afE7lGiaWCZjSxz2ZNtyoQAAAZY"]
[Wed Apr 29 06:58:29.565962 2026] [:error] [pid 40343:tid 40349] [client 52.230.176.21:51312] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ah25.php"] [unique_id "afE7lWiaWCZjSxz2ZNtypAAAAYI"]
[Wed Apr 29 06:58:30.465316 2026] [:error] [pid 40343:tid 40371] [client 52.230.176.21:51626] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ah25.php"] [unique_id "afE7lmiaWCZjSxz2ZNtypQAAAZc"]
[Wed Apr 29 06:58:30.946622 2026] [:error] [pid 40343:tid 40369] [client 52.230.176.21:51273] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ah25.php"] [unique_id "afE7lmiaWCZjSxz2ZNtypwAAAZU"]
[Wed Apr 29 06:58:32.396054 2026] [:error] [pid 40313:tid 40324] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Wed Apr 29 06:58:32.603416 2026] [:error] [pid 40313:tid 40328] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Wed Apr 29 06:58:32.793023 2026] [:error] [pid 40313:tid 40331] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Wed Apr 29 06:58:32.984440 2026] [:error] [pid 40313:tid 40322] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Wed Apr 29 06:58:33.176309 2026] [:error] [pid 40313:tid 40315] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/sk25_1.php
[Wed Apr 29 06:58:33.370040 2026] [:error] [pid 40313:tid 40319] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/usep.php
[Wed Apr 29 06:58:33.561046 2026] [:error] [pid 40313:tid 40335] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Wed Apr 29 06:58:33.750921 2026] [:error] [pid 40313:tid 40316] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/v4.php
[Wed Apr 29 06:58:33.949041 2026] [:error] [pid 40313:tid 40334] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/wp4.php
[Wed Apr 29 06:58:34.139755 2026] [:error] [pid 40313:tid 40336] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 29 06:58:34.345954 2026] [:error] [pid 40313:tid 40329] [client 52.230.176.21:51612] File does not exist: /usr/local/apache/htdocs/suspended-page/mamzi.php
[Wed Apr 29 06:58:34.557715 2026] [:error] [pid 40313:tid 40337] [client 52.230.176.21:51612] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpls.php"] [unique_id "afE7mqpx5sKFuV9bHzpY-wAAAVY"]
[Wed Apr 29 06:58:35.761466 2026] [:error] [pid 56756:tid 56806] [client 52.230.176.21:51632] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpls.php"] [unique_id "afE7m3Di78vq-l2wwMwRkAAAAE4"]
[Wed Apr 29 06:58:36.517853 2026] [:error] [pid 56863:tid 56887] [client 52.230.176.21:10230] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpls.php"] [unique_id "afE7nGQQTEnvYCOsiwLc1gAAANY"]
[Wed Apr 29 06:58:37.195525 2026] [:error] [pid 56863:tid 56884] [client 52.230.176.21:51268] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpls.php"] [unique_id "afE7nWQQTEnvYCOsiwLc1wAAANM"]
[Wed Apr 29 06:58:38.103033 2026] [:error] [pid 40343:tid 40354] [client 52.230.176.21:51323] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xrp.php"] [unique_id "afE7nmiaWCZjSxz2ZNtyrQAAAYc"]
[Wed Apr 29 06:58:38.977182 2026] [:error] [pid 40343:tid 40352] [client 52.230.176.21:10224] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xrp.php"] [unique_id "afE7nmiaWCZjSxz2ZNtyrgAAAYU"]
[Wed Apr 29 06:58:39.523214 2026] [:error] [pid 40343:tid 40360] [client 52.230.176.21:51634] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xrp.php"] [unique_id "afE7n2iaWCZjSxz2ZNtysAAAAYw"]
[Wed Apr 29 06:58:40.189589 2026] [:error] [pid 56863:tid 56888] [client 52.230.176.21:10164] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xrp.php"] [unique_id "afE7oGQQTEnvYCOsiwLc2QAAANc"]
[Wed Apr 29 06:58:41.000789 2026] [:error] [pid 40343:tid 40363] [client 52.230.176.21:10003] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v2.php"] [unique_id "afE7oGiaWCZjSxz2ZNtysgAAAY8"]
[Wed Apr 29 06:58:42.005618 2026] [:error] [pid 40343:tid 40353] [client 52.230.176.21:51592] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v2.php"] [unique_id "afE7omiaWCZjSxz2ZNtytAAAAYY"]
[Wed Apr 29 06:58:42.693559 2026] [:error] [pid 40343:tid 40368] [client 52.230.176.21:51621] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v2.php"] [unique_id "afE7omiaWCZjSxz2ZNtytQAAAZQ"]
[Wed Apr 29 06:58:43.240941 2026] [:error] [pid 40344:tid 40397] [client 52.230.176.21:51627] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v2.php"] [unique_id "afE7o5_iiwb4cHXz-JoBrQAAAdY"]
[Wed Apr 29 06:58:43.937188 2026] [:error] [pid 56755:tid 56774] [client 52.230.176.21:10131] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-acc.php"] [unique_id "afE7o_dXjiwtyGfj4lxMQwAAAAo"]
[Wed Apr 29 06:58:44.721551 2026] [:error] [pid 56755:tid 56788] [client 52.230.176.21:51605] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-acc.php"] [unique_id "afE7pPdXjiwtyGfj4lxMRAAAABg"]
[Wed Apr 29 06:58:45.420170 2026] [:error] [pid 40344:tid 40384] [client 52.230.176.21:10217] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-acc.php"] [unique_id "afE7pZ_iiwb4cHXz-JoBrwAAAck"]
[Wed Apr 29 06:58:46.015523 2026] [:error] [pid 40343:tid 40366] [client 52.230.176.21:10167] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-acc.php"] [unique_id "afE7pmiaWCZjSxz2ZNtytgAAAZI"]
[Wed Apr 29 06:58:46.874013 2026] [:error] [pid 40343:tid 40347] [client 52.230.176.21:9966] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/333.php"] [unique_id "afE7pmiaWCZjSxz2ZNtyuAAAAYA"]
[Wed Apr 29 06:58:47.508564 2026] [:error] [pid 56863:tid 56877] [client 52.230.176.21:10106] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/333.php"] [unique_id "afE7p2QQTEnvYCOsiwLc2wAAAMw"]
[Wed Apr 29 06:58:48.160045 2026] [:error] [pid 56757:tid 56830] [client 52.230.176.21:10150] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/333.php"] [unique_id "afE7qPj76quHaaG1miSWFgAAAIs"]
[Wed Apr 29 06:58:48.909658 2026] [:error] [pid 56863:tid 56869] [client 52.230.176.21:10199] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/333.php"] [unique_id "afE7qGQQTEnvYCOsiwLc3AAAAMQ"]
[Wed Apr 29 06:58:49.703147 2026] [:error] [pid 56757:tid 56835] [client 52.230.176.21:51304] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/031.php"] [unique_id "afE7qfj76quHaaG1miSWGAAAAJA"]
[Wed Apr 29 06:58:50.495435 2026] [:error] [pid 40313:tid 40325] [client 52.230.176.21:9926] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/031.php"] [unique_id "afE7qqpx5sKFuV9bHzpY_gAAAUo"]
[Wed Apr 29 06:58:51.050244 2026] [:error] [pid 56863:tid 56871] [client 52.230.176.21:10190] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/031.php"] [unique_id "afE7q2QQTEnvYCOsiwLc4AAAAMY"]
[Wed Apr 29 06:58:51.747878 2026] [:error] [pid 40313:tid 40327] [client 52.230.176.21:9925] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/031.php"] [unique_id "afE7q6px5sKFuV9bHzpY_wAAAUw"]
[Wed Apr 29 06:58:52.749571 2026] [:error] [pid 40344:tid 40394] [client 52.230.176.21:51642] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-trackback.php"] [unique_id "afE7rJ_iiwb4cHXz-JoBtAAAAdM"]
[Wed Apr 29 06:58:53.466579 2026] [:error] [pid 56756:tid 56795] [client 52.230.176.21:51324] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-trackback.php"] [unique_id "afE7rXDi78vq-l2wwMwRkgAAAEM"]
[Wed Apr 29 06:58:54.186150 2026] [:error] [pid 40313:tid 40339] [client 52.230.176.21:9984] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-trackback.php"] [unique_id "afE7rqpx5sKFuV9bHzpZAAAAAVg"]
[Wed Apr 29 06:58:55.065607 2026] [:error] [pid 40344:tid 40398] [client 52.230.176.21:9992] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-trackback.php"] [unique_id "afE7r5_iiwb4cHXz-JoBuQAAAdc"]
[Wed Apr 29 06:58:55.870845 2026] [:error] [pid 40343:tid 40364] [client 52.230.176.21:10079] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xx.php"] [unique_id "afE7r2iaWCZjSxz2ZNtyuQAAAZA"]
[Wed Apr 29 06:58:56.484615 2026] [:error] [pid 40313:tid 40320] [client 52.230.176.21:9968] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xx.php"] [unique_id "afE7sKpx5sKFuV9bHzpZAQAAAUU"]
[Wed Apr 29 06:58:56.910531 2026] [:error] [pid 40344:tid 40389] [client 52.230.176.21:51609] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xx.php"] [unique_id "afE7sJ_iiwb4cHXz-JoBvQAAAc4"]
[Wed Apr 29 06:58:57.493659 2026] [:error] [pid 40313:tid 40326] [client 52.230.176.21:9770] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xx.php"] [unique_id "afE7sapx5sKFuV9bHzpZAgAAAUs"]
[Wed Apr 29 06:58:58.047063 2026] [:error] [pid 56755:tid 56775] [client 52.230.176.21:10114] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/testo.php"] [unique_id "afE7svdXjiwtyGfj4lxMRQAAAAs"]
[Wed Apr 29 06:58:58.661229 2026] [:error] [pid 40313:tid 40338] [client 52.230.176.21:10001] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/testo.php"] [unique_id "afE7sqpx5sKFuV9bHzpZAwAAAVc"]
[Wed Apr 29 06:58:59.538875 2026] [:error] [pid 56757:tid 56841] [client 52.230.176.21:10201] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/testo.php"] [unique_id "afE7s_j76quHaaG1miSWGQAAAJY"]
[Wed Apr 29 06:58:59.974774 2026] [:error] [pid 40344:tid 40382] [client 52.230.176.21:51300] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/testo.php"] [unique_id "afE7s5_iiwb4cHXz-JoBvwAAAcc"]
[Wed Apr 29 06:59:00.623552 2026] [:error] [pid 40313:tid 40330] [client 52.230.176.21:10182] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/row.php"] [unique_id "afE7tKpx5sKFuV9bHzpZBAAAAU8"]
[Wed Apr 29 06:59:01.349868 2026] [:error] [pid 26594:tid 26620] [client 52.230.176.21:10205] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/row.php"] [unique_id "afE7tds-37Kay1vO52k4KQAAARg"]
[Wed Apr 29 06:59:01.973633 2026] [:error] [pid 56757:tid 56826] [client 52.230.176.21:9424] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/row.php"] [unique_id "afE7tfj76quHaaG1miSWGgAAAIc"]
[Wed Apr 29 06:59:02.474661 2026] [:error] [pid 56757:tid 56840] [client 52.230.176.21:10156] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/row.php"] [unique_id "afE7tvj76quHaaG1miSWGwAAAJU"]
[Wed Apr 29 06:59:03.208911 2026] [:error] [pid 56755:tid 56783] [client 52.230.176.21:10220] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/555.php"] [unique_id "afE7t_dXjiwtyGfj4lxMSQAAABM"]
[Wed Apr 29 06:59:03.922249 2026] [:error] [pid 40344:tid 40393] [client 52.230.176.21:9933] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/555.php"] [unique_id "afE7t5_iiwb4cHXz-JoBwAAAAdI"]
[Wed Apr 29 06:59:04.883647 2026] [:error] [pid 40344:tid 40378] [client 52.230.176.21:10206] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/555.php"] [unique_id "afE7uJ_iiwb4cHXz-JoBxAAAAcM"]
[Wed Apr 29 06:59:05.587964 2026] [:error] [pid 40313:tid 40315] [client 52.230.176.21:51270] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/555.php"] [unique_id "afE7uapx5sKFuV9bHzpZBgAAAUA"]
[Wed Apr 29 06:59:06.126000 2026] [:error] [pid 40313:tid 40335] [client 52.230.176.21:10113] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-conflg.php"] [unique_id "afE7uqpx5sKFuV9bHzpZBwAAAVQ"]
[Wed Apr 29 06:59:06.601623 2026] [:error] [pid 56863:tid 56884] [client 52.230.176.21:10175] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-conflg.php"] [unique_id "afE7umQQTEnvYCOsiwLc5AAAANM"]
[Wed Apr 29 06:59:07.298106 2026] [:error] [pid 40343:tid 40359] [client 52.230.176.21:51307] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-conflg.php"] [unique_id "afE7u2iaWCZjSxz2ZNtyvQAAAYs"]
[Wed Apr 29 06:59:07.903137 2026] [:error] [pid 40343:tid 40360] [client 52.230.176.21:10176] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-conflg.php"] [unique_id "afE7u2iaWCZjSxz2ZNtyvwAAAYw"]
[Wed Apr 29 06:59:09.027450 2026] [:error] [pid 56863:tid 56879] [client 52.230.176.21:10158] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "afE7vWQQTEnvYCOsiwLc5QAAAM4"]
[Wed Apr 29 06:59:09.648592 2026] [:error] [pid 40344:tid 40396] [client 52.230.176.21:10213] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "afE7vZ_iiwb4cHXz-JoBzAAAAdU"]
[Wed Apr 29 06:59:10.195966 2026] [:error] [pid 56757:tid 56822] [client 52.230.176.21:51299] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "afE7vvj76quHaaG1miSWHQAAAIM"]
[Wed Apr 29 06:59:10.938947 2026] [:error] [pid 56863:tid 56888] [client 52.230.176.21:51326] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xqq.php"] [unique_id "afE7vmQQTEnvYCOsiwLc5wAAANc"]
[Wed Apr 29 06:59:11.596595 2026] [:error] [pid 40343:tid 40371] [client 52.230.176.21:10237] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jmfi2.php"] [unique_id "afE7v2iaWCZjSxz2ZNtywQAAAZc"]
[Wed Apr 29 06:59:12.437268 2026] [:error] [pid 40343:tid 40353] [client 52.230.176.21:10151] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jmfi2.php"] [unique_id "afE7wGiaWCZjSxz2ZNtywgAAAYY"]
[Wed Apr 29 06:59:13.017284 2026] [:error] [pid 40344:tid 40393] [client 52.230.176.21:10189] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jmfi2.php"] [unique_id "afE7wZ_iiwb4cHXz-JoBzwAAAdI"]
[Wed Apr 29 06:59:13.422296 2026] [:error] [pid 40343:tid 40356] [client 52.230.176.21:10217] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jmfi2.php"] [unique_id "afE7wWiaWCZjSxz2ZNtywwAAAYk"]
[Wed Apr 29 06:59:13.902940 2026] [:error] [pid 56755:tid 56771] [client 52.230.176.21:9961] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-Blogs.php"] [unique_id "afE7wfdXjiwtyGfj4lxMSgAAAAc"]
[Wed Apr 29 06:59:14.553064 2026] [:error] [pid 56863:tid 56875] [client 52.230.176.21:10133] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-Blogs.php"] [unique_id "afE7wmQQTEnvYCOsiwLc6AAAAMo"]
[Wed Apr 29 06:59:15.360433 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:10148] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-Blogs.php"] [unique_id "afE7w5_iiwb4cHXz-JoB0AAAAcQ"]
[Wed Apr 29 06:59:16.094039 2026] [:error] [pid 56756:tid 56793] [client 52.230.176.21:9978] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-Blogs.php"] [unique_id "afE7xHDi78vq-l2wwMwRlAAAAEE"]
[Wed Apr 29 06:59:16.693638 2026] [:error] [pid 56757:tid 56820] [client 52.230.176.21:10214] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/card.php"] [unique_id "afE7xPj76quHaaG1miSWHgAAAIE"]
[Wed Apr 29 06:59:17.558249 2026] [:error] [pid 40313:tid 40316] [client 52.230.176.21:51271] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/card.php"] [unique_id "afE7xapx5sKFuV9bHzpZCAAAAUE"]
[Wed Apr 29 06:59:18.103929 2026] [:error] [pid 56863:tid 56869] [client 52.230.176.21:51591] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/card.php"] [unique_id "afE7xmQQTEnvYCOsiwLc6gAAAMQ"]
[Wed Apr 29 06:59:18.641290 2026] [:error] [pid 56863:tid 56871] [client 52.230.176.21:10169] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/card.php"] [unique_id "afE7xmQQTEnvYCOsiwLc6wAAAMY"]
[Wed Apr 29 06:59:19.312682 2026] [:error] [pid 56757:tid 56829] [client 52.230.176.21:10074] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mds.php"] [unique_id "afE7x_j76quHaaG1miSWHwAAAIo"]
[Wed Apr 29 06:59:19.791060 2026] [:error] [pid 40313:tid 40329] [client 52.230.176.21:51639] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mds.php"] [unique_id "afE7x6px5sKFuV9bHzpZCgAAAU4"]
[Wed Apr 29 06:59:20.339519 2026] [:error] [pid 56757:tid 56837] [client 52.230.176.21:10172] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mds.php"] [unique_id "afE7yPj76quHaaG1miSWIAAAAJI"]
[Wed Apr 29 06:59:21.019268 2026] [:error] [pid 40313:tid 40318] [client 52.230.176.21:9977] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mds.php"] [unique_id "afE7yapx5sKFuV9bHzpZDQAAAUM"]
[Wed Apr 29 06:59:21.597215 2026] [:error] [pid 40313:tid 40332] [client 52.230.176.21:51276] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hey.php"] [unique_id "afE7yapx5sKFuV9bHzpZDgAAAVE"]
[Wed Apr 29 06:59:22.108858 2026] [:error] [pid 40344:tid 40383] [client 52.230.176.21:10098] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hey.php"] [unique_id "afE7yp_iiwb4cHXz-JoB0gAAAcg"]
[Wed Apr 29 06:59:22.702127 2026] [:error] [pid 40343:tid 40364] [client 52.230.176.21:10149] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hey.php"] [unique_id "afE7ymiaWCZjSxz2ZNtyxwAAAZA"]
[Wed Apr 29 06:59:23.116824 2026] [:error] [pid 26594:tid 26609] [client 52.230.176.21:10105] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hey.php"] [unique_id "afE7y9s-37Kay1vO52k4KwAAAQ0"]
[Wed Apr 29 06:59:23.667342 2026] [:error] [pid 40313:tid 40339] [client 52.230.176.21:9928] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/samll.php"] [unique_id "afE7y6px5sKFuV9bHzpZEQAAAVg"]
[Wed Apr 29 06:59:24.199229 2026] [:error] [pid 40313:tid 40338] [client 52.230.176.21:51301] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/samll.php"] [unique_id "afE7zKpx5sKFuV9bHzpZEwAAAVc"]
[Wed Apr 29 06:59:24.745933 2026] [:error] [pid 40313:tid 40331] [client 52.230.176.21:9996] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/samll.php"] [unique_id "afE7zKpx5sKFuV9bHzpZFAAAAVA"]
[Wed Apr 29 06:59:25.347172 2026] [:error] [pid 56755:tid 56781] [client 52.230.176.21:51610] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/samll.php"] [unique_id "afE7zfdXjiwtyGfj4lxMTAAAABE"]
[Wed Apr 29 06:59:25.936950 2026] [:error] [pid 40344:tid 40397] [client 52.230.176.21:9415] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/h.php"] [unique_id "afE7zZ_iiwb4cHXz-JoB0wAAAdY"]
[Wed Apr 29 06:59:26.496682 2026] [:error] [pid 40344:tid 40388] [client 52.230.176.21:9982] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/h.php"] [unique_id "afE7zp_iiwb4cHXz-JoB1QAAAc0"]
[Wed Apr 29 06:59:27.129142 2026] [:error] [pid 56756:tid 56797] [client 52.230.176.21:51291] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/h.php"] [unique_id "afE7z3Di78vq-l2wwMwRlgAAAEU"]
[Wed Apr 29 06:59:27.806332 2026] [:error] [pid 56755:tid 56776] [client 52.230.176.21:10021] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/h.php"] [unique_id "afE7z_dXjiwtyGfj4lxMTQAAAAw"]
[Wed Apr 29 06:59:28.316191 2026] [:error] [pid 40313:tid 40329] [client 52.230.176.21:9941] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bdroot.php"] [unique_id "afE70Kpx5sKFuV9bHzpZFwAAAU4"]
[Wed Apr 29 06:59:28.834199 2026] [:error] [pid 56755:tid 56773] [client 52.230.176.21:10057] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bdroot.php"] [unique_id "afE70PdXjiwtyGfj4lxMTgAAAAk"]
[Wed Apr 29 06:59:29.488750 2026] [:error] [pid 40313:tid 40336] [client 52.230.176.21:9947] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bdroot.php"] [unique_id "afE70apx5sKFuV9bHzpZGAAAAVU"]
[Wed Apr 29 06:59:30.521300 2026] [:error] [pid 40313:tid 40318] [client 52.230.176.21:9447] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bdroot.php"] [unique_id "afE70qpx5sKFuV9bHzpZGQAAAUM"]
[Wed Apr 29 06:59:31.483203 2026] [:error] [pid 56757:tid 56825] [client 52.230.176.21:9463] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-config.php"] [unique_id "afE70_j76quHaaG1miSWIwAAAIY"]
[Wed Apr 29 06:59:31.950183 2026] [:error] [pid 40343:tid 40354] [client 52.230.176.21:51289] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-config.php"] [unique_id "afE702iaWCZjSxz2ZNtyyQAAAYc"]
[Wed Apr 29 06:59:32.667217 2026] [:error] [pid 56757:tid 56831] [client 52.230.176.21:10102] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-config.php"] [unique_id "afE71Pj76quHaaG1miSWJAAAAIw"]
[Wed Apr 29 06:59:33.112174 2026] [:error] [pid 40343:tid 40359] [client 52.230.176.21:10137] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-config.php"] [unique_id "afE71WiaWCZjSxz2ZNtyywAAAYs"]
[Wed Apr 29 06:59:33.504905 2026] [:error] [pid 40344:tid 40382] [client 52.230.176.21:10055] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afE71Z_iiwb4cHXz-JoB3gAAAcc"]
[Wed Apr 29 06:59:34.030226 2026] [:error] [pid 56756:tid 56796] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Apr 29 06:59:34.322920 2026] [:error] [pid 56756:tid 56811] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/444.php
[Wed Apr 29 06:59:34.515210 2026] [:error] [pid 56756:tid 56816] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Wed Apr 29 06:59:34.710073 2026] [:error] [pid 56756:tid 56805] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/himu.php
[Wed Apr 29 06:59:34.901919 2026] [:error] [pid 56756:tid 56799] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Wed Apr 29 06:59:35.093642 2026] [:error] [pid 56756:tid 56806] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Wed Apr 29 06:59:35.286977 2026] [:error] [pid 56756:tid 56798] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/hans.php
[Wed Apr 29 06:59:35.480188 2026] [:error] [pid 56756:tid 56804] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/lgr.php
[Wed Apr 29 06:59:35.752913 2026] [:error] [pid 56756:tid 56795] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/an7.php
[Wed Apr 29 06:59:35.944832 2026] [:error] [pid 56756:tid 56809] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/file1.php
[Wed Apr 29 06:59:36.149508 2026] [:error] [pid 56756:tid 56815] [client 52.230.176.21:9458] File does not exist: /usr/local/apache/htdocs/suspended-page/luxe.php
[Wed Apr 29 06:59:36.412656 2026] [:error] [pid 56756:tid 56803] [client 52.230.176.21:9458] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp_ok.php"] [unique_id "afE72HDi78vq-l2wwMwRqQAAAEs"]
[Wed Apr 29 06:59:36.907746 2026] [:error] [pid 40344:tid 40376] [client 52.230.176.21:9446] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp_ok.php"] [unique_id "afE72J_iiwb4cHXz-JoB3wAAAcE"]
[Wed Apr 29 06:59:37.499142 2026] [:error] [pid 56863:tid 56868] [client 52.230.176.21:51613] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp_ok.php"] [unique_id "afE72WQQTEnvYCOsiwLc8QAAAMM"]
[Wed Apr 29 06:59:38.109136 2026] [:error] [pid 56757:tid 56835] [client 52.230.176.21:10083] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp_ok.php"] [unique_id "afE72vj76quHaaG1miSWJwAAAJA"]
[Wed Apr 29 06:59:38.622926 2026] [:error] [pid 26594:tid 26611] [client 52.230.176.21:51306] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afE72ts-37Kay1vO52k4LQAAAQ8"]
[Wed Apr 29 06:59:39.067522 2026] [:error] [pid 56756:tid 56793] [client 52.230.176.21:10231] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afE723Di78vq-l2wwMwRqgAAAEE"]
[Wed Apr 29 06:59:39.541540 2026] [:error] [pid 56757:tid 56838] [client 52.230.176.21:10161] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afE72_j76quHaaG1miSWKAAAAJM"]
[Wed Apr 29 06:59:40.034779 2026] [:error] [pid 56863:tid 56888] [client 52.230.176.21:9963] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afE73GQQTEnvYCOsiwLc8gAAANc"]
[Wed Apr 29 06:59:40.524490 2026] [:error] [pid 40343:tid 40363] [client 52.230.176.21:9983] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inde.php"] [unique_id "afE73GiaWCZjSxz2ZNtyzQAAAY8"]
[Wed Apr 29 06:59:41.042868 2026] [:error] [pid 56863:tid 56870] [client 52.230.176.21:9421] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inde.php"] [unique_id "afE73WQQTEnvYCOsiwLc9AAAAMU"]
[Wed Apr 29 06:59:41.588629 2026] [:error] [pid 56863:tid 56889] [client 52.230.176.21:10068] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inde.php"] [unique_id "afE73WQQTEnvYCOsiwLc9QAAANg"]
[Wed Apr 29 06:59:42.429122 2026] [:error] [pid 40343:tid 40356] [client 52.230.176.21:10227] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inde.php"] [unique_id "afE73miaWCZjSxz2ZNtyzwAAAYk"]
[Wed Apr 29 06:59:42.956132 2026] [:error] [pid 40344:tid 40383] [client 52.230.176.21:9435] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xtt.php"] [unique_id "afE73p_iiwb4cHXz-JoB5AAAAcg"]
[Wed Apr 29 06:59:43.594415 2026] [:error] [pid 40313:tid 40326] [client 52.230.176.21:10196] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xtt.php"] [unique_id "afE736px5sKFuV9bHzpZGwAAAUs"]
[Wed Apr 29 06:59:44.213086 2026] [:error] [pid 56863:tid 56875] [client 52.230.176.21:10078] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xtt.php"] [unique_id "afE74GQQTEnvYCOsiwLc9wAAAMo"]
[Wed Apr 29 06:59:44.809638 2026] [:error] [pid 40344:tid 40384] [client 52.230.176.21:9956] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xtt.php"] [unique_id "afE74J_iiwb4cHXz-JoB5QAAAck"]
[Wed Apr 29 06:59:45.737706 2026] [:error] [pid 40313:tid 40321] [client 52.230.176.21:9899] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/autoload_classmap.php"] [unique_id "afE74apx5sKFuV9bHzpZHAAAAUY"]
[Wed Apr 29 06:59:46.655960 2026] [:error] [pid 40344:tid 40392] [client 52.230.176.21:10193] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/autoload_classmap.php"] [unique_id "afE74p_iiwb4cHXz-JoB5gAAAdE"]
[Wed Apr 29 06:59:47.371534 2026] [:error] [pid 40344:tid 40381] [client 52.230.176.21:10062] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/autoload_classmap.php"] [unique_id "afE745_iiwb4cHXz-JoB5wAAAcY"]
[Wed Apr 29 06:59:47.909831 2026] [:error] [pid 40343:tid 40368] [client 52.230.176.21:10147] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/autoload_classmap.php"] [unique_id "afE742iaWCZjSxz2ZNty0wAAAZQ"]
[Wed Apr 29 06:59:48.583698 2026] [:error] [pid 40313:tid 40338] [client 52.230.176.21:10090] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we2.php"] [unique_id "afE75Kpx5sKFuV9bHzpZHQAAAVc"]
[Wed Apr 29 06:59:49.193277 2026] [:error] [pid 40344:tid 40375] [client 52.230.176.21:9951] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we2.php"] [unique_id "afE75Z_iiwb4cHXz-JoB6AAAAcA"]
[Wed Apr 29 06:59:49.781878 2026] [:error] [pid 40313:tid 40330] [client 52.230.176.21:9469] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we2.php"] [unique_id "afE75apx5sKFuV9bHzpZHgAAAU8"]
[Wed Apr 29 06:59:50.346451 2026] [:error] [pid 40344:tid 40396] [client 52.230.176.21:51297] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/we2.php"] [unique_id "afE75p_iiwb4cHXz-JoB6gAAAdU"]
[Wed Apr 29 06:59:50.953728 2026] [:error] [pid 26594:tid 26598] [client 52.230.176.21:10168] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zicgg.php"] [unique_id "afE75ts-37Kay1vO52k4MAAAAQI"]
[Wed Apr 29 06:59:51.622447 2026] [:error] [pid 26594:tid 26601] [client 52.230.176.21:10101] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zicgg.php"] [unique_id "afE759s-37Kay1vO52k4MQAAAQU"]
[Wed Apr 29 06:59:52.242632 2026] [:error] [pid 56757:tid 56843] [client 52.230.176.21:10061] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zicgg.php"] [unique_id "afE76Pj76quHaaG1miSWKQAAAJg"]
[Wed Apr 29 06:59:53.302054 2026] [:error] [pid 40344:tid 40390] [client 52.230.176.21:9940] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zicgg.php"] [unique_id "afE76Z_iiwb4cHXz-JoB7AAAAc8"]
[Wed Apr 29 06:59:53.851845 2026] [:error] [pid 40313:tid 40324] [client 52.230.176.21:9946] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pouhg.php"] [unique_id "afE76apx5sKFuV9bHzpZHwAAAUk"]
[Wed Apr 29 06:59:54.491662 2026] [:error] [pid 56756:tid 56808] [client 52.230.176.21:51594] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pouhg.php"] [unique_id "afE76nDi78vq-l2wwMwRrAAAAFA"]
[Wed Apr 29 06:59:55.288099 2026] [:error] [pid 40344:tid 40380] [client 52.230.176.21:10233] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pouhg.php"] [unique_id "afE765_iiwb4cHXz-JoB7gAAAcU"]
[Wed Apr 29 06:59:55.998508 2026] [:error] [pid 26594:tid 26608] [client 52.230.176.21:10211] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pouhg.php"] [unique_id "afE769s-37Kay1vO52k4MgAAAQw"]
[Wed Apr 29 06:59:56.521439 2026] [:error] [pid 26594:tid 26615] [client 52.230.176.21:9997] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file88.php"] [unique_id "afE77Ns-37Kay1vO52k4MwAAARM"]
[Wed Apr 29 06:59:56.986394 2026] [:error] [pid 56756:tid 56813] [client 52.230.176.21:9934] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file88.php"] [unique_id "afE77HDi78vq-l2wwMwRrQAAAFU"]
[Wed Apr 29 06:59:57.693663 2026] [:error] [pid 40344:tid 40399] [client 52.230.176.21:10024] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file88.php"] [unique_id "afE77Z_iiwb4cHXz-JoB8AAAAdg"]
[Wed Apr 29 06:59:58.241185 2026] [:error] [pid 40343:tid 40372] [client 52.230.176.21:9969] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file88.php"] [unique_id "afE77miaWCZjSxz2ZNty1gAAAZg"]
[Wed Apr 29 06:59:58.864473 2026] [:error] [pid 26594:tid 26602] [client 52.230.176.21:9429] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xenon1337.php"] [unique_id "afE77ts-37Kay1vO52k4NQAAAQY"]
[Wed Apr 29 06:59:59.370380 2026] [:error] [pid 40344:tid 40398] [client 52.230.176.21:9955] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xenon1337.php"] [unique_id "afE775_iiwb4cHXz-JoB8QAAAdc"]
[Wed Apr 29 07:00:00.318641 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:10073] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xenon1337.php"] [unique_id "afE78J_iiwb4cHXz-JoB8gAAAcQ"]
[Wed Apr 29 07:00:01.126455 2026] [:error] [pid 40344:tid 40397] [client 52.230.176.21:9972] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xenon1337.php"] [unique_id "afE78Z_iiwb4cHXz-JoB8wAAAdY"]
[Wed Apr 29 07:00:02.145769 2026] [:error] [pid 40343:tid 40370] [client 52.230.176.21:9987] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1index.php"] [unique_id "afE78miaWCZjSxz2ZNty2AAAAZY"]
[Wed Apr 29 07:00:02.958692 2026] [:error] [pid 40343:tid 40350] [client 52.230.176.21:9885] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1index.php"] [unique_id "afE78miaWCZjSxz2ZNty2QAAAYM"]
[Wed Apr 29 07:00:03.637321 2026] [:error] [pid 40343:tid 40359] [client 52.230.176.21:9736] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1index.php"] [unique_id "afE782iaWCZjSxz2ZNty2gAAAYs"]
[Wed Apr 29 07:00:04.160445 2026] [:error] [pid 56755:tid 56774] [client 52.230.176.21:51265] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1index.php"] [unique_id "afE79PdXjiwtyGfj4lxMVAAAAAo"]
[Wed Apr 29 07:00:05.017215 2026] [:error] [pid 56755:tid 56787] [client 52.230.176.21:9980] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "afE79fdXjiwtyGfj4lxMVQAAABc"]
[Wed Apr 29 07:00:05.690461 2026] [:error] [pid 40344:tid 40388] [client 52.230.176.21:10165] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "afE79Z_iiwb4cHXz-JoB9AAAAc0"]
[Wed Apr 29 07:00:06.317291 2026] [:error] [pid 40343:tid 40363] [client 52.230.176.21:9423] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "afE79miaWCZjSxz2ZNty3AAAAY8"]
[Wed Apr 29 07:00:07.118250 2026] [:error] [pid 40343:tid 40361] [client 52.230.176.21:10180] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "afE792iaWCZjSxz2ZNty4wAAAY0"]
[Wed Apr 29 07:00:07.929010 2026] [:error] [pid 40313:tid 40315] [client 52.230.176.21:10096] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "afE796px5sKFuV9bHzpZIgAAAUA"]
[Wed Apr 29 07:00:08.495384 2026] [:error] [pid 40313:tid 40335] [client 52.230.176.21:51633] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "afE7-Kpx5sKFuV9bHzpZIwAAAVQ"]
[Wed Apr 29 07:00:09.012530 2026] [:error] [pid 40343:tid 40370] [client 52.230.176.21:9938] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "afE7-WiaWCZjSxz2ZNty5AAAAZY"]
[Wed Apr 29 07:00:09.620042 2026] [:error] [pid 56756:tid 56812] [client 52.230.176.21:10064] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "afE7-XDi78vq-l2wwMwRsQAAAFQ"]
[Wed Apr 29 07:00:10.194814 2026] [:error] [pid 40313:tid 40316] [client 52.230.176.21:10223] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cache.php"] [unique_id "afE7-qpx5sKFuV9bHzpZJAAAAUE"]
[Wed Apr 29 07:00:10.782104 2026] [:error] [pid 26594:tid 26620] [client 52.230.176.21:9738] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cache.php"] [unique_id "afE7-ts-37Kay1vO52k4OQAAARg"]
[Wed Apr 29 07:00:11.434099 2026] [:error] [pid 26594:tid 26597] [client 52.230.176.21:9939] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cache.php"] [unique_id "afE7-9s-37Kay1vO52k4OwAAAQE"]
[Wed Apr 29 07:00:12.035270 2026] [:error] [pid 40344:tid 40392] [client 52.230.176.21:9450] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cache.php"] [unique_id "afE7_J_iiwb4cHXz-JoB9gAAAdE"]
[Wed Apr 29 07:00:12.824020 2026] [:error] [pid 26594:tid 26600] [client 52.230.176.21:10012] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error.php"] [unique_id "afE7_Ns-37Kay1vO52k4PAAAAQQ"]
[Wed Apr 29 07:00:13.497419 2026] [:error] [pid 56756:tid 56811] [client 52.230.176.21:51281] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error.php"] [unique_id "afE7_XDi78vq-l2wwMwRsgAAAFM"]
[Wed Apr 29 07:00:14.048457 2026] [:error] [pid 40344:tid 40394] [client 52.230.176.21:9976] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error.php"] [unique_id "afE7_p_iiwb4cHXz-JoB-AAAAdM"]
[Wed Apr 29 07:00:14.553850 2026] [:error] [pid 40344:tid 40396] [client 52.230.176.21:51628] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error.php"] [unique_id "afE7_p_iiwb4cHXz-JoB-QAAAdU"]
[Wed Apr 29 07:00:15.002398 2026] [:error] [pid 40344:tid 40380] [client 52.230.176.21:10235] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file32.php"] [unique_id "afE7_5_iiwb4cHXz-JoB-wAAAcU"]
[Wed Apr 29 07:00:15.512066 2026] [:error] [pid 40344:tid 40389] [client 52.230.176.21:9444] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file32.php"] [unique_id "afE7_5_iiwb4cHXz-JoB_QAAAc4"]
[Wed Apr 29 07:00:16.787905 2026] [:error] [pid 56863:tid 56868] [client 52.230.176.21:10121] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file32.php"] [unique_id "afE8AGQQTEnvYCOsiwLc_gAAAMM"]
[Wed Apr 29 07:00:17.405509 2026] [:error] [pid 40344:tid 40393] [client 52.230.176.21:10066] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file32.php"] [unique_id "afE8AZ_iiwb4cHXz-JoCAAAAAdI"]
[Wed Apr 29 07:00:17.990682 2026] [:error] [pid 56863:tid 56888] [client 52.230.176.21:9989] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cvrvk.php"] [unique_id "afE8AWQQTEnvYCOsiwLc_wAAANc"]
[Wed Apr 29 07:00:18.680529 2026] [:error] [pid 40313:tid 40323] [client 52.230.176.21:9856] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cvrvk.php"] [unique_id "afE8Aqpx5sKFuV9bHzpZJgAAAUg"]
[Wed Apr 29 07:00:19.494081 2026] [:error] [pid 56863:tid 56889] [client 52.230.176.21:51278] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cvrvk.php"] [unique_id "afE8A2QQTEnvYCOsiwLdAAAAANg"]
[Wed Apr 29 07:00:20.208635 2026] [:error] [pid 56863:tid 56875] [client 52.230.176.21:51623] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cvrvk.php"] [unique_id "afE8BGQQTEnvYCOsiwLdAgAAAMo"]
[Wed Apr 29 07:00:20.710985 2026] [:error] [pid 40313:tid 40336] [client 52.230.176.21:51604] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp.php"] [unique_id "afE8BKpx5sKFuV9bHzpZJwAAAVU"]
[Wed Apr 29 07:00:21.498663 2026] [:error] [pid 26594:tid 26619] [client 52.230.176.21:10110] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp.php"] [unique_id "afE8Bds-37Kay1vO52k4PgAAARc"]
[Wed Apr 29 07:00:22.141556 2026] [:error] [pid 56863:tid 56881] [client 52.230.176.21:10191] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp.php"] [unique_id "afE8BmQQTEnvYCOsiwLdAwAAANA"]
[Wed Apr 29 07:00:22.742058 2026] [:error] [pid 26594:tid 26598] [client 52.230.176.21:10054] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp.php"] [unique_id "afE8Bts-37Kay1vO52k4QQAAAQI"]
[Wed Apr 29 07:00:23.366093 2026] [:error] [pid 40343:tid 40352] [client 52.230.176.21:10232] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-t.api.php"] [unique_id "afE8B2iaWCZjSxz2ZNty5gAAAYU"]
[Wed Apr 29 07:00:23.940504 2026] [:error] [pid 56756:tid 56816] [client 52.230.176.21:51603] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-t.api.php"] [unique_id "afE8B3Di78vq-l2wwMwRswAAAFg"]
[Wed Apr 29 07:00:25.308483 2026] [:error] [pid 56756:tid 56806] [client 52.230.176.21:10093] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-t.api.php"] [unique_id "afE8CXDi78vq-l2wwMwRtAAAAE4"]
[Wed Apr 29 07:00:26.017837 2026] [:error] [pid 40313:tid 40332] [client 52.230.176.21:9427] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-t.api.php"] [unique_id "afE8Cqpx5sKFuV9bHzpZKQAAAVE"]
[Wed Apr 29 07:00:26.522130 2026] [:error] [pid 40343:tid 40367] [client 52.230.176.21:9636] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hello.php"] [unique_id "afE8CmiaWCZjSxz2ZNty6gAAAZM"]
[Wed Apr 29 07:00:27.052816 2026] [:error] [pid 56756:tid 56809] [client 52.230.176.21:9408] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hello.php"] [unique_id "afE8C3Di78vq-l2wwMwRtwAAAFE"]
[Wed Apr 29 07:00:28.327120 2026] [:error] [pid 56863:tid 56877] [client 52.230.176.21:9876] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hello.php"] [unique_id "afE8DGQQTEnvYCOsiwLdBAAAAMw"]
[Wed Apr 29 07:00:28.930260 2026] [:error] [pid 56863:tid 56869] [client 52.230.176.21:9751] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hello.php"] [unique_id "afE8DGQQTEnvYCOsiwLdBQAAAMQ"]
[Wed Apr 29 07:00:29.714145 2026] [:error] [pid 40344:tid 40388] [client 52.230.176.21:51313] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "afE8DZ_iiwb4cHXz-JoCAwAAAc0"]
[Wed Apr 29 07:00:31.498770 2026] [:error] [pid 40344:tid 40392] [client 52.230.176.21:10141] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "afE8D5_iiwb4cHXz-JoCBAAAAdE"]
[Wed Apr 29 07:00:32.077109 2026] [:error] [pid 56863:tid 56873] [client 52.230.176.21:10006] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "afE8EGQQTEnvYCOsiwLdBgAAAMg"]
[Wed Apr 29 07:00:33.067345 2026] [:error] [pid 40344:tid 40375] [client 52.230.176.21:51277] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links-opml.php"] [unique_id "afE8EZ_iiwb4cHXz-JoCBwAAAcA"]
[Wed Apr 29 07:00:33.651222 2026] [:error] [pid 40344:tid 40385] [client 52.230.176.21:9440] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lti.php"] [unique_id "afE8EZ_iiwb4cHXz-JoCCQAAAco"]
[Wed Apr 29 07:00:34.460945 2026] [:error] [pid 56757:tid 56820] [client 52.230.176.21:9892] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lti.php"] [unique_id "afE8Evj76quHaaG1miSWLQAAAIE"]
[Wed Apr 29 07:00:35.225745 2026] [:error] [pid 40344:tid 40380] [client 52.230.176.21:9880] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lti.php"] [unique_id "afE8E5_iiwb4cHXz-JoCCwAAAcU"]
[Wed Apr 29 07:00:36.061280 2026] [:error] [pid 56756:tid 56813] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/lti.php
[Wed Apr 29 07:00:36.513997 2026] [:error] [pid 56756:tid 56807] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Wed Apr 29 07:00:37.076693 2026] [:error] [pid 56756:tid 56802] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/shellalfa.php
[Wed Apr 29 07:00:37.309720 2026] [:error] [pid 56756:tid 56792] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Wed Apr 29 07:00:37.504269 2026] [:error] [pid 56756:tid 56801] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/xmu.php
[Wed Apr 29 07:00:39.103807 2026] [:error] [pid 56756:tid 56801] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/shelp.php
[Wed Apr 29 07:00:39.296106 2026] [:error] [pid 56756:tid 56810] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Wed Apr 29 07:00:39.548616 2026] [:error] [pid 56756:tid 56812] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/pucci.php
[Wed Apr 29 07:00:39.977390 2026] [:error] [pid 56756:tid 56796] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php
[Wed Apr 29 07:00:40.235044 2026] [:error] [pid 56756:tid 56814] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Apr 29 07:00:40.433627 2026] [:error] [pid 56756:tid 56811] [client 52.230.176.21:9945] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Wed Apr 29 07:00:40.622139 2026] [:error] [pid 56756:tid 56816] [client 52.230.176.21:9945] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "afE8GHDi78vq-l2wwMwRxQAAAFg"]
[Wed Apr 29 07:00:41.549635 2026] [:error] [pid 56863:tid 56882] [client 52.230.176.21:51588] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "afE8GWQQTEnvYCOsiwLdCQAAANE"]
[Wed Apr 29 07:00:42.300630 2026] [:error] [pid 40344:tid 40382] [client 52.230.176.21:9643] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "afE8Gp_iiwb4cHXz-JoCDQAAAcc"]
[Wed Apr 29 07:00:43.579109 2026] [:error] [pid 40343:tid 40361] [client 52.230.176.21:10186] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "afE8G2iaWCZjSxz2ZNty7QAAAY0"]
[Wed Apr 29 07:00:44.259093 2026] [:error] [pid 40313:tid 40331] [client 52.230.176.21:51618] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "afE8HKpx5sKFuV9bHzpZLgAAAVA"]
[Wed Apr 29 07:00:45.005735 2026] [:error] [pid 40343:tid 40366] [client 52.230.176.21:51292] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "afE8HWiaWCZjSxz2ZNty7gAAAZI"]
[Wed Apr 29 07:00:46.631417 2026] [:error] [pid 56757:tid 56830] [client 52.230.176.21:9445] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "afE8Hvj76quHaaG1miSWOgAAAIs"]
[Wed Apr 29 07:00:47.635645 2026] [:error] [pid 40343:tid 40347] [client 52.230.176.21:9889] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ol.php"] [unique_id "afE8H2iaWCZjSxz2ZNtzAQAAAYA"]
[Wed Apr 29 07:00:48.216570 2026] [:error] [pid 40313:tid 40334] [client 52.230.176.21:10194] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mws.php"] [unique_id "afE8IKpx5sKFuV9bHzpZMQAAAVM"]
[Wed Apr 29 07:00:49.891445 2026] [:error] [pid 40343:tid 40372] [client 52.230.176.21:51264] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mws.php"] [unique_id "afE8IWiaWCZjSxz2ZNtzDAAAAZg"]
[Wed Apr 29 07:00:51.088698 2026] [:error] [pid 56756:tid 56800] [client 52.230.176.21:9944] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mws.php"] [unique_id "afE8I3Di78vq-l2wwMwRzQAAAEg"]
[Wed Apr 29 07:00:55.582503 2026] [:error] [pid 56863:tid 56878] [client 52.230.176.21:10210] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mws.php"] [unique_id "afE8J2QQTEnvYCOsiwLdTQAAAM0"]
[Wed Apr 29 07:00:58.631749 2026] [:error] [pid 56756:tid 56810] [client 52.230.176.21:9903] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file9.php"] [unique_id "afE8KnDi78vq-l2wwMwRzgAAAFI"]
[Wed Apr 29 07:01:00.270914 2026] [:error] [pid 56863:tid 56888] [client 52.230.176.21:51596] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file9.php"] [unique_id "afE8LGQQTEnvYCOsiwLdUQAAANc"]
[Wed Apr 29 07:01:01.900830 2026] [:error] [pid 40343:tid 40354] [client 52.230.176.21:10077] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file9.php"] [unique_id "afE8LWiaWCZjSxz2ZNtzDQAAAYc"]
[Wed Apr 29 07:01:03.115387 2026] [:error] [pid 56863:tid 56879] [client 52.230.176.21:51600] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file9.php"] [unique_id "afE8L2QQTEnvYCOsiwLdUgAAAM4"]
[Wed Apr 29 07:01:04.214753 2026] [:error] [pid 40313:tid 40336] [client 52.230.176.21:9442] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ff1.php"] [unique_id "afE8MKpx5sKFuV9bHzpZMwAAAVU"]
[Wed Apr 29 07:01:07.227524 2026] [:error] [pid 40344:tid 40377] [client 52.230.176.21:9962] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ff1.php"] [unique_id "afE8M5_iiwb4cHXz-JoCIAAAAcI"]
[Wed Apr 29 07:01:08.868952 2026] [:error] [pid 40344:tid 40380] [client 52.230.176.21:9461] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ff1.php"] [unique_id "afE8NJ_iiwb4cHXz-JoCIQAAAcU"]
[Wed Apr 29 07:01:11.763579 2026] [:error] [pid 56757:tid 56825] [client 52.230.176.21:51287] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ff1.php"] [unique_id "afE8N_j76quHaaG1miSWiwAAAIY"]
[Wed Apr 29 07:01:13.242085 2026] [:error] [pid 26594:tid 26610] [client 52.230.176.21:10031] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/doc.php"] [unique_id "afE8Ods-37Kay1vO52k4UwAAAQ4"]
[Wed Apr 29 07:01:15.497991 2026] [:error] [pid 40344:tid 40397] [client 52.230.176.21:10222] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/doc.php"] [unique_id "afE8O5_iiwb4cHXz-JoCJgAAAdY"]
[Wed Apr 29 07:01:17.780867 2026] [:error] [pid 40343:tid 40372] [client 52.230.176.21:10116] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/doc.php"] [unique_id "afE8PWiaWCZjSxz2ZNtzFQAAAZg"]
[Wed Apr 29 07:01:19.842388 2026] [:error] [pid 40344:tid 40384] [client 52.230.176.21:10209] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/doc.php"] [unique_id "afE8P5_iiwb4cHXz-JoCKwAAAck"]
[Wed Apr 29 07:01:25.036714 2026] [:error] [pid 26594:tid 26607] [client 52.230.176.21:9994] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "afE8Rds-37Kay1vO52k4VgAAAQs"]
[Wed Apr 29 07:01:29.214616 2026] [:error] [pid 56755:tid 56773] [client 52.230.176.21:9943] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "afE8SfdXjiwtyGfj4lxMWwAAAAk"]
[Wed Apr 29 07:01:30.431623 2026] [:error] [pid 40343:tid 40371] [client 52.230.176.21:10126] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "afE8SmiaWCZjSxz2ZNtzIwAAAZc"]
[Wed Apr 29 07:01:35.231676 2026] [:error] [pid 56863:tid 56873] [client 52.230.176.21:9975] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "afE8T2QQTEnvYCOsiwLdVwAAAMg"]
[Wed Apr 29 07:01:36.296332 2026] [:error] [pid 56863:tid 56874] [client 52.230.176.21:9443] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/06.php"] [unique_id "afE8UGQQTEnvYCOsiwLdWAAAAMk"]
[Wed Apr 29 07:01:37.454923 2026] [:error] [pid 40343:tid 40359] [client 52.230.176.21:10238] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/06.php"] [unique_id "afE8UWiaWCZjSxz2ZNtzKgAAAYs"]
[Wed Apr 29 07:01:39.703319 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:9778] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/06.php"] [unique_id "afE8U5_iiwb4cHXz-JoCNwAAAcQ"]
[Wed Apr 29 07:01:41.015130 2026] [:error] [pid 40344:tid 40376] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Wed Apr 29 07:01:41.215337 2026] [:error] [pid 40344:tid 40398] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Wed Apr 29 07:01:41.417181 2026] [:error] [pid 40344:tid 40387] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/owl.php
[Wed Apr 29 07:01:41.609435 2026] [:error] [pid 40344:tid 40378] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/hook.php
[Wed Apr 29 07:01:41.802500 2026] [:error] [pid 40344:tid 40395] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Wed Apr 29 07:01:41.994543 2026] [:error] [pid 40344:tid 40397] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Wed Apr 29 07:01:42.188376 2026] [:error] [pid 40344:tid 40394] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Wed Apr 29 07:01:42.491035 2026] [:error] [pid 40344:tid 40391] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/clirp.php
[Wed Apr 29 07:01:42.684504 2026] [:error] [pid 40344:tid 40375] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Wed Apr 29 07:01:42.881622 2026] [:error] [pid 40344:tid 40388] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/wkdec.php
[Wed Apr 29 07:01:43.215099 2026] [:error] [pid 40344:tid 40392] [client 52.230.176.21:9967] File does not exist: /usr/local/apache/htdocs/suspended-page/lo.php
[Wed Apr 29 07:01:43.407874 2026] [:error] [pid 40344:tid 40389] [client 52.230.176.21:9967] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "afE8V5_iiwb4cHXz-JoCRgAAAc4"]
[Wed Apr 29 07:01:44.113428 2026] [:error] [pid 40313:tid 40328] [client 52.230.176.21:9653] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "afE8WKpx5sKFuV9bHzpZNwAAAU0"]
[Wed Apr 29 07:01:45.094594 2026] [:error] [pid 40313:tid 40320] [client 52.230.176.21:9416] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "afE8Wapx5sKFuV9bHzpZOAAAAUU"]
[Wed Apr 29 07:01:45.837934 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:9887] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "afE8WZ_iiwb4cHXz-JoCSQAAAcQ"]
[Wed Apr 29 07:01:46.756941 2026] [:error] [pid 40344:tid 40398] [client 52.230.176.21:9410] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless5.php"] [unique_id "afE8Wp_iiwb4cHXz-JoCSwAAAdc"]
[Wed Apr 29 07:01:47.806542 2026] [:error] [pid 40344:tid 40397] [client 52.230.176.21:51286] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless5.php"] [unique_id "afE8W5_iiwb4cHXz-JoCTAAAAdY"]
[Wed Apr 29 07:01:49.347737 2026] [:error] [pid 56755:tid 56784] [client 52.230.176.21:10063] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless5.php"] [unique_id "afE8XfdXjiwtyGfj4lxMXgAAABQ"]
[Wed Apr 29 07:01:50.682200 2026] [:error] [pid 26594:tid 26603] [client 52.230.176.21:51298] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bless5.php"] [unique_id "afE8Xts-37Kay1vO52k4VwAAAQc"]
[Wed Apr 29 07:01:51.319165 2026] [:error] [pid 56755:tid 56765] [client 52.230.176.21:10002] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "afE8X_dXjiwtyGfj4lxMXwAAAAE"]
[Wed Apr 29 07:01:52.052004 2026] [:error] [pid 40344:tid 40394] [client 52.230.176.21:9981] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "afE8YJ_iiwb4cHXz-JoCTgAAAdM"]
[Wed Apr 29 07:01:53.200219 2026] [:error] [pid 40344:tid 40386] [client 52.230.176.21:10200] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "afE8YZ_iiwb4cHXz-JoCTwAAAcs"]
[Wed Apr 29 07:01:54.599186 2026] [:error] [pid 40313:tid 40338] [client 52.230.176.21:10127] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "afE8Yqpx5sKFuV9bHzpZOQAAAVc"]
[Wed Apr 29 07:01:55.558823 2026] [:error] [pid 40344:tid 40377] [client 52.230.176.21:51625] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "afE8Y5_iiwb4cHXz-JoCVgAAAcI"]
[Wed Apr 29 07:01:56.243826 2026] [:error] [pid 40313:tid 40330] [client 52.230.176.21:10216] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "afE8ZKpx5sKFuV9bHzpZOgAAAU8"]
[Wed Apr 29 07:01:56.820537 2026] [:error] [pid 56863:tid 56885] [client 52.230.176.21:10184] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "afE8ZGQQTEnvYCOsiwLdWgAAANQ"]
[Wed Apr 29 07:01:57.750988 2026] [:error] [pid 56863:tid 56878] [client 52.230.176.21:51293] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "afE8ZWQQTEnvYCOsiwLdWwAAAM0"]
[Wed Apr 29 07:01:58.435973 2026] [:error] [pid 40344:tid 40393] [client 52.230.176.21:10058] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "afE8Zp_iiwb4cHXz-JoCVwAAAdI"]
[Wed Apr 29 07:01:59.693346 2026] [:error] [pid 40343:tid 40366] [client 52.230.176.21:10128] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "afE8Z2iaWCZjSxz2ZNtzMQAAAZI"]
[Wed Apr 29 07:02:00.726321 2026] [:error] [pid 56863:tid 56872] [client 52.230.176.21:10070] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "afE8aGQQTEnvYCOsiwLdXAAAAMc"]
[Wed Apr 29 07:02:01.368000 2026] [:error] [pid 56863:tid 56868] [client 52.230.176.21:10183] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "afE8aWQQTEnvYCOsiwLdXgAAAMM"]
[Wed Apr 29 07:02:01.949661 2026] [:error] [pid 40344:tid 40391] [client 52.230.176.21:9439] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cliner.php"] [unique_id "afE8aZ_iiwb4cHXz-JoCWwAAAdA"]
[Wed Apr 29 07:02:02.666640 2026] [:error] [pid 56863:tid 56865] [client 52.230.176.21:10198] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cliner.php"] [unique_id "afE8amQQTEnvYCOsiwLdXwAAAMA"]
[Wed Apr 29 07:02:03.276190 2026] [:error] [pid 40343:tid 40351] [client 52.230.176.21:10130] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cliner.php"] [unique_id "afE8a2iaWCZjSxz2ZNtzMgAAAYQ"]
[Wed Apr 29 07:02:04.150451 2026] [:error] [pid 40344:tid 40383] [client 52.230.176.21:10228] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-cliner.php"] [unique_id "afE8bJ_iiwb4cHXz-JoCXAAAAcg"]
[Wed Apr 29 07:02:05.086710 2026] [:error] [pid 26594:tid 26612] [client 52.230.176.21:9417] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "afE8bds-37Kay1vO52k4XQAAARA"]
[Wed Apr 29 07:02:05.819221 2026] [:error] [pid 26594:tid 26618] [client 52.230.176.21:10067] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "afE8bds-37Kay1vO52k4XgAAARY"]
[Wed Apr 29 07:02:06.688528 2026] [:error] [pid 40313:tid 40331] [client 52.230.176.21:51321] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "afE8bqpx5sKFuV9bHzpZOwAAAVA"]
[Wed Apr 29 07:02:07.804953 2026] [:error] [pid 26594:tid 26601] [client 52.230.176.21:51305] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/v3.php"] [unique_id "afE8b9s-37Kay1vO52k4XwAAAQU"]
[Wed Apr 29 07:02:08.624871 2026] [:error] [pid 56863:tid 56879] [client 52.230.176.21:51611] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "afE8cGQQTEnvYCOsiwLdYQAAAM4"]
[Wed Apr 29 07:02:09.594291 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:10071] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "afE8cZ_iiwb4cHXz-JoCYwAAAcQ"]
[Wed Apr 29 07:02:10.657837 2026] [:error] [pid 40344:tid 40395] [client 52.230.176.21:9895] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "afE8cp_iiwb4cHXz-JoCZAAAAdQ"]
[Wed Apr 29 07:02:11.409692 2026] [:error] [pid 40313:tid 40337] [client 52.230.176.21:10202] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "afE8c6px5sKFuV9bHzpZPAAAAVY"]
[Wed Apr 29 07:02:12.316093 2026] [:error] [pid 26594:tid 26608] [client 52.230.176.21:10225] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "afE8dNs-37Kay1vO52k4YAAAAQw"]
[Wed Apr 29 07:02:13.315304 2026] [:error] [pid 56756:tid 56814] [client 52.230.176.21:10234] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "afE8dXDi78vq-l2wwMwR3AAAAFY"]
[Wed Apr 29 07:02:14.288914 2026] [:error] [pid 40313:tid 40324] [client 52.230.176.21:10051] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "afE8dqpx5sKFuV9bHzpZPgAAAUk"]
[Wed Apr 29 07:02:15.409524 2026] [:error] [pid 40344:tid 40390] [client 52.230.176.21:10160] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "afE8d5_iiwb4cHXz-JoCbQAAAc8"]
[Wed Apr 29 07:02:16.126449 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:51629] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ton.php"] [unique_id "afE8eJ_iiwb4cHXz-JoCcQAAAcQ"]
[Wed Apr 29 07:02:16.842155 2026] [:error] [pid 56757:tid 56822] [client 52.230.176.21:9942] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ton.php"] [unique_id "afE8ePj76quHaaG1miSWkgAAAIM"]
[Wed Apr 29 07:02:17.562048 2026] [:error] [pid 56863:tid 56877] [client 52.230.176.21:10034] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ton.php"] [unique_id "afE8eWQQTEnvYCOsiwLdZAAAAMw"]
[Wed Apr 29 07:02:18.472096 2026] [:error] [pid 56863:tid 56876] [client 52.230.176.21:10082] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ton.php"] [unique_id "afE8emQQTEnvYCOsiwLdZQAAAMs"]
[Wed Apr 29 07:02:19.372041 2026] [:error] [pid 56863:tid 56874] [client 52.230.176.21:10185] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/forbidals.php"] [unique_id "afE8e2QQTEnvYCOsiwLdaQAAAMk"]
[Wed Apr 29 07:02:19.934663 2026] [:error] [pid 40343:tid 40348] [client 52.230.176.21:10049] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/forbidals.php"] [unique_id "afE8e2iaWCZjSxz2ZNtzOgAAAYE"]
[Wed Apr 29 07:02:20.641878 2026] [:error] [pid 40344:tid 40382] [client 52.230.176.21:9456] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/forbidals.php"] [unique_id "afE8fJ_iiwb4cHXz-JoCdgAAAcc"]
[Wed Apr 29 07:02:21.597135 2026] [:error] [pid 40313:tid 40315] [client 52.230.176.21:9868] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/forbidals.php"] [unique_id "afE8fapx5sKFuV9bHzpZUAAAAUA"]
[Wed Apr 29 07:02:22.317669 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:10162] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zzkhe.php"] [unique_id "afE8fp_iiwb4cHXz-JoCeQAAAcQ"]
[Wed Apr 29 07:02:23.478289 2026] [:error] [pid 56756:tid 56795] [client 52.230.176.21:51637] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zzkhe.php"] [unique_id "afE8f3Di78vq-l2wwMwR3QAAAEM"]
[Wed Apr 29 07:02:24.635980 2026] [:error] [pid 40344:tid 40383] [client 52.230.176.21:10170] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zzkhe.php"] [unique_id "afE8gJ_iiwb4cHXz-JoCfAAAAcg"]
[Wed Apr 29 07:02:25.489124 2026] [:error] [pid 40344:tid 40385] [client 52.230.176.21:51595] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zzkhe.php"] [unique_id "afE8gZ_iiwb4cHXz-JoCgQAAAco"]
[Wed Apr 29 07:02:26.958910 2026] [:error] [pid 40344:tid 40398] [client 52.230.176.21:51302] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xm.php"] [unique_id "afE8gp_iiwb4cHXz-JoChgAAAdc"]
[Wed Apr 29 07:02:27.980833 2026] [:error] [pid 56756:tid 56809] [client 52.230.176.21:10027] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xm.php"] [unique_id "afE8g3Di78vq-l2wwMwR3gAAAFE"]
[Wed Apr 29 07:02:28.974625 2026] [:error] [pid 40344:tid 40378] [client 52.230.176.21:10134] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xm.php"] [unique_id "afE8hJ_iiwb4cHXz-JoCjwAAAcM"]
[Wed Apr 29 07:02:29.516307 2026] [:error] [pid 40343:tid 40353] [client 52.230.176.21:51589] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-xm.php"] [unique_id "afE8hWiaWCZjSxz2ZNtzQwAAAYY"]
[Wed Apr 29 07:02:31.162003 2026] [:error] [pid 56756:tid 56804] [client 52.230.176.21:51585] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cc13.php"] [unique_id "afE8h3Di78vq-l2wwMwR4QAAAEw"]
[Wed Apr 29 07:02:31.880745 2026] [:error] [pid 56863:tid 56876] [client 52.230.176.21:9470] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cc13.php"] [unique_id "afE8h2QQTEnvYCOsiwLdcQAAAMs"]
[Wed Apr 29 07:02:32.367917 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:62264] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cc13.php"] [unique_id "afE8iJ_iiwb4cHXz-JoCoAAAAcQ"]
[Wed Apr 29 07:02:33.446474 2026] [:error] [pid 56757:tid 56841] [client 52.230.176.21:9923] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cc13.php"] [unique_id "afE8ifj76quHaaG1miSWnAAAAJY"]
[Wed Apr 29 07:02:34.340449 2026] [:error] [pid 40344:tid 40379] [client 52.230.176.21:51316] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yas.php"] [unique_id "afE8ip_iiwb4cHXz-JoCqQAAAcQ"]
[Wed Apr 29 07:02:35.321301 2026] [:error] [pid 40313:tid 40319] [client 52.230.176.21:10044] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yas.php"] [unique_id "afE8i6px5sKFuV9bHzpZXwAAAUQ"]
[Wed Apr 29 07:02:36.341919 2026] [:error] [pid 56757:tid 56840] [client 52.230.176.21:10142] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yas.php"] [unique_id "afE8jPj76quHaaG1miSWnQAAAJU"]
[Wed Apr 29 07:02:37.188042 2026] [:error] [pid 40344:tid 40396] [client 52.230.176.21:51311] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yas.php"] [unique_id "afE8jZ_iiwb4cHXz-JoCqgAAAdU"]
[Wed Apr 29 07:02:38.016702 2026] [:error] [pid 40344:tid 40391] [client 52.230.176.21:10080] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "afE8jp_iiwb4cHXz-JoCrAAAAdA"]
[Wed Apr 29 07:02:38.869593 2026] [:error] [pid 40344:tid 40388] [client 52.230.176.21:51318] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "afE8jp_iiwb4cHXz-JoCrgAAAc0"]
[Wed Apr 29 07:02:39.798927 2026] [:error] [pid 40344:tid 40396] [client 52.230.176.21:51601] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "afE8j5_iiwb4cHXz-JoCrwAAAdU"]
[Wed Apr 29 07:02:40.474295 2026] [:error] [pid 40313:tid 40318] [client 52.230.176.21:51317] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "afE8kKpx5sKFuV9bHzpZYQAAAUM"]
[Wed Apr 29 07:02:41.676507 2026] [:error] [pid 56863:tid 56865] [client 52.230.176.21:51283] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asas.php"] [unique_id "afE8kWQQTEnvYCOsiwLdeAAAAMA"]
[Wed Apr 29 07:02:43.522872 2026] [:error] [pid 56863:tid 56883] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/asas.php
[Wed Apr 29 07:02:43.724039 2026] [:error] [pid 56863:tid 56888] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Wed Apr 29 07:02:43.914798 2026] [:error] [pid 56863:tid 56887] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/yellow.php
[Wed Apr 29 07:02:44.167289 2026] [:error] [pid 56863:tid 56870] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/wuasr.php
[Wed Apr 29 07:02:44.358192 2026] [:error] [pid 56863:tid 56889] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Wed Apr 29 07:02:44.567624 2026] [:error] [pid 56863:tid 56879] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/sko.php
[Wed Apr 29 07:02:44.913666 2026] [:error] [pid 56863:tid 56884] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Wed Apr 29 07:02:46.436965 2026] [:error] [pid 56863:tid 56884] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Wed Apr 29 07:02:46.634050 2026] [:error] [pid 56863:tid 56886] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/fileas.php
[Wed Apr 29 07:02:46.893318 2026] [:error] [pid 56863:tid 56875] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Wed Apr 29 07:02:47.086481 2026] [:error] [pid 56863:tid 56881] [client 52.230.176.21:10136] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Wed Apr 29 07:02:47.273711 2026] [:error] [pid 56863:tid 56869] [client 52.230.176.21:10136] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wolv2.php"] [unique_id "afE8l2QQTEnvYCOsiwLdhAAAAMQ"]
[Wed Apr 29 07:02:48.299508 2026] [:error] [pid 40313:tid 40334] [client 52.230.176.21:51608] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wolv2.php"] [unique_id "afE8mKpx5sKFuV9bHzpZYgAAAVM"]
[Wed Apr 29 07:02:49.154126 2026] [:error] [pid 40343:tid 40354] [client 52.230.176.21:51319] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wolv2.php"] [unique_id "afE8mWiaWCZjSxz2ZNtzSgAAAYc"]
[Wed Apr 29 07:02:49.993917 2026] [:error] [pid 56755:tid 56770] [client 52.230.176.21:51282] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wolv2.php"] [unique_id "afE8mfdXjiwtyGfj4lxMagAAAAY"]
[Wed Apr 29 07:02:50.902922 2026] [:error] [pid 56756:tid 56813] [client 52.230.176.21:9411] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-db.php"] [unique_id "afE8mnDi78vq-l2wwMwR5AAAAFU"]
[Wed Apr 29 07:02:52.149696 2026] [:error] [pid 56757:tid 56826] [client 52.230.176.21:10155] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-db.php"] [unique_id "afE8nPj76quHaaG1miSWoAAAAIc"]
[Wed Apr 29 07:02:53.044983 2026] [:error] [pid 40344:tid 40392] [client 52.230.176.21:9929] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-db.php"] [unique_id "afE8nZ_iiwb4cHXz-JoCtAAAAdE"]
[Wed Apr 29 07:02:53.932873 2026] [:error] [pid 40344:tid 40398] [client 52.230.176.21:10154] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-db.php"] [unique_id "afE8nZ_iiwb4cHXz-JoCtQAAAdc"]
[Wed Apr 29 07:02:55.271410 2026] [:error] [pid 40343:tid 40356] [client 52.230.176.21:51636] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-sx10.php"] [unique_id "afE8n2iaWCZjSxz2ZNtzTQAAAYk"]
[Wed Apr 29 07:02:56.771171 2026] [:error] [pid 56863:tid 56876] [client 52.230.176.21:9995] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-sx10.php"] [unique_id "afE8oGQQTEnvYCOsiwLdhQAAAMs"]
[Wed Apr 29 07:02:58.355389 2026] [:error] [pid 40343:tid 40355] [client 52.230.176.21:10122] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-sx10.php"] [unique_id "afE8omiaWCZjSxz2ZNtzTwAAAYg"]
[Wed Apr 29 07:02:59.069200 2026] [:error] [pid 56755:tid 56765] [client 52.230.176.21:10013] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-sx10.php"] [unique_id "afE8o_dXjiwtyGfj4lxMbQAAAAE"]
[Wed Apr 29 07:02:59.939471 2026] [:error] [pid 26594:tid 26614] [client 52.230.176.21:51647] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xml.php"] [unique_id "afE8o9s-37Kay1vO52k4bQAAARI"]
[Wed Apr 29 07:03:01.722499 2026] [:error] [pid 56755:tid 56768] [client 52.230.176.21:10197] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xml.php"] [unique_id "afE8pfdXjiwtyGfj4lxMbwAAAAQ"]
[Wed Apr 29 07:03:03.278684 2026] [:error] [pid 26594:tid 26606] [client 52.230.176.21:10052] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xml.php"] [unique_id "afE8p9s-37Kay1vO52k4bgAAAQo"]
[Wed Apr 29 07:03:04.444150 2026] [:error] [pid 40344:tid 40399] [client 52.230.176.21:9973] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xml.php"] [unique_id "afE8qJ_iiwb4cHXz-JoCtwAAAdg"]
[Wed Apr 29 07:03:05.371644 2026] [:error] [pid 56755:tid 56766] [client 52.230.176.21:10005] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/moon3.php"] [unique_id "afE8qfdXjiwtyGfj4lxMcQAAAAI"]
[Wed Apr 29 07:03:06.520173 2026] [:error] [pid 26594:tid 26607] [client 52.230.176.21:10212] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/moon3.php"] [unique_id "afE8qts-37Kay1vO52k4cQAAAQs"]
[Wed Apr 29 07:03:08.358608 2026] [:error] [pid 56756:tid 56792] [client 52.230.176.21:9935] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/moon3.php"] [unique_id "afE8rHDi78vq-l2wwMwR5gAAAEA"]
[Wed Apr 29 07:03:09.781810 2026] [:error] [pid 26594:tid 26597] [client 52.230.176.21:51624] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/moon3.php"] [unique_id "afE8rds-37Kay1vO52k4cwAAAQE"]
[Wed Apr 29 07:03:11.575033 2026] [:error] [pid 40313:tid 40321] [client 52.230.176.21:51273] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/db.php"] [unique_id "afE8r6px5sKFuV9bHzpZZQAAAUY"]
[Wed Apr 29 07:03:12.897309 2026] [:error] [pid 40313:tid 40338] [client 52.230.176.21:51620] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/db.php"] [unique_id "afE8sKpx5sKFuV9bHzpZZgAAAVc"]
[Wed Apr 29 07:03:13.901984 2026] [:error] [pid 40344:tid 40396] [client 52.230.176.21:51645] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/db.php"] [unique_id "afE8sZ_iiwb4cHXz-JoCuAAAAdU"]
[Wed Apr 29 07:03:14.907338 2026] [:error] [pid 40313:tid 40325] [client 52.230.176.21:10220] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/db.php"] [unique_id "afE8sqpx5sKFuV9bHzpZZwAAAUo"]
[Wed Apr 29 07:03:16.119032 2026] [:error] [pid 40343:tid 40370] [client 52.230.176.21:51634] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "afE8tGiaWCZjSxz2ZNtzUwAAAZY"]
[Wed Apr 29 07:03:17.015085 2026] [:error] [pid 56863:tid 56872] [client 52.230.176.21:10208] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "afE8tWQQTEnvYCOsiwLdiQAAAMc"]
[Wed Apr 29 07:03:19.506193 2026] [:error] [pid 56863:tid 56866] [client 52.230.176.21:10081] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "afE8t2QQTEnvYCOsiwLdiwAAAME"]
[Wed Apr 29 07:03:21.014613 2026] [:error] [pid 26594:tid 26601] [client 52.230.176.21:9462] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "afE8uds-37Kay1vO52k4eAAAAQU"]
[Wed Apr 29 07:03:22.551544 2026] [:error] [pid 40343:tid 40350] [client 52.230.176.21:51614] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/revealability.php"] [unique_id "afE8umiaWCZjSxz2ZNtzVQAAAYM"]
[Wed Apr 29 07:03:23.405909 2026] [:error] [pid 26594:tid 26615] [client 52.230.176.21:10175] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/revealability.php"] [unique_id "afE8u9s-37Kay1vO52k4eQAAARM"]
[Wed Apr 29 07:03:24.903679 2026] [:error] [pid 40343:tid 40354] [client 52.230.176.21:10236] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/revealability.php"] [unique_id "afE8vGiaWCZjSxz2ZNtzVgAAAYc"]
[Wed Apr 29 07:03:26.030915 2026] [:error] [pid 56863:tid 56884] [client 52.230.176.21:51592] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/revealability.php"] [unique_id "afE8vmQQTEnvYCOsiwLdjgAAANM"]
[Wed Apr 29 07:03:27.265958 2026] [:error] [pid 40343:tid 40365] [client 52.230.176.21:10120] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tox.php"] [unique_id "afE8v2iaWCZjSxz2ZNtzVwAAAZE"]
[Wed Apr 29 07:03:29.258043 2026] [:error] [pid 56757:tid 56831] [client 52.230.176.21:51606] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tox.php"] [unique_id "afE8wfj76quHaaG1miSWpAAAAIw"]
[Wed Apr 29 07:03:31.007344 2026] [:error] [pid 56863:tid 56871] [client 52.230.176.21:9925] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tox.php"] [unique_id "afE8w2QQTEnvYCOsiwLdkwAAAMY"]
[Wed Apr 29 07:03:32.888484 2026] [:error] [pid 40344:tid 40394] [client 52.230.176.21:10166] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tox.php"] [unique_id "afE8xJ_iiwb4cHXz-JoCvAAAAdM"]
[Wed Apr 29 07:03:34.472499 2026] [:error] [pid 40344:tid 40390] [client 52.230.176.21:10239] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/packed.php"] [unique_id "afE8xp_iiwb4cHXz-JoCvwAAAc8"]
[Wed Apr 29 07:03:35.884972 2026] [:error] [pid 40344:tid 40377] [client 52.230.176.21:51622] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/packed.php"] [unique_id "afE8x5_iiwb4cHXz-JoCxAAAAcI"]
[Wed Apr 29 07:03:37.776844 2026] [:error] [pid 40313:tid 40336] [client 52.230.176.21:51627] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/packed.php"] [unique_id "afE8yapx5sKFuV9bHzpZbQAAAVU"]
[Wed Apr 29 07:03:38.906436 2026] [:error] [pid 56757:tid 56843] [client 52.230.176.21:9454] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/packed.php"] [unique_id "afE8yvj76quHaaG1miSWpgAAAJg"]
[Wed Apr 29 07:03:40.368735 2026] [:error] [pid 56756:tid 56812] [client 52.230.176.21:51271] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "afE8zHDi78vq-l2wwMwR6gAAAFQ"]
[Wed Apr 29 07:03:41.290271 2026] [:error] [pid 56757:tid 56835] [client 52.230.176.21:51289] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "afE8zfj76quHaaG1miSWpwAAAJA"]
[Wed Apr 29 07:03:42.602218 2026] [:error] [pid 56756:tid 56806] [client 52.230.176.21:10237] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "afE8znDi78vq-l2wwMwR7QAAAE4"]
[Wed Apr 29 07:03:43.326178 2026] [:error] [pid 56863:tid 56879] [client 52.230.176.21:10215] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "afE8z2QQTEnvYCOsiwLdmgAAAM4"]
[Wed Apr 29 07:03:44.341435 2026] [:error] [pid 26594:tid 26613] [client 52.230.176.21:10157] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccu.php"] [unique_id "afE80Ns-37Kay1vO52k4ewAAARE"]
[Wed Apr 29 07:03:45.611766 2026] [:error] [pid 40344:tid 40380] [client 52.230.176.21:9937] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccu.php"] [unique_id "afE80Z_iiwb4cHXz-JoCyAAAAcU"]
[Wed Apr 29 07:03:48.450921 2026] [:error] [pid 40313:tid 40318] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/ccu.php
[Wed Apr 29 07:03:48.641337 2026] [:error] [pid 40313:tid 40329] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/ffile.php
[Wed Apr 29 07:03:48.843512 2026] [:error] [pid 40313:tid 40332] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/class.1.php
[Wed Apr 29 07:03:49.348168 2026] [:error] [pid 40313:tid 40333] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/popo.php
[Wed Apr 29 07:03:49.544138 2026] [:error] [pid 40313:tid 40327] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/academy.php
[Wed Apr 29 07:03:49.750542 2026] [:error] [pid 40313:tid 40317] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xml.php
[Wed Apr 29 07:03:49.941347 2026] [:error] [pid 40313:tid 40326] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Wed Apr 29 07:03:50.205455 2026] [:error] [pid 40313:tid 40321] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Wed Apr 29 07:03:50.395733 2026] [:error] [pid 40313:tid 40338] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Wed Apr 29 07:03:50.593178 2026] [:error] [pid 40313:tid 40325] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Wed Apr 29 07:03:51.070330 2026] [:error] [pid 40313:tid 40328] [client 52.230.176.21:51591] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Wed Apr 29 07:03:51.469488 2026] [:error] [pid 40313:tid 40316] [client 52.230.176.21:51591] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ouh.php"] [unique_id "afE816px5sKFuV9bHzpZewAAAUE"]
[Wed Apr 29 07:03:52.519097 2026] [:error] [pid 40344:tid 40395] [client 52.230.176.21:51613] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ouh.php"] [unique_id "afE82J_iiwb4cHXz-JoCywAAAdQ"]
[Wed Apr 29 07:03:54.264788 2026] [:error] [pid 40344:tid 40399] [client 52.230.176.21:9959] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ouh.php"] [unique_id "afE82p_iiwb4cHXz-JoCzAAAAdg"]
[Wed Apr 29 07:03:55.284353 2026] [:error] [pid 40344:tid 40382] [client 52.230.176.21:10204] [client 52.230.176.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ouh.php"] [unique_id "afE825_iiwb4cHXz-JoCzQAAAcc"]
[Wed Apr 29 23:09:05.357783 2026] [:error] [pid 47618:tid 47633] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Wed Apr 29 23:09:05.594606 2026] [:error] [pid 47618:tid 47643] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Wed Apr 29 23:09:05.833026 2026] [:error] [pid 47618:tid 47645] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 29 23:09:06.069718 2026] [:error] [pid 47618:tid 47634] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Wed Apr 29 23:09:06.307383 2026] [:error] [pid 47618:tid 47626] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Wed Apr 29 23:09:06.564002 2026] [:error] [pid 47618:tid 47622] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Apr 29 23:09:06.807385 2026] [:error] [pid 47618:tid 47632] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Wed Apr 29 23:09:07.043606 2026] [:error] [pid 47618:tid 47629] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Apr 29 23:09:07.280282 2026] [:error] [pid 47618:tid 47638] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Apr 29 23:09:07.516526 2026] [:error] [pid 47618:tid 47636] [client 172.213.161.119:33411] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 29 23:09:07.992374 2026] [:error] [pid 47618:tid 47637] [client 172.213.161.119:33411] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afIfE3HYUSxIrhce2OA0dAAAAVA"]
[Wed Apr 29 23:09:09.046865 2026] [:error] [pid 21227:tid 21249] [client 172.213.161.119:33410] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afIfFcB3c6U5AGPPsXqfUwAAANA"]
[Wed Apr 29 23:09:10.120878 2026] [:error] [pid 21137:tid 21171] [client 172.213.161.119:33168] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afIfFvw-HnaioFPIurV04AAAAAI"]
[Wed Apr 29 23:09:11.143052 2026] [:error] [pid 47618:tid 47628] [client 172.213.161.119:33366] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afIfF3HYUSxIrhce2OA0eAAAAUc"]
[Thu Apr 30 04:20:10.391626 2026] [:error] [pid 52350:tid 52381] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Thu Apr 30 04:20:10.655618 2026] [:error] [pid 52350:tid 52364] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Thu Apr 30 04:20:10.919106 2026] [:error] [pid 52350:tid 52374] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Apr 30 04:20:11.187937 2026] [:error] [pid 52350:tid 52372] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Thu Apr 30 04:20:11.452027 2026] [:error] [pid 52350:tid 52361] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Thu Apr 30 04:20:11.715763 2026] [:error] [pid 52350:tid 52373] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 30 04:20:11.979581 2026] [:error] [pid 52350:tid 52366] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Thu Apr 30 04:20:12.243386 2026] [:error] [pid 52350:tid 52375] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Apr 30 04:20:12.507019 2026] [:error] [pid 52350:tid 52365] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 30 04:20:12.770575 2026] [:error] [pid 52350:tid 52358] [client 158.158.98.94:5405] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 30 04:20:13.878760 2026] [:error] [pid 52350:tid 52364] [client 158.158.98.94:5405] [client 158.158.98.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afJn_f1j4GHE9hm7bfcjqwAAAQY"]
[Thu Apr 30 04:20:14.907581 2026] [:error] [pid 52350:tid 52368] [client 158.158.98.94:5402] [client 158.158.98.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afJn_v1j4GHE9hm7bfcjrQAAAQo"]
[Thu Apr 30 04:20:15.948608 2026] [:error] [pid 52436:tid 52459] [client 158.158.98.94:22383] [client 158.158.98.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afJn_wLFWPk_P7AfE8fNiAAAAVQ"]
[Thu Apr 30 04:20:16.930723 2026] [:error] [pid 18220:tid 18236] [client 158.158.98.94:5353] [client 158.158.98.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afJoAMyESVSfAPebmxbcLQAAAM0"]
[Thu Apr 30 06:04:08.453345 2026] [:error] [pid 18113:tid 18180] [client 172.213.161.119:3335] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Apr 30 06:04:08.689217 2026] [:error] [pid 18113:tid 18200] [client 172.213.161.119:3335] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 30 06:04:09.171381 2026] [:error] [pid 18113:tid 18186] [client 172.213.161.119:3335] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Thu Apr 30 06:04:09.689305 2026] [:error] [pid 18113:tid 18183] [client 172.213.161.119:3335] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Apr 30 06:04:09.927083 2026] [:error] [pid 18113:tid 18187] [client 172.213.161.119:3335] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 30 06:04:10.171113 2026] [:error] [pid 18113:tid 18192] [client 172.213.161.119:3335] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Apr 30 06:04:10.410456 2026] [:error] [pid 18113:tid 18197] [client 172.213.161.119:3335] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 30 06:04:10.661226 2026] [:error] [pid 18113:tid 18184] [client 172.213.161.119:3335] File does not exist: /usr/local/apache/htdocs/suspended-page/meta.php
[Thu Apr 30 06:04:10.894647 2026] [:error] [pid 18113:tid 18195] [client 172.213.161.119:3335] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afKAWniIjwsVGkvz5IlTigAAAJI"]
[Thu Apr 30 06:04:11.863078 2026] [:error] [pid 52350:tid 52364] [client 172.213.161.119:3864] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afKAW_1j4GHE9hm7bfc68wAAAQY"]
[Thu Apr 30 06:04:13.088837 2026] [:error] [pid 52350:tid 52376] [client 172.213.161.119:32602] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afKAXf1j4GHE9hm7bfc69AAAARI"]
[Thu Apr 30 06:04:14.098333 2026] [:error] [pid 52350:tid 52361] [client 172.213.161.119:31715] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afKAXv1j4GHE9hm7bfc69gAAAQM"]
[Thu Apr 30 10:37:28.356285 2026] [:error] [pid 18220:tid 18235] [client 158.158.98.94:25451] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Apr 30 10:37:28.597596 2026] [:error] [pid 18220:tid 18232] [client 158.158.98.94:25451] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 30 10:37:29.080755 2026] [:error] [pid 18220:tid 18223] [client 158.158.98.94:25451] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Thu Apr 30 10:37:29.562130 2026] [:error] [pid 18220:tid 18226] [client 158.158.98.94:25451] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Apr 30 10:37:29.802825 2026] [:error] [pid 18220:tid 18241] [client 158.158.98.94:25451] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 30 10:37:30.046580 2026] [:error] [pid 18220:tid 18242] [client 158.158.98.94:25451] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Apr 30 10:37:30.287662 2026] [:error] [pid 18220:tid 18225] [client 158.158.98.94:25451] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 30 10:37:30.530556 2026] [:error] [pid 18220:tid 18224] [client 158.158.98.94:25451] File does not exist: /usr/local/apache/htdocs/suspended-page/meta.php
[Thu Apr 30 10:37:30.768589 2026] [:error] [pid 18220:tid 18230] [client 158.158.98.94:25451] [client 158.158.98.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afLAasyESVSfAPebmxYPDQAAAMc"]
[Thu Apr 30 10:37:31.755978 2026] [:error] [pid 18111:tid 18122] [client 158.158.98.94:23815] [client 158.158.98.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afLAa2ctLbxB7Q1_oK3E9wAAAAA"]
[Thu Apr 30 10:37:32.716311 2026] [:error] [pid 18112:tid 18163] [client 158.158.98.94:25393] [client 158.158.98.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afLAbCUrJv3y8j6Lm1vT1AAAAE0"]
[Thu Apr 30 10:37:33.671979 2026] [:error] [pid 53641:tid 53658] [client 158.158.98.94:6099] [client 158.158.98.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "afLAbWC119wja3QGeAGVbwAAAYY"]
[Thu Apr 30 12:24:09.751034 2026] [:error] [pid 52436:tid 52441] [client 172.213.161.119:39542] [client 172.213.161.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.213.161.119, incrementing ddos counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "afLZaQLFWPk_P7AfE8cWagAAAUI"]
[Thu Apr 30 12:24:09.755671 2026] [:error] [pid 52436:tid 52441] [client 172.213.161.119:39542] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 30 12:24:10.229302 2026] [:error] [pid 52436:tid 52460] [client 172.213.161.119:39542] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 30 12:24:10.466368 2026] [:error] [pid 52436:tid 52461] [client 172.213.161.119:39542] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 30 12:24:10.939423 2026] [:error] [pid 52436:tid 52442] [client 172.213.161.119:39542] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Thu Apr 30 12:24:11.191026 2026] [:error] [pid 52436:tid 52444] [client 172.213.161.119:39542] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Thu Apr 30 12:24:11.427570 2026] [:error] [pid 52436:tid 52443] [client 172.213.161.119:39542] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Thu Apr 30 12:24:12.373612 2026] [:error] [pid 52436:tid 52454] [client 172.213.161.119:39542] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bak.php"] [unique_id "afLZbALFWPk_P7AfE8cWdQAAAU8"]
[Thu Apr 30 12:24:13.306841 2026] [:error] [pid 52350:tid 52358] [client 172.213.161.119:39561] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bak.php"] [unique_id "afLZbf1j4GHE9hm7bfd7JwAAAQE"]
[Thu Apr 30 12:24:14.270901 2026] [:error] [pid 18113:tid 18184] [client 172.213.161.119:56837] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bak.php"] [unique_id "afLZbniIjwsVGkvz5Il2_wAAAIc"]
[Thu Apr 30 12:24:15.255720 2026] [:error] [pid 18220:tid 18246] [client 172.213.161.119:25062] [client 172.213.161.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bak.php"] [unique_id "afLZb8yESVSfAPebmxYbrAAAANc"]
[Fri May 01 05:14:53.264955 2026] [:error] [pid 6046:tid 6108] [client 104.28.214.115:32230] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/style.php"] [unique_id "afPGTYyBrpmb1HMIbiTGdgAAAZg"]
[Fri May 01 22:28:17.114372 2026] [:error] [pid 50214:tid 50229] [client 34.106.245.234:49370] [client 34.106.245.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "afS4gYs0pgrtfZkbhjN0HQAAAYs"]
[Sat May 02 14:49:09.562700 2026] [:error] [pid 53436:tid 53516] [client 104.207.62.151:61683] [client 104.207.62.151] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "afWeZa9N0xp8fccVM0CzKgAAAJE"]
[Sun May 03 01:13:32.239476 2026] [:error] [pid 52012:tid 52099] [client 20.151.130.38:53126] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afYwvEzSWr-8cpS83mgUYQAAA1Y"]
[Sun May 03 01:13:32.967975 2026] [:error] [pid 52012:tid 52086] [client 20.151.130.38:53140] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afYwvEzSWr-8cpS83mgUZAAAA0k"]
[Sun May 03 01:13:34.241725 2026] [:error] [pid 52012:tid 52093] [client 20.151.130.38:53245] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afYwvkzSWr-8cpS83mgUagAAA1A"]
[Sun May 03 01:13:35.022468 2026] [:error] [pid 22846:tid 22861] [client 20.151.130.38:53237] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afYwv4m1Ms03Mfhp3aYTCQAAAQ0"]
[Sun May 03 01:13:35.248318 2026] [:error] [pid 52012:tid 52082] [client 20.151.130.38:53205] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afYwv0zSWr-8cpS83mgUbAAAA0U"]
[Sun May 03 01:13:35.633681 2026] [:error] [pid 52012:tid 52081] [client 20.151.130.38:53214] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afYwv0zSWr-8cpS83mgUbgAAA0Q"]
[Sun May 03 01:13:36.533228 2026] [:error] [pid 52012:tid 52075] [client 20.151.130.38:53203] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afYwwEzSWr-8cpS83mgUdAAAA0A"]
[Sun May 03 01:13:37.575715 2026] [:error] [pid 52012:tid 52094] [client 20.151.130.38:53132] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "afYwwUzSWr-8cpS83mgUdgAAA1E"]
[Mon May 04 01:25:59.268247 2026] [:error] [pid 54535:tid 54557] [client 34.6.134.138:52334] [client 34.6.134.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "afeFJ_Ryz79iR-ntJRIh0AAAAhQ"]
[Mon May 04 04:56:33.437006 2026] [:error] [pid 57046:tid 57076] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Mon May 04 04:56:33.626838 2026] [:error] [pid 57046:tid 57072] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/card.php
[Mon May 04 04:56:33.911081 2026] [:error] [pid 57046:tid 57082] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Mon May 04 04:56:34.100925 2026] [:error] [pid 57046:tid 57061] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lacoto.php
[Mon May 04 04:56:34.296726 2026] [:error] [pid 57046:tid 57081] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Mon May 04 04:56:34.485766 2026] [:error] [pid 57046:tid 57074] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/ganja.php
[Mon May 04 04:56:34.723298 2026] [:error] [pid 57046:tid 57084] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Mon May 04 04:56:34.989439 2026] [:error] [pid 57046:tid 57071] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-X1s2e6h3p7.php
[Mon May 04 04:56:35.178195 2026] [:error] [pid 57046:tid 57085] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/dragonshell.php
[Mon May 04 04:56:35.370781 2026] [:error] [pid 57046:tid 57069] [client 20.9.82.33:7123] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Mon May 04 04:56:35.556065 2026] [:error] [pid 57046:tid 57077] [client 20.9.82.33:7123] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "afe2g4DA4d1tYGL7mqAaywAAABA"]
[Mon May 04 04:56:36.003134 2026] [:error] [pid 57046:tid 57068] [client 20.9.82.33:7107] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "afe2hIDA4d1tYGL7mqAazQAAAAc"]
[Mon May 04 04:56:36.570096 2026] [:error] [pid 57046:tid 57063] [client 20.9.82.33:7160] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "afe2hIDA4d1tYGL7mqAa0AAAAAI"]
[Mon May 04 04:56:36.986792 2026] [:error] [pid 57046:tid 57064] [client 20.9.82.33:7142] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "afe2hIDA4d1tYGL7mqAa1AAAAAM"]
[Mon May 04 04:56:37.637787 2026] [:error] [pid 57047:tid 57112] [client 20.9.82.33:7165] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj11.php"] [unique_id "afe2hVtCAxKLCAMkLV2P0AAAAFY"]
[Mon May 04 04:56:38.185693 2026] [:error] [pid 57047:tid 57099] [client 20.9.82.33:7059] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj11.php"] [unique_id "afe2hltCAxKLCAMkLV2P0gAAAEk"]
[Mon May 04 04:56:39.062955 2026] [:error] [pid 57154:tid 57173] [client 20.9.82.33:7134] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj11.php"] [unique_id "afe2h_4DAn7umy_ATRzPjQAAANA"]
[Mon May 04 04:56:39.608185 2026] [:error] [pid 57154:tid 57164] [client 20.9.82.33:7157] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj11.php"] [unique_id "afe2h_4DAn7umy_ATRzPjgAAAMc"]
[Mon May 04 04:56:40.376092 2026] [:error] [pid 58625:tid 58649] [client 20.9.82.33:7156] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "afe2iPZfjPGFqq6KSLkFlwAAARU"]
[Mon May 04 04:56:40.866168 2026] [:error] [pid 57154:tid 57175] [client 20.9.82.33:7104] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "afe2iP4DAn7umy_ATRzPkgAAANI"]
[Mon May 04 04:56:41.308400 2026] [:error] [pid 58625:tid 58629] [client 20.9.82.33:7153] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "afe2ifZfjPGFqq6KSLkFmgAAAQE"]
[Mon May 04 04:56:42.125219 2026] [:error] [pid 57046:tid 57080] [client 20.9.82.33:7113] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "afe2ioDA4d1tYGL7mqAa4gAAABM"]
[Mon May 04 04:56:42.759331 2026] [:error] [pid 57154:tid 57164] [client 20.9.82.33:7140] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xroot.php"] [unique_id "afe2iv4DAn7umy_ATRzPlwAAAMc"]
[Mon May 04 04:56:43.263388 2026] [:error] [pid 57154:tid 57180] [client 20.9.82.33:7124] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xroot.php"] [unique_id "afe2i_4DAn7umy_ATRzPmwAAANc"]
[Mon May 04 04:56:43.823721 2026] [:error] [pid 57046:tid 57074] [client 20.9.82.33:7139] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xroot.php"] [unique_id "afe2i4DA4d1tYGL7mqAa5QAAAA0"]
[Mon May 04 04:56:44.378480 2026] [:error] [pid 58625:tid 58643] [client 20.9.82.33:7110] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xroot.php"] [unique_id "afe2jPZfjPGFqq6KSLkFogAAAQ8"]
[Mon May 04 04:56:45.071764 2026] [:error] [pid 58625:tid 58630] [client 20.9.82.33:7125] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "afe2jfZfjPGFqq6KSLkFpwAAAQI"]
[Mon May 04 04:56:45.762537 2026] [:error] [pid 58625:tid 58629] [client 20.9.82.33:7152] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "afe2jfZfjPGFqq6KSLkFqgAAAQE"]
[Mon May 04 04:56:46.552158 2026] [:error] [pid 57048:tid 57130] [client 20.9.82.33:7060] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "afe2joZINtpBgqE164JC4AAAAI0"]
[Mon May 04 04:56:47.046138 2026] [:error] [pid 58625:tid 58633] [client 20.9.82.33:7131] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "afe2j_ZfjPGFqq6KSLkFrwAAAQU"]
[Mon May 04 04:56:47.817908 2026] [:error] [pid 57047:tid 57093] [client 20.9.82.33:7105] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uwu.php"] [unique_id "afe2j1tCAxKLCAMkLV2P1gAAAEM"]
[Mon May 04 04:56:48.545571 2026] [:error] [pid 57154:tid 57164] [client 20.9.82.33:7112] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uwu.php"] [unique_id "afe2kP4DAn7umy_ATRzPowAAAMc"]
[Mon May 04 04:56:49.158822 2026] [:error] [pid 58625:tid 58629] [client 20.9.82.33:7154] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uwu.php"] [unique_id "afe2kfZfjPGFqq6KSLkFuwAAAQE"]
[Mon May 04 04:56:49.757251 2026] [:error] [pid 58625:tid 58635] [client 20.9.82.33:7046] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uwu.php"] [unique_id "afe2kfZfjPGFqq6KSLkFvwAAAQc"]
[Mon May 04 04:56:50.442315 2026] [:error] [pid 57046:tid 57070] [client 20.9.82.33:7130] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aios-bootstrap.php"] [unique_id "afe2koDA4d1tYGL7mqAa7AAAAAk"]
[Mon May 04 04:56:51.173820 2026] [:error] [pid 57154:tid 57163] [client 20.9.82.33:6154] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aios-bootstrap.php"] [unique_id "afe2k_4DAn7umy_ATRzPqwAAAMY"]
[Mon May 04 04:56:51.831942 2026] [:error] [pid 57046:tid 57065] [client 20.9.82.33:7120] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aios-bootstrap.php"] [unique_id "afe2k4DA4d1tYGL7mqAa7wAAAAQ"]
[Mon May 04 04:56:52.516747 2026] [:error] [pid 57154:tid 57172] [client 20.9.82.33:7047] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aios-bootstrap.php"] [unique_id "afe2lP4DAn7umy_ATRzPrgAAAM8"]
[Mon May 04 04:56:53.306473 2026] [:error] [pid 31168:tid 31192] [client 20.9.82.33:7109] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "afe2lbJUVgN8GV2P4h5EjAAAAVY"]
[Mon May 04 04:56:54.084914 2026] [:error] [pid 58625:tid 58646] [client 20.9.82.33:7056] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "afe2lvZfjPGFqq6KSLkFwQAAARI"]
[Mon May 04 04:56:54.554500 2026] [:error] [pid 58625:tid 58642] [client 20.9.82.33:7114] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "afe2lvZfjPGFqq6KSLkFwwAAAQ4"]
[Mon May 04 04:56:55.146675 2026] [:error] [pid 57046:tid 57062] [client 20.9.82.33:7155] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "afe2l4DA4d1tYGL7mqAa8QAAAAE"]
[Mon May 04 04:56:55.632763 2026] [:error] [pid 57154:tid 57169] [client 20.9.82.33:7166] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/006.php"] [unique_id "afe2l_4DAn7umy_ATRzPtQAAAMw"]
[Mon May 04 04:56:56.061137 2026] [:error] [pid 58625:tid 58629] [client 20.9.82.33:7052] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/006.php"] [unique_id "afe2mPZfjPGFqq6KSLkFywAAAQE"]
[Mon May 04 04:56:56.473791 2026] [:error] [pid 58625:tid 58632] [client 20.9.82.33:7137] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/006.php"] [unique_id "afe2mPZfjPGFqq6KSLkFzAAAAQQ"]
[Mon May 04 04:56:56.971321 2026] [:error] [pid 57154:tid 57159] [client 20.9.82.33:7057] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/006.php"] [unique_id "afe2mP4DAn7umy_ATRzPuQAAAMI"]
[Mon May 04 04:56:57.445981 2026] [:error] [pid 57046:tid 57071] [client 20.9.82.33:7149] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "afe2mYDA4d1tYGL7mqAa9AAAAAo"]
[Mon May 04 04:56:57.934522 2026] [:error] [pid 57154:tid 57173] [client 20.9.82.33:7122] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "afe2mf4DAn7umy_ATRzPvAAAANA"]
[Mon May 04 04:56:58.453692 2026] [:error] [pid 58625:tid 58637] [client 20.9.82.33:7081] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "afe2mvZfjPGFqq6KSLkF1gAAAQk"]
[Mon May 04 04:56:59.232335 2026] [:error] [pid 58625:tid 58636] [client 20.9.82.33:7080] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "afe2m_ZfjPGFqq6KSLkF3AAAAQg"]
[Mon May 04 04:57:00.227001 2026] [:error] [pid 57048:tid 57127] [client 20.9.82.33:7158] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "afe2nIZINtpBgqE164JC6wAAAIo"]
[Mon May 04 04:57:01.292824 2026] [:error] [pid 57048:tid 57140] [client 20.9.82.33:7162] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "afe2nYZINtpBgqE164JC7gAAAJc"]
[Mon May 04 04:57:01.902904 2026] [:error] [pid 57154:tid 57181] [client 20.9.82.33:6164] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "afe2nf4DAn7umy_ATRzPxAAAANg"]
[Mon May 04 04:57:02.541572 2026] [:error] [pid 57046:tid 57073] [client 20.9.82.33:7043] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "afe2noDA4d1tYGL7mqAa-QAAAAw"]
[Mon May 04 04:57:03.080194 2026] [:error] [pid 57154:tid 57160] [client 20.9.82.33:7132] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "afe2n_4DAn7umy_ATRzPygAAAMM"]
[Mon May 04 04:57:03.587749 2026] [:error] [pid 57154:tid 57169] [client 20.9.82.33:7048] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "afe2n_4DAn7umy_ATRzPzQAAAMw"]
[Mon May 04 04:57:04.141431 2026] [:error] [pid 57046:tid 57072] [client 20.9.82.33:7136] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "afe2oIDA4d1tYGL7mqAa_QAAAAs"]
[Mon May 04 04:57:04.979332 2026] [:error] [pid 57048:tid 57133] [client 20.9.82.33:7129] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/11.php"] [unique_id "afe2oIZINtpBgqE164JC9QAAAJA"]
[Mon May 04 04:57:05.403902 2026] [:error] [pid 57047:tid 57104] [client 20.9.82.33:6171] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amxloxxr.php"] [unique_id "afe2oVtCAxKLCAMkLV2P6QAAAE4"]
[Mon May 04 04:57:05.984450 2026] [:error] [pid 57047:tid 57111] [client 20.9.82.33:7076] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amxloxxr.php"] [unique_id "afe2oVtCAxKLCAMkLV2P7gAAAFU"]
[Mon May 04 04:57:06.417528 2026] [:error] [pid 57154:tid 57178] [client 20.9.82.33:6150] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amxloxxr.php"] [unique_id "afe2ov4DAn7umy_ATRzP1gAAANU"]
[Mon May 04 04:57:07.015106 2026] [:error] [pid 57154:tid 57162] [client 20.9.82.33:6167] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/amxloxxr.php"] [unique_id "afe2o_4DAn7umy_ATRzP3QAAAMU"]
[Mon May 04 04:57:07.446407 2026] [:error] [pid 57154:tid 57172] [client 20.9.82.33:7163] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qhupyoon.php"] [unique_id "afe2o_4DAn7umy_ATRzP4wAAAM8"]
[Mon May 04 04:57:07.945520 2026] [:error] [pid 57154:tid 57161] [client 20.9.82.33:7072] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qhupyoon.php"] [unique_id "afe2o_4DAn7umy_ATRzP6QAAAMQ"]
[Mon May 04 04:57:08.402692 2026] [:error] [pid 57154:tid 57158] [client 20.9.82.33:7127] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qhupyoon.php"] [unique_id "afe2pP4DAn7umy_ATRzP7wAAAME"]
[Mon May 04 04:57:08.952339 2026] [:error] [pid 57048:tid 57123] [client 20.9.82.33:7069] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qhupyoon.php"] [unique_id "afe2pIZINtpBgqE164JC-gAAAIY"]
[Mon May 04 04:57:09.388692 2026] [:error] [pid 58625:tid 58641] [client 20.9.82.33:7040] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "afe2pfZfjPGFqq6KSLkF7wAAAQ0"]
[Mon May 04 04:57:09.991530 2026] [:error] [pid 58625:tid 58628] [client 20.9.82.33:7116] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "afe2pfZfjPGFqq6KSLkF9AAAAQA"]
[Mon May 04 04:57:10.402471 2026] [:error] [pid 57047:tid 57098] [client 20.9.82.33:7074] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "afe2pltCAxKLCAMkLV2P9AAAAEg"]
[Mon May 04 04:57:10.814478 2026] [:error] [pid 58625:tid 58633] [client 20.9.82.33:7135] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "afe2pvZfjPGFqq6KSLkF9wAAAQU"]
[Mon May 04 04:57:11.354980 2026] [:error] [pid 57048:tid 57121] [client 20.9.82.33:7108] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "afe2p4ZINtpBgqE164JC_QAAAIQ"]
[Mon May 04 04:57:11.844945 2026] [:error] [pid 58625:tid 58636] [client 20.9.82.33:6159] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "afe2p_ZfjPGFqq6KSLkF-wAAAQg"]
[Mon May 04 04:57:12.440521 2026] [:error] [pid 57048:tid 57129] [client 20.9.82.33:7049] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "afe2qIZINtpBgqE164JC_wAAAIw"]
[Mon May 04 04:57:12.943481 2026] [:error] [pid 57048:tid 57134] [client 20.9.82.33:7161] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "afe2qIZINtpBgqE164JDAwAAAJE"]
[Mon May 04 04:57:13.494774 2026] [:error] [pid 57047:tid 57104] [client 20.9.82.33:7079] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6ap7e.php"] [unique_id "afe2qVtCAxKLCAMkLV2P9gAAAE4"]
[Mon May 04 04:57:14.101826 2026] [:error] [pid 57046:tid 57077] [client 20.9.82.33:7118] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6ap7e.php"] [unique_id "afe2qoDA4d1tYGL7mqAbAwAAABA"]
[Mon May 04 04:57:14.654043 2026] [:error] [pid 58625:tid 58640] [client 20.9.82.33:7146] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6ap7e.php"] [unique_id "afe2qvZfjPGFqq6KSLkF_QAAAQw"]
[Mon May 04 04:57:15.192531 2026] [:error] [pid 58625:tid 58643] [client 20.9.82.33:7050] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/6ap7e.php"] [unique_id "afe2q_ZfjPGFqq6KSLkF_wAAAQ8"]
[Mon May 04 04:57:15.654857 2026] [:error] [pid 58625:tid 58646] [client 20.9.82.33:7077] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "afe2q_ZfjPGFqq6KSLkGAAAAARI"]
[Mon May 04 04:57:16.123102 2026] [:error] [pid 57047:tid 57107] [client 20.9.82.33:7159] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "afe2rFtCAxKLCAMkLV2P9wAAAFE"]
[Mon May 04 04:57:16.863724 2026] [:error] [pid 57046:tid 57065] [client 20.9.82.33:7121] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "afe2rIDA4d1tYGL7mqAbBwAAAAQ"]
[Mon May 04 04:57:17.690954 2026] [:error] [pid 31168:tid 31185] [client 20.9.82.33:6149] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cilus.php"] [unique_id "afe2rbJUVgN8GV2P4h5EnAAAAU8"]
[Mon May 04 04:57:18.214005 2026] [:error] [pid 57048:tid 57123] [client 20.9.82.33:7141] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "afe2roZINtpBgqE164JDBwAAAIY"]
[Mon May 04 04:57:18.760895 2026] [:error] [pid 57048:tid 57130] [client 20.9.82.33:7138] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "afe2roZINtpBgqE164JDCQAAAI0"]
[Mon May 04 04:57:19.255861 2026] [:error] [pid 31168:tid 31183] [client 20.9.82.33:7164] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "afe2r7JUVgN8GV2P4h5EoAAAAU0"]
[Mon May 04 04:57:19.871848 2026] [:error] [pid 57048:tid 57132] [client 20.9.82.33:7151] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "afe2r4ZINtpBgqE164JDDgAAAI8"]
[Mon May 04 04:57:20.292818 2026] [:error] [pid 57154:tid 57179] [client 20.9.82.33:7045] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fone1.php"] [unique_id "afe2sP4DAn7umy_ATRzP9gAAANY"]
[Mon May 04 04:57:20.800330 2026] [:error] [pid 57154:tid 57158] [client 20.9.82.33:6151] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fone1.php"] [unique_id "afe2sP4DAn7umy_ATRzP9wAAAME"]
[Mon May 04 04:57:21.395202 2026] [:error] [pid 57154:tid 57178] [client 20.9.82.33:7055] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fone1.php"] [unique_id "afe2sf4DAn7umy_ATRzP-AAAANU"]
[Mon May 04 04:57:22.095640 2026] [:error] [pid 31168:tid 31190] [client 20.9.82.33:7133] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fone1.php"] [unique_id "afe2srJUVgN8GV2P4h5EowAAAVQ"]
[Mon May 04 04:57:22.593428 2026] [:error] [pid 57048:tid 57129] [client 20.9.82.33:6177] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "afe2soZINtpBgqE164JDEAAAAIw"]
[Mon May 04 04:57:23.339599 2026] [:error] [pid 57048:tid 57119] [client 20.9.82.33:7041] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "afe2s4ZINtpBgqE164JDEgAAAII"]
[Mon May 04 04:57:23.937183 2026] [:error] [pid 58625:tid 58639] [client 20.9.82.33:7064] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "afe2s_ZfjPGFqq6KSLkGEAAAAQs"]
[Mon May 04 04:57:24.483180 2026] [:error] [pid 58625:tid 58646] [client 20.9.82.33:7062] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "afe2tPZfjPGFqq6KSLkGFAAAARI"]
[Mon May 04 04:57:25.394685 2026] [:error] [pid 58625:tid 58636] [client 20.9.82.33:7053] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoper1.php"] [unique_id "afe2tfZfjPGFqq6KSLkGGQAAAQg"]
[Mon May 04 04:57:26.340209 2026] [:error] [pid 57048:tid 57141] [client 20.9.82.33:6160] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoper1.php"] [unique_id "afe2toZINtpBgqE164JDFgAAAJg"]
[Mon May 04 04:57:26.806302 2026] [:error] [pid 57154:tid 57172] [client 20.9.82.33:6176] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoper1.php"] [unique_id "afe2tv4DAn7umy_ATRzP_AAAAM8"]
[Mon May 04 04:57:27.515411 2026] [:error] [pid 31168:tid 31191] [client 20.9.82.33:6145] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoper1.php"] [unique_id "afe2t7JUVgN8GV2P4h5ErQAAAVU"]
[Mon May 04 04:57:27.948966 2026] [:error] [pid 57048:tid 57124] [client 20.9.82.33:6173] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atkno.php"] [unique_id "afe2t4ZINtpBgqE164JDGAAAAIc"]
[Mon May 04 04:57:28.387112 2026] [:error] [pid 57046:tid 57077] [client 20.9.82.33:7087] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atkno.php"] [unique_id "afe2uIDA4d1tYGL7mqAbEQAAABA"]
[Mon May 04 04:57:28.808223 2026] [:error] [pid 31168:tid 31188] [client 20.9.82.33:7044] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atkno.php"] [unique_id "afe2uLJUVgN8GV2P4h5EsQAAAVI"]
[Mon May 04 04:57:29.367289 2026] [:error] [pid 31168:tid 31177] [client 20.9.82.33:7106] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atkno.php"] [unique_id "afe2ubJUVgN8GV2P4h5EswAAAUc"]
[Mon May 04 04:57:30.207444 2026] [:error] [pid 57048:tid 57127] [client 20.9.82.33:6146] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "afe2uoZINtpBgqE164JDYQAAAIo"]
[Mon May 04 04:57:31.050012 2026] [:error] [pid 57154:tid 57180] [client 20.9.82.33:7083] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "afe2u_4DAn7umy_ATRzQKgAAANc"]
[Mon May 04 04:57:31.797806 2026] [:error] [pid 57047:tid 57102] [client 20.9.82.33:6194] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "afe2u1tCAxKLCAMkLV2QAQAAAEw"]
[Mon May 04 04:57:32.963032 2026] [:error] [pid 57046:tid 57085] [client 20.9.82.33:7143] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "afe2vIDA4d1tYGL7mqAbHQAAABg"]
[Mon May 04 04:57:33.630718 2026] [:error] [pid 57047:tid 57113] [client 20.9.82.33:6168] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/insta.php"] [unique_id "afe2vVtCAxKLCAMkLV2QDAAAAFc"]
[Mon May 04 04:57:34.344585 2026] [:error] [pid 31168:tid 31191] [client 20.9.82.33:6147] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/insta.php"] [unique_id "afe2vrJUVgN8GV2P4h5EuQAAAVU"]
[Mon May 04 04:57:35.209608 2026] [:error] [pid 57047:tid 57091] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/insta.php
[Mon May 04 04:57:35.400317 2026] [:error] [pid 57047:tid 57096] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/wpxl.php
[Mon May 04 04:57:35.610169 2026] [:error] [pid 57047:tid 57099] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/admlo.php
[Mon May 04 04:57:35.799121 2026] [:error] [pid 57047:tid 57100] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php
[Mon May 04 04:57:36.101059 2026] [:error] [pid 57047:tid 57102] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/ptanf.php
[Mon May 04 04:57:36.290381 2026] [:error] [pid 57047:tid 57095] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/ctex1.php
[Mon May 04 04:57:36.483045 2026] [:error] [pid 57047:tid 57105] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Mon May 04 04:57:36.673763 2026] [:error] [pid 57047:tid 57103] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Mon May 04 04:57:36.878367 2026] [:error] [pid 57047:tid 57090] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Mon May 04 04:57:37.106886 2026] [:error] [pid 57047:tid 57092] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/axe.php
[Mon May 04 04:57:37.296484 2026] [:error] [pid 57047:tid 57094] [client 20.9.82.33:7117] File does not exist: /usr/local/apache/htdocs/suspended-page/index0.php
[Mon May 04 04:57:37.755010 2026] [:error] [pid 57047:tid 57104] [client 20.9.82.33:7117] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-01ul.php"] [unique_id "afe2wVtCAxKLCAMkLV2QHQAAAE4"]
[Mon May 04 04:57:38.550831 2026] [:error] [pid 57048:tid 57119] [client 20.9.82.33:7068] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-01ul.php"] [unique_id "afe2woZINtpBgqE164JDfgAAAII"]
[Mon May 04 04:57:39.639321 2026] [:error] [pid 57048:tid 57126] [client 20.9.82.33:7042] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-01ul.php"] [unique_id "afe2w4ZINtpBgqE164JDgQAAAIk"]
[Mon May 04 04:57:40.452376 2026] [:error] [pid 57048:tid 57120] [client 20.9.82.33:6162] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-01ul.php"] [unique_id "afe2xIZINtpBgqE164JDhAAAAIM"]
[Mon May 04 04:57:41.347513 2026] [:error] [pid 57048:tid 57138] [client 20.9.82.33:7144] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/e3.php"] [unique_id "afe2xYZINtpBgqE164JDiAAAAJU"]
[Mon May 04 04:57:41.840014 2026] [:error] [pid 57048:tid 57135] [client 20.9.82.33:6198] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/e3.php"] [unique_id "afe2xYZINtpBgqE164JDiQAAAJI"]
[Mon May 04 04:57:42.270007 2026] [:error] [pid 58625:tid 58628] [client 20.9.82.33:7088] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/e3.php"] [unique_id "afe2xvZfjPGFqq6KSLkGKgAAAQA"]
[Mon May 04 04:57:42.941579 2026] [:error] [pid 57047:tid 57106] [client 20.9.82.33:6169] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/e3.php"] [unique_id "afe2xltCAxKLCAMkLV2QIwAAAFA"]
[Mon May 04 04:57:43.459472 2026] [:error] [pid 58625:tid 58629] [client 20.9.82.33:7132] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fkohd.php"] [unique_id "afe2x_ZfjPGFqq6KSLkGLwAAAQE"]
[Mon May 04 04:57:44.414871 2026] [:error] [pid 57046:tid 57076] [client 20.9.82.33:6979] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fkohd.php"] [unique_id "afe2yIDA4d1tYGL7mqAbJwAAAA8"]
[Mon May 04 04:57:45.020691 2026] [:error] [pid 58625:tid 58641] [client 20.9.82.33:6166] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fkohd.php"] [unique_id "afe2yfZfjPGFqq6KSLkGNAAAAQ0"]
[Mon May 04 04:57:45.495437 2026] [:error] [pid 31168:tid 31184] [client 20.9.82.33:7071] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fkohd.php"] [unique_id "afe2ybJUVgN8GV2P4h5ExQAAAU4"]
[Mon May 04 04:57:46.086778 2026] [:error] [pid 57048:tid 57132] [client 20.9.82.33:7078] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws78.php"] [unique_id "afe2yoZINtpBgqE164JDkQAAAI8"]
[Mon May 04 04:57:46.639364 2026] [:error] [pid 58625:tid 58651] [client 20.9.82.33:7085] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws78.php"] [unique_id "afe2yvZfjPGFqq6KSLkGOQAAARc"]
[Mon May 04 04:57:47.261684 2026] [:error] [pid 57047:tid 57111] [client 20.9.82.33:6158] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws78.php"] [unique_id "afe2y1tCAxKLCAMkLV2QJAAAAFU"]
[Mon May 04 04:57:47.736749 2026] [:error] [pid 57046:tid 57064] [client 20.9.82.33:7008] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws78.php"] [unique_id "afe2y4DA4d1tYGL7mqAbLQAAAAM"]
[Mon May 04 04:57:48.456939 2026] [:error] [pid 57046:tid 57078] [client 20.9.82.33:7090] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "afe2zIDA4d1tYGL7mqAbLwAAABE"]
[Mon May 04 04:57:49.157965 2026] [:error] [pid 58625:tid 58634] [client 20.9.82.33:7092] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "afe2zfZfjPGFqq6KSLkGPgAAAQY"]
[Mon May 04 04:57:49.690491 2026] [:error] [pid 57046:tid 57066] [client 20.9.82.33:7067] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "afe2zYDA4d1tYGL7mqAbMgAAAAU"]
[Mon May 04 04:57:50.381545 2026] [:error] [pid 57154:tid 57157] [client 20.9.82.33:7130] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "afe2zv4DAn7umy_ATRzQOAAAAMA"]
[Mon May 04 04:57:51.080335 2026] [:error] [pid 57046:tid 57062] [client 20.9.82.33:6993] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zo.php"] [unique_id "afe2z4DA4d1tYGL7mqAbNwAAAAE"]
[Mon May 04 04:57:51.614636 2026] [:error] [pid 57154:tid 57179] [client 20.9.82.33:6148] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zo.php"] [unique_id "afe2z_4DAn7umy_ATRzQPAAAANY"]
[Mon May 04 04:57:52.239892 2026] [:error] [pid 57048:tid 57136] [client 20.9.82.33:7147] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zo.php"] [unique_id "afe20IZINtpBgqE164JDnQAAAJM"]
[Mon May 04 04:57:52.736421 2026] [:error] [pid 57048:tid 57124] [client 20.9.82.33:7065] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zo.php"] [unique_id "afe20IZINtpBgqE164JDnwAAAIc"]
[Mon May 04 04:57:53.357522 2026] [:error] [pid 58625:tid 58636] [client 20.9.82.33:7066] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "afe20fZfjPGFqq6KSLkGSAAAAQg"]
[Mon May 04 04:57:54.089039 2026] [:error] [pid 58625:tid 58631] [client 20.9.82.33:6986] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "afe20vZfjPGFqq6KSLkGSgAAAQM"]
[Mon May 04 04:57:54.559286 2026] [:error] [pid 57154:tid 57163] [client 20.9.82.33:7075] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "afe20v4DAn7umy_ATRzQQAAAAMY"]
[Mon May 04 04:57:55.205194 2026] [:error] [pid 57154:tid 57177] [client 20.9.82.33:6157] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "afe20_4DAn7umy_ATRzQQQAAANQ"]
[Mon May 04 04:57:55.962990 2026] [:error] [pid 58625:tid 58648] [client 20.9.82.33:6172] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/masks.php"] [unique_id "afe20_ZfjPGFqq6KSLkGTgAAARQ"]
[Mon May 04 04:57:56.881820 2026] [:error] [pid 57047:tid 57110] [client 20.9.82.33:6189] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/masks.php"] [unique_id "afe21FtCAxKLCAMkLV2QKQAAAFQ"]
[Mon May 04 04:57:57.480421 2026] [:error] [pid 57047:tid 57104] [client 20.9.82.33:6155] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/masks.php"] [unique_id "afe21VtCAxKLCAMkLV2QKgAAAE4"]
[Mon May 04 04:57:58.027981 2026] [:error] [pid 57154:tid 57162] [client 20.9.82.33:7128] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/masks.php"] [unique_id "afe21v4DAn7umy_ATRzQRAAAAMU"]
[Mon May 04 04:57:58.620853 2026] [:error] [pid 58625:tid 58645] [client 20.9.82.33:7148] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "afe21vZfjPGFqq6KSLkGTwAAARE"]
[Mon May 04 04:57:59.120962 2026] [:error] [pid 31168:tid 31171] [client 20.9.82.33:7091] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "afe217JUVgN8GV2P4h5E1QAAAUE"]
[Mon May 04 04:57:59.700394 2026] [:error] [pid 57154:tid 57181] [client 20.9.82.33:7097] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "afe21_4DAn7umy_ATRzQRwAAANg"]
[Mon May 04 04:58:00.259010 2026] [:error] [pid 57047:tid 57108] [client 20.9.82.33:6170] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "afe22FtCAxKLCAMkLV2QLwAAAFI"]
[Mon May 04 04:58:00.814977 2026] [:error] [pid 57047:tid 57101] [client 20.9.82.33:7026] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "afe22FtCAxKLCAMkLV2QMQAAAEs"]
[Mon May 04 04:58:01.313098 2026] [:error] [pid 57048:tid 57122] [client 20.9.82.33:7103] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "afe22YZINtpBgqE164JDqAAAAIU"]
[Mon May 04 04:58:01.935777 2026] [:error] [pid 57048:tid 57124] [client 20.9.82.33:6977] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "afe22YZINtpBgqE164JDrQAAAIc"]
[Mon May 04 04:58:02.812458 2026] [:error] [pid 58625:tid 58630] [client 20.9.82.33:7051] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "afe22vZfjPGFqq6KSLkGUQAAAQI"]
[Mon May 04 04:58:03.487287 2026] [:error] [pid 31168:tid 31172] [client 20.9.82.33:7006] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "afe227JUVgN8GV2P4h5E2AAAAUI"]
[Mon May 04 04:58:04.039194 2026] [:error] [pid 58625:tid 58633] [client 20.9.82.33:6195] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "afe23PZfjPGFqq6KSLkGVQAAAQU"]
[Mon May 04 04:58:04.679853 2026] [:error] [pid 58625:tid 58631] [client 20.9.82.33:7089] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "afe23PZfjPGFqq6KSLkGWAAAAQM"]
[Mon May 04 04:58:05.327660 2026] [:error] [pid 58625:tid 58632] [client 20.9.82.33:7096] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "afe23fZfjPGFqq6KSLkGWgAAAQQ"]
[Mon May 04 04:58:06.133308 2026] [:error] [pid 58625:tid 58637] [client 20.9.82.33:7014] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vv.php"] [unique_id "afe23vZfjPGFqq6KSLkGXwAAAQk"]
[Mon May 04 04:58:06.767695 2026] [:error] [pid 57047:tid 57091] [client 20.9.82.33:6156] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vv.php"] [unique_id "afe23ltCAxKLCAMkLV2QMgAAAEE"]
[Mon May 04 04:58:07.462048 2026] [:error] [pid 57154:tid 57168] [client 20.9.82.33:7071] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vv.php"] [unique_id "afe23_4DAn7umy_ATRzQTQAAAMs"]
[Mon May 04 04:58:08.136517 2026] [:error] [pid 57154:tid 57181] [client 20.9.82.33:7061] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vv.php"] [unique_id "afe24P4DAn7umy_ATRzQTwAAANg"]
[Mon May 04 04:58:08.723726 2026] [:error] [pid 57047:tid 57105] [client 20.9.82.33:6929] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpconf.php"] [unique_id "afe24FtCAxKLCAMkLV2QNAAAAE8"]
[Mon May 04 04:58:09.377286 2026] [:error] [pid 57154:tid 57160] [client 20.9.82.33:6201] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpconf.php"] [unique_id "afe24f4DAn7umy_ATRzQUgAAAMM"]
[Mon May 04 04:58:09.852539 2026] [:error] [pid 57047:tid 57090] [client 20.9.82.33:6920] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpconf.php"] [unique_id "afe24VtCAxKLCAMkLV2QNQAAAEA"]
[Mon May 04 04:58:10.657789 2026] [:error] [pid 57154:tid 57180] [client 20.9.82.33:7099] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpconf.php"] [unique_id "afe24v4DAn7umy_ATRzQVgAAANc"]
[Mon May 04 04:58:11.490515 2026] [:error] [pid 58625:tid 58631] [client 20.9.82.33:7126] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "afe24_ZfjPGFqq6KSLkGcQAAAQM"]
[Mon May 04 04:58:12.114895 2026] [:error] [pid 58625:tid 58642] [client 20.9.82.33:7073] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "afe25PZfjPGFqq6KSLkGdAAAAQ4"]
[Mon May 04 04:58:12.591023 2026] [:error] [pid 58625:tid 58634] [client 20.9.82.33:6981] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "afe25PZfjPGFqq6KSLkGdgAAAQY"]
[Mon May 04 04:58:13.537070 2026] [:error] [pid 58625:tid 58649] [client 20.9.82.33:6180] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "afe25fZfjPGFqq6KSLkGewAAARU"]
[Mon May 04 04:58:14.329680 2026] [:error] [pid 31168:tid 31171] [client 20.9.82.33:6163] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-zx.php"] [unique_id "afe25rJUVgN8GV2P4h5E3AAAAUE"]
[Mon May 04 04:58:14.831747 2026] [:error] [pid 58625:tid 58631] [client 20.9.82.33:6144] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-zx.php"] [unique_id "afe25vZfjPGFqq6KSLkGfwAAAQM"]
[Mon May 04 04:58:15.597180 2026] [:error] [pid 57154:tid 57179] [client 20.9.82.33:6999] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-zx.php"] [unique_id "afe25_4DAn7umy_ATRzQWwAAANY"]
[Mon May 04 04:58:16.328519 2026] [:error] [pid 31168:tid 31177] [client 20.9.82.33:6987] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-zx.php"] [unique_id "afe26LJUVgN8GV2P4h5E4QAAAUc"]
[Mon May 04 04:58:16.889323 2026] [:error] [pid 58625:tid 58644] [client 20.9.82.33:6190] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "afe26PZfjPGFqq6KSLkGggAAARA"]
[Mon May 04 04:58:17.523841 2026] [:error] [pid 58625:tid 58635] [client 20.9.82.33:6948] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "afe26fZfjPGFqq6KSLkGhAAAAQc"]
[Mon May 04 04:58:19.014456 2026] [:error] [pid 58625:tid 58629] [client 20.9.82.33:7016] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "afe26_ZfjPGFqq6KSLkGigAAAQE"]
[Mon May 04 04:58:19.595001 2026] [:error] [pid 57154:tid 57158] [client 20.9.82.33:7167] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "afe26_4DAn7umy_ATRzQYwAAAME"]
[Mon May 04 04:58:20.593822 2026] [:error] [pid 58625:tid 58641] [client 20.9.82.33:6199] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mar.php"] [unique_id "afe27PZfjPGFqq6KSLkGjgAAAQ0"]
[Mon May 04 04:58:21.228562 2026] [:error] [pid 58625:tid 58646] [client 20.9.82.33:6153] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mar.php"] [unique_id "afe27fZfjPGFqq6KSLkGkQAAARI"]
[Mon May 04 04:58:21.931206 2026] [:error] [pid 57154:tid 57177] [client 20.9.82.33:7100] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mar.php"] [unique_id "afe27f4DAn7umy_ATRzQZgAAANQ"]
[Mon May 04 04:58:22.961610 2026] [:error] [pid 58625:tid 58632] [client 20.9.82.33:6179] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mar.php"] [unique_id "afe27vZfjPGFqq6KSLkGkwAAAQQ"]
[Mon May 04 04:58:23.485388 2026] [:error] [pid 57154:tid 57164] [client 20.9.82.33:6997] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/iov.php"] [unique_id "afe27_4DAn7umy_ATRzQagAAAMc"]
[Mon May 04 04:58:24.184482 2026] [:error] [pid 57154:tid 57176] [client 20.9.82.33:7000] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/iov.php"] [unique_id "afe28P4DAn7umy_ATRzQbgAAANM"]
[Mon May 04 04:58:25.091366 2026] [:error] [pid 31168:tid 31191] [client 20.9.82.33:6985] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/iov.php"] [unique_id "afe28bJUVgN8GV2P4h5E5wAAAVU"]
[Mon May 04 04:58:25.567999 2026] [:error] [pid 57048:tid 57125] [client 20.9.82.33:6200] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/iov.php"] [unique_id "afe28YZINtpBgqE164JDxAAAAIg"]
[Mon May 04 04:58:26.158127 2026] [:error] [pid 57046:tid 57078] [client 20.9.82.33:7145] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jodohghi.php"] [unique_id "afe28oDA4d1tYGL7mqAbRQAAABE"]
[Mon May 04 04:58:26.989567 2026] [:error] [pid 57047:tid 57107] [client 20.9.82.33:6992] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jodohghi.php"] [unique_id "afe28ltCAxKLCAMkLV2QPwAAAFE"]
[Mon May 04 04:58:28.456936 2026] [:error] [pid 57154:tid 57171] [client 20.9.82.33:7012] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jodohghi.php"] [unique_id "afe29P4DAn7umy_ATRzQcwAAAM4"]
[Mon May 04 04:58:29.888878 2026] [:error] [pid 57047:tid 57110] [client 20.9.82.33:6207] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jodohghi.php"] [unique_id "afe29VtCAxKLCAMkLV2QQAAAAFQ"]
[Mon May 04 04:58:31.023689 2026] [:error] [pid 58625:tid 58632] [client 20.9.82.33:7005] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rendi59.php"] [unique_id "afe29_ZfjPGFqq6KSLkGoAAAAQQ"]
[Mon May 04 04:58:31.984456 2026] [:error] [pid 57048:tid 57121] [client 20.9.82.33:6203] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rendi59.php"] [unique_id "afe294ZINtpBgqE164JD0AAAAIQ"]
[Mon May 04 04:58:33.811199 2026] [:error] [pid 58625:tid 58634] [client 20.9.82.33:6206] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rendi59.php"] [unique_id "afe2-fZfjPGFqq6KSLkGpgAAAQY"]
[Mon May 04 04:58:34.833045 2026] [:error] [pid 58625:tid 58645] [client 20.9.82.33:6991] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rendi59.php"] [unique_id "afe2-vZfjPGFqq6KSLkGrAAAARE"]
[Mon May 04 04:58:36.191698 2026] [:error] [pid 57154:tid 57162] [client 20.9.82.33:6945] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rivasqup.php"] [unique_id "afe2_P4DAn7umy_ATRzQewAAAMU"]
[Mon May 04 04:58:37.172305 2026] [:error] [pid 58625:tid 58636] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/rivasqup.php
[Mon May 04 04:58:37.363122 2026] [:error] [pid 58625:tid 58628] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/mga.php
[Mon May 04 04:58:37.559854 2026] [:error] [pid 58625:tid 58630] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/dshtv.php
[Mon May 04 04:58:37.907111 2026] [:error] [pid 58625:tid 58644] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/sym403.php
[Mon May 04 04:58:38.188534 2026] [:error] [pid 58625:tid 58650] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/temp1.php
[Mon May 04 04:58:38.381601 2026] [:error] [pid 58625:tid 58637] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Mon May 04 04:58:39.975496 2026] [:error] [pid 58625:tid 58637] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon May 04 04:58:40.226222 2026] [:error] [pid 58625:tid 58632] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Mon May 04 04:58:40.430115 2026] [:error] [pid 58625:tid 58634] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/bbny.php
[Mon May 04 04:58:40.747538 2026] [:error] [pid 58625:tid 58644] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/ggb.php
[Mon May 04 04:58:41.000772 2026] [:error] [pid 58625:tid 58642] [client 20.9.82.33:7001] File does not exist: /usr/local/apache/htdocs/suspended-page/zhw.php
[Mon May 04 04:58:41.199231 2026] [:error] [pid 58625:tid 58629] [client 20.9.82.33:7001] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "afe3AfZfjPGFqq6KSLkGxgAAAQE"]
[Mon May 04 04:58:42.407784 2026] [:error] [pid 57154:tid 57174] [client 20.9.82.33:6161] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "afe3Av4DAn7umy_ATRzQiAAAANE"]
[Mon May 04 04:58:42.974910 2026] [:error] [pid 58625:tid 58652] [client 20.9.82.33:6914] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "afe3AvZfjPGFqq6KSLkGzAAAARg"]
[Mon May 04 04:58:43.420624 2026] [:error] [pid 57154:tid 57179] [client 20.9.82.33:6196] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "afe3A_4DAn7umy_ATRzQigAAANY"]
[Mon May 04 04:58:44.191160 2026] [:error] [pid 57154:tid 57169] [client 20.9.82.33:6996] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "afe3BP4DAn7umy_ATRzQjwAAAMw"]
[Mon May 04 04:58:45.337332 2026] [:error] [pid 57154:tid 57163] [client 20.9.82.33:7058] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "afe3Bf4DAn7umy_ATRzQkgAAAMY"]
[Mon May 04 04:58:45.881357 2026] [:error] [pid 57154:tid 57181] [client 20.9.82.33:7094] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "afe3Bf4DAn7umy_ATRzQlAAAANg"]
[Mon May 04 04:58:46.486208 2026] [:error] [pid 57154:tid 57177] [client 20.9.82.33:7119] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "afe3Bv4DAn7umy_ATRzQlwAAANQ"]
[Mon May 04 04:58:47.425929 2026] [:error] [pid 57154:tid 57167] [client 20.9.82.33:7070] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lov.php"] [unique_id "afe3B_4DAn7umy_ATRzQmgAAAMo"]
[Mon May 04 04:58:48.147004 2026] [:error] [pid 31168:tid 31192] [client 20.9.82.33:6175] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lov.php"] [unique_id "afe3CLJUVgN8GV2P4h5E9AAAAVY"]
[Mon May 04 04:58:48.823083 2026] [:error] [pid 31168:tid 31171] [client 20.9.82.33:7034] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lov.php"] [unique_id "afe3CLJUVgN8GV2P4h5E9QAAAUE"]
[Mon May 04 04:58:49.322007 2026] [:error] [pid 31168:tid 31174] [client 20.9.82.33:7054] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lov.php"] [unique_id "afe3CbJUVgN8GV2P4h5E-AAAAUQ"]
[Mon May 04 04:58:49.898999 2026] [:error] [pid 57154:tid 57175] [client 20.9.82.33:6183] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/knw.php"] [unique_id "afe3Cf4DAn7umy_ATRzQnQAAANI"]
[Mon May 04 04:58:50.489624 2026] [:error] [pid 57048:tid 57127] [client 20.9.82.33:6187] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/knw.php"] [unique_id "afe3CoZINtpBgqE164JD4wAAAIo"]
[Mon May 04 04:58:51.141297 2026] [:error] [pid 57047:tid 57109] [client 20.9.82.33:6946] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/knw.php"] [unique_id "afe3C1tCAxKLCAMkLV2QRwAAAFM"]
[Mon May 04 04:58:52.659745 2026] [:error] [pid 58625:tid 58637] [client 20.9.82.33:6202] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/knw.php"] [unique_id "afe3DPZfjPGFqq6KSLkG3wAAAQk"]
[Mon May 04 04:58:53.216631 2026] [:error] [pid 57048:tid 57134] [client 20.9.82.33:6994] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "afe3DYZINtpBgqE164JD5QAAAJE"]
[Mon May 04 04:58:55.677217 2026] [:error] [pid 58625:tid 58650] [client 20.9.82.33:7063] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "afe3D_ZfjPGFqq6KSLkG5gAAARY"]
[Mon May 04 04:58:56.106416 2026] [:error] [pid 58625:tid 58641] [client 20.9.82.33:6957] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "afe3EPZfjPGFqq6KSLkG7AAAAQ0"]
[Mon May 04 04:58:56.837717 2026] [:error] [pid 31168:tid 31188] [client 20.9.82.33:6182] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "afe3ELJUVgN8GV2P4h5FBAAAAVI"]
[Mon May 04 04:58:57.851697 2026] [:error] [pid 58625:tid 58646] [client 20.9.82.33:7102] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "afe3EfZfjPGFqq6KSLkG9gAAARI"]
[Mon May 04 04:58:58.684951 2026] [:error] [pid 31168:tid 31183] [client 20.9.82.33:7022] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "afe3ErJUVgN8GV2P4h5FCQAAAU0"]
[Mon May 04 04:59:00.530357 2026] [:error] [pid 57048:tid 57125] [client 20.9.82.33:7017] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "afe3FIZINtpBgqE164JD7AAAAIg"]
[Mon May 04 04:59:02.963611 2026] [:error] [pid 57048:tid 57131] [client 20.9.82.33:6969] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "afe3FoZINtpBgqE164JD9QAAAI4"]
[Mon May 04 04:59:03.891627 2026] [:error] [pid 57154:tid 57180] [client 20.9.82.33:6193] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-k7djufwez2.php"] [unique_id "afe3F_4DAn7umy_ATRzQugAAANc"]
[Mon May 04 04:59:05.398502 2026] [:error] [pid 57046:tid 57070] [client 20.9.82.33:7018] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-k7djufwez2.php"] [unique_id "afe3GYDA4d1tYGL7mqAbVQAAAAk"]
[Mon May 04 04:59:06.862545 2026] [:error] [pid 57046:tid 57067] [client 20.9.82.33:7010] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-k7djufwez2.php"] [unique_id "afe3GoDA4d1tYGL7mqAbVwAAAAY"]
[Mon May 04 04:59:08.149661 2026] [:error] [pid 57154:tid 57162] [client 20.9.82.33:6928] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-k7djufwez2.php"] [unique_id "afe3HP4DAn7umy_ATRzQwAAAAMU"]
[Mon May 04 04:59:09.034586 2026] [:error] [pid 57154:tid 57170] [client 20.9.82.33:6192] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-tiroto.php"] [unique_id "afe3Hf4DAn7umy_ATRzQwQAAAM0"]
[Mon May 04 04:59:10.616313 2026] [:error] [pid 57154:tid 57181] [client 20.9.82.33:6174] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-tiroto.php"] [unique_id "afe3Hv4DAn7umy_ATRzQxwAAANg"]
[Mon May 04 04:59:11.544249 2026] [:error] [pid 57048:tid 57136] [client 20.9.82.33:6984] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-tiroto.php"] [unique_id "afe3H4ZINtpBgqE164JEAgAAAJM"]
[Mon May 04 04:59:12.332288 2026] [:error] [pid 31168:tid 31193] [client 20.9.82.33:7031] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-tiroto.php"] [unique_id "afe3ILJUVgN8GV2P4h5FGQAAAVc"]
[Mon May 04 04:59:13.146042 2026] [:error] [pid 31168:tid 31192] [client 20.9.82.33:6851] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/son.php"] [unique_id "afe3IbJUVgN8GV2P4h5FHAAAAVY"]
[Mon May 04 04:59:14.035364 2026] [:error] [pid 31168:tid 31183] [client 20.9.82.33:6947] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/son.php"] [unique_id "afe3IrJUVgN8GV2P4h5FHwAAAU0"]
[Mon May 04 04:59:15.046849 2026] [:error] [pid 57046:tid 57062] [client 20.9.82.33:6983] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/son.php"] [unique_id "afe3I4DA4d1tYGL7mqAbXgAAAAE"]
[Mon May 04 04:59:15.736555 2026] [:error] [pid 57154:tid 57180] [client 20.9.82.33:7024] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/son.php"] [unique_id "afe3I_4DAn7umy_ATRzQ1wAAANc"]
[Mon May 04 04:59:17.607104 2026] [:error] [pid 58625:tid 58647] [client 20.9.82.33:6982] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/99.php"] [unique_id "afe3JfZfjPGFqq6KSLkG_QAAARM"]
[Mon May 04 04:59:18.968531 2026] [:error] [pid 58625:tid 58631] [client 20.9.82.33:7037] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/99.php"] [unique_id "afe3JvZfjPGFqq6KSLkHAQAAAQM"]
[Mon May 04 04:59:20.142963 2026] [:error] [pid 57047:tid 57108] [client 20.9.82.33:6205] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/99.php"] [unique_id "afe3KFtCAxKLCAMkLV2QeQAAAFI"]
[Mon May 04 04:59:20.906205 2026] [:error] [pid 58625:tid 58652] [client 20.9.82.33:6926] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/99.php"] [unique_id "afe3KPZfjPGFqq6KSLkHCAAAARg"]
[Mon May 04 04:59:22.326124 2026] [:error] [pid 57154:tid 57169] [client 20.9.82.33:7082] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "afe3Kv4DAn7umy_ATRzQ6wAAAMw"]
[Mon May 04 04:59:23.601482 2026] [:error] [pid 57046:tid 57083] [client 20.9.82.33:7098] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "afe3K4DA4d1tYGL7mqAbaQAAABY"]
[Mon May 04 04:59:27.558242 2026] [:error] [pid 58625:tid 58651] [client 20.9.82.33:7029] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "afe3L_ZfjPGFqq6KSLkHGAAAARc"]
[Mon May 04 04:59:28.272888 2026] [:error] [pid 57046:tid 57082] [client 20.9.82.33:7095] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "afe3MIDA4d1tYGL7mqAbcgAAABU"]
[Mon May 04 04:59:29.316444 2026] [:error] [pid 57046:tid 57077] [client 20.9.82.33:6951] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filefuns.php"] [unique_id "afe3MYDA4d1tYGL7mqAbdQAAABA"]
[Mon May 04 04:59:31.503399 2026] [:error] [pid 57048:tid 57133] [client 20.9.82.33:6912] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filefuns.php"] [unique_id "afe3M4ZINtpBgqE164JEjAAAAJA"]
[Mon May 04 04:59:32.280094 2026] [:error] [pid 57048:tid 57126] [client 20.9.82.33:6927] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filefuns.php"] [unique_id "afe3NIZINtpBgqE164JEjQAAAIk"]
[Mon May 04 04:59:33.309613 2026] [:error] [pid 57154:tid 57157] [client 20.9.82.33:6944] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filefuns.php"] [unique_id "afe3Nf4DAn7umy_ATRzQ-gAAAMA"]
[Mon May 04 04:59:34.784069 2026] [:error] [pid 58625:tid 58651] [client 20.9.82.33:7101] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ay.php"] [unique_id "afe3NvZfjPGFqq6KSLkHHAAAARc"]
[Mon May 04 04:59:36.014921 2026] [:error] [pid 58625:tid 58643] [client 20.9.82.33:6915] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ay.php"] [unique_id "afe3OPZfjPGFqq6KSLkHIwAAAQ8"]
[Mon May 04 04:59:37.292377 2026] [:error] [pid 57046:tid 57083] [client 20.9.82.33:6989] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ay.php"] [unique_id "afe3OYDA4d1tYGL7mqAbgAAAABY"]
[Mon May 04 04:59:38.773849 2026] [:error] [pid 57154:tid 57165] [client 20.9.82.33:6152] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ay.php"] [unique_id "afe3Ov4DAn7umy_ATRzRAQAAAMg"]
[Mon May 04 04:59:39.581484 2026] [:error] [pid 57048:tid 57134] [client 20.9.82.33:7039] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/options.php"] [unique_id "afe3O4ZINtpBgqE164JEmAAAAJE"]
[Mon May 04 04:59:40.862871 2026] [:error] [pid 57048:tid 57122] [client 20.9.82.33:6995] File does not exist: /usr/local/apache/htdocs/suspended-page/options.php
[Mon May 04 04:59:41.051363 2026] [:error] [pid 57048:tid 57131] [client 20.9.82.33:6995] [client 20.9.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "afe3PYZINtpBgqE164JEmwAAAI4"]
[Mon May 04 04:59:42.300560 2026] [:error] [pid 31168:tid 31173] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Mon May 04 04:59:42.490979 2026] [:error] [pid 31168:tid 31185] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/1a.php
[Mon May 04 04:59:42.689924 2026] [:error] [pid 31168:tid 31182] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Mon May 04 04:59:44.105196 2026] [:error] [pid 31168:tid 31182] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/file-kikikoko.php
[Mon May 04 04:59:44.362382 2026] [:error] [pid 31168:tid 31181] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Mon May 04 04:59:44.563581 2026] [:error] [pid 31168:tid 31172] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/tramuibs.php
[Mon May 04 04:59:44.759167 2026] [:error] [pid 31168:tid 31180] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/19.php
[Mon May 04 04:59:44.948389 2026] [:error] [pid 31168:tid 31171] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Mon May 04 04:59:45.284136 2026] [:error] [pid 31168:tid 31179] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/bpxrn.php
[Mon May 04 04:59:45.637980 2026] [:error] [pid 31168:tid 31192] [client 20.9.82.33:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Mon May 04 04:59:45.916511 2026] [:error] [pid 31168:tid 31189] [client 20.9.82.33:6931] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws37.php"] [unique_id "afe3QbJUVgN8GV2P4h5FTQAAAVM"]
[Mon May 04 04:59:46.646732 2026] [:error] [pid 58625:tid 58647] [client 20.9.82.33:6976] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws37.php"] [unique_id "afe3QvZfjPGFqq6KSLkHMgAAARM"]
[Mon May 04 04:59:47.671644 2026] [:error] [pid 58625:tid 58630] [client 20.9.82.33:7115] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws37.php"] [unique_id "afe3Q_ZfjPGFqq6KSLkHNQAAAQI"]
[Mon May 04 04:59:48.185829 2026] [:error] [pid 57048:tid 57124] [client 20.9.82.33:6935] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws37.php"] [unique_id "afe3RIZINtpBgqE164JEowAAAIc"]
[Mon May 04 04:59:49.001487 2026] [:error] [pid 57154:tid 57160] [client 20.9.82.33:7023] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "afe3Rf4DAn7umy_ATRzREAAAAMM"]
[Mon May 04 04:59:49.653840 2026] [:error] [pid 57154:tid 57173] [client 20.9.82.33:6941] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "afe3Rf4DAn7umy_ATRzRFAAAANA"]
[Mon May 04 04:59:52.014549 2026] [:error] [pid 57154:tid 57164] [client 20.9.82.33:6980] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "afe3SP4DAn7umy_ATRzRGgAAAMc"]
[Mon May 04 04:59:53.046821 2026] [:error] [pid 57154:tid 57158] [client 20.9.82.33:6964] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "afe3Sf4DAn7umy_ATRzRIAAAAME"]
[Mon May 04 04:59:53.730199 2026] [:error] [pid 57154:tid 57162] [client 20.9.82.33:6963] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bojcdooq.php"] [unique_id "afe3Sf4DAn7umy_ATRzRJQAAAMU"]
[Mon May 04 04:59:54.651845 2026] [:error] [pid 57154:tid 57174] [client 20.9.82.33:6888] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bojcdooq.php"] [unique_id "afe3Sv4DAn7umy_ATRzRKQAAANE"]
[Mon May 04 04:59:56.314822 2026] [:error] [pid 57154:tid 57181] [client 20.9.82.33:6978] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bojcdooq.php"] [unique_id "afe3TP4DAn7umy_ATRzRLAAAANg"]
[Mon May 04 04:59:56.918986 2026] [:error] [pid 57154:tid 57161] [client 20.9.82.33:7013] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bojcdooq.php"] [unique_id "afe3TP4DAn7umy_ATRzRLgAAAMQ"]
[Mon May 04 04:59:57.517615 2026] [:error] [pid 57046:tid 57077] [client 20.9.82.33:6857] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zdd.php"] [unique_id "afe3TYDA4d1tYGL7mqAbjAAAABA"]
[Mon May 04 04:59:58.622012 2026] [:error] [pid 31168:tid 31179] [client 20.9.82.33:6913] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zdd.php"] [unique_id "afe3TrJUVgN8GV2P4h5FWQAAAUk"]
[Mon May 04 04:59:59.328560 2026] [:error] [pid 57154:tid 57165] [client 20.9.82.33:7025] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zdd.php"] [unique_id "afe3T_4DAn7umy_ATRzRMwAAAMg"]
[Mon May 04 05:00:00.183777 2026] [:error] [pid 57154:tid 57163] [client 20.9.82.33:6922] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zdd.php"] [unique_id "afe3UP4DAn7umy_ATRzROQAAAMY"]
[Mon May 04 05:00:01.536186 2026] [:error] [pid 57047:tid 57102] [client 20.9.82.33:7003] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/133.php"] [unique_id "afe3UVtCAxKLCAMkLV2QgQAAAEw"]
[Mon May 04 05:00:02.033798 2026] [:error] [pid 57154:tid 57157] [client 20.9.82.33:6186] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/133.php"] [unique_id "afe3Uv4DAn7umy_ATRzRPAAAAMA"]
[Mon May 04 05:00:02.800474 2026] [:error] [pid 57154:tid 57179] [client 20.9.82.33:6938] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/133.php"] [unique_id "afe3Uv4DAn7umy_ATRzRPQAAANY"]
[Mon May 04 05:00:03.473978 2026] [:error] [pid 57154:tid 57160] [client 20.9.82.33:7007] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/133.php"] [unique_id "afe3U_4DAn7umy_ATRzRPwAAAMM"]
[Mon May 04 05:00:04.284609 2026] [:error] [pid 57046:tid 57067] [client 20.9.82.33:7009] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jq.php"] [unique_id "afe3VIDA4d1tYGL7mqAbkwAAAAY"]
[Mon May 04 05:00:05.132718 2026] [:error] [pid 57046:tid 57072] [client 20.9.82.33:6967] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jq.php"] [unique_id "afe3VYDA4d1tYGL7mqAbmAAAAAs"]
[Mon May 04 05:00:06.213158 2026] [:error] [pid 57046:tid 57081] [client 20.9.82.33:7086] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jq.php"] [unique_id "afe3VoDA4d1tYGL7mqAbnAAAABQ"]
[Mon May 04 05:00:07.192943 2026] [:error] [pid 57048:tid 57131] [client 20.9.82.33:6181] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jq.php"] [unique_id "afe3V4ZINtpBgqE164JEqQAAAI4"]
[Mon May 04 05:00:08.343817 2026] [:error] [pid 57154:tid 57169] [client 20.9.82.33:7150] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cro.php"] [unique_id "afe3WP4DAn7umy_ATRzRQwAAAMw"]
[Mon May 04 05:00:09.115795 2026] [:error] [pid 31168:tid 31179] [client 20.9.82.33:7035] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cro.php"] [unique_id "afe3WbJUVgN8GV2P4h5FYAAAAUk"]
[Mon May 04 05:00:10.672985 2026] [:error] [pid 57047:tid 57098] [client 20.9.82.33:6934] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cro.php"] [unique_id "afe3WltCAxKLCAMkLV2QhQAAAEg"]
[Mon May 04 05:00:11.288092 2026] [:error] [pid 57047:tid 57104] [client 20.9.82.33:6937] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cro.php"] [unique_id "afe3W1tCAxKLCAMkLV2QhgAAAE4"]
[Mon May 04 05:00:11.751742 2026] [:error] [pid 57048:tid 57133] [client 20.9.82.33:6917] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wwx.php"] [unique_id "afe3W4ZINtpBgqE164JEqwAAAJA"]
[Mon May 04 05:00:12.249028 2026] [:error] [pid 58625:tid 58647] [client 20.9.82.33:6178] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wwx.php"] [unique_id "afe3XPZfjPGFqq6KSLkHPAAAARM"]
[Mon May 04 05:00:13.153693 2026] [:error] [pid 57154:tid 57157] [client 20.9.82.33:6942] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wwx.php"] [unique_id "afe3Xf4DAn7umy_ATRzRTwAAAMA"]
[Mon May 04 05:00:13.877032 2026] [:error] [pid 58625:tid 58636] [client 20.9.82.33:7020] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wwx.php"] [unique_id "afe3XfZfjPGFqq6KSLkHPgAAAQg"]
[Mon May 04 05:00:14.398152 2026] [:error] [pid 58625:tid 58640] [client 20.9.82.33:6872] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/trx24.php"] [unique_id "afe3XvZfjPGFqq6KSLkHQQAAAQw"]
[Mon May 04 05:00:15.353047 2026] [:error] [pid 31168:tid 31180] [client 20.9.82.33:6197] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/trx24.php"] [unique_id "afe3X7JUVgN8GV2P4h5FZAAAAUo"]
[Mon May 04 05:00:16.414201 2026] [:error] [pid 57154:tid 57166] [client 20.9.82.33:6866] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/trx24.php"] [unique_id "afe3YP4DAn7umy_ATRzRUgAAAMk"]
[Mon May 04 05:00:17.066071 2026] [:error] [pid 57047:tid 57108] [client 20.9.82.33:6998] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/trx24.php"] [unique_id "afe3YVtCAxKLCAMkLV2QiwAAAFI"]
[Mon May 04 05:00:17.976475 2026] [:error] [pid 57047:tid 57109] [client 20.9.82.33:6188] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blox.php"] [unique_id "afe3YVtCAxKLCAMkLV2QjgAAAFM"]
[Mon May 04 05:00:18.626516 2026] [:error] [pid 57046:tid 57063] [client 20.9.82.33:6921] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blox.php"] [unique_id "afe3YoDA4d1tYGL7mqAboAAAAAI"]
[Mon May 04 05:00:19.418635 2026] [:error] [pid 57154:tid 57174] [client 20.9.82.33:6859] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blox.php"] [unique_id "afe3Y_4DAn7umy_ATRzRVQAAANE"]
[Mon May 04 05:00:19.996342 2026] [:error] [pid 57154:tid 57178] [client 20.9.82.33:6988] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blox.php"] [unique_id "afe3Y_4DAn7umy_ATRzRVwAAANU"]
[Mon May 04 05:00:20.625087 2026] [:error] [pid 57154:tid 57167] [client 20.9.82.33:7015] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/berax.php"] [unique_id "afe3ZP4DAn7umy_ATRzRXAAAAMo"]
[Mon May 04 05:00:21.319556 2026] [:error] [pid 57046:tid 57061] [client 20.9.82.33:6191] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/berax.php"] [unique_id "afe3ZYDA4d1tYGL7mqAbpAAAAAA"]
[Mon May 04 05:00:22.064799 2026] [:error] [pid 57048:tid 57124] [client 20.9.82.33:6924] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/berax.php"] [unique_id "afe3ZoZINtpBgqE164JEsAAAAIc"]
[Mon May 04 05:00:22.992828 2026] [:error] [pid 57154:tid 57161] [client 20.9.82.33:6949] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/berax.php"] [unique_id "afe3Zv4DAn7umy_ATRzRYwAAAMQ"]
[Mon May 04 05:00:23.862031 2026] [:error] [pid 31168:tid 31176] [client 20.9.82.33:6902] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bkxzo.php"] [unique_id "afe3Z7JUVgN8GV2P4h5FZQAAAUY"]
[Mon May 04 05:00:24.618816 2026] [:error] [pid 57047:tid 57096] [client 20.9.82.33:6740] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bkxzo.php"] [unique_id "afe3aFtCAxKLCAMkLV2QkgAAAEY"]
[Mon May 04 05:00:25.449541 2026] [:error] [pid 31168:tid 31174] [client 20.9.82.33:7019] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bkxzo.php"] [unique_id "afe3abJUVgN8GV2P4h5FZgAAAUQ"]
[Mon May 04 05:00:26.177634 2026] [:error] [pid 57048:tid 57130] [client 20.9.82.33:7038] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bkxzo.php"] [unique_id "afe3aoZINtpBgqE164JEswAAAI0"]
[Mon May 04 05:00:27.152698 2026] [:error] [pid 57046:tid 57063] [client 20.9.82.33:7011] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cdxadmin.php"] [unique_id "afe3a4DA4d1tYGL7mqAbrQAAAAI"]
[Mon May 04 05:00:28.611189 2026] [:error] [pid 58625:tid 58633] [client 20.9.82.33:6862] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cdxadmin.php"] [unique_id "afe3bPZfjPGFqq6KSLkHTAAAAQU"]
[Mon May 04 05:00:29.201924 2026] [:error] [pid 57048:tid 57126] [client 20.9.82.33:6916] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cdxadmin.php"] [unique_id "afe3bYZINtpBgqE164JEtgAAAIk"]
[Mon May 04 05:00:30.008076 2026] [:error] [pid 57046:tid 57077] [client 20.9.82.33:6990] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cdxadmin.php"] [unique_id "afe3boDA4d1tYGL7mqAbsQAAABA"]
[Mon May 04 05:00:31.435029 2026] [:error] [pid 58625:tid 58644] [client 20.9.82.33:7027] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dfre.php"] [unique_id "afe3b_ZfjPGFqq6KSLkHTwAAARA"]
[Mon May 04 05:00:31.977844 2026] [:error] [pid 58625:tid 58641] [client 20.9.82.33:6856] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dfre.php"] [unique_id "afe3b_ZfjPGFqq6KSLkHUQAAAQ0"]
[Mon May 04 05:00:32.706481 2026] [:error] [pid 58625:tid 58642] [client 20.9.82.33:6971] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dfre.php"] [unique_id "afe3cPZfjPGFqq6KSLkHVQAAAQ4"]
[Mon May 04 05:00:34.053030 2026] [:error] [pid 58625:tid 58649] [client 20.9.82.33:6917] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dfre.php"] [unique_id "afe3cvZfjPGFqq6KSLkHWQAAARU"]
[Mon May 04 05:00:34.498307 2026] [:error] [pid 57046:tid 57084] [client 20.9.82.33:7032] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sko.php"] [unique_id "afe3coDA4d1tYGL7mqAbtQAAABc"]
[Mon May 04 05:00:34.987838 2026] [:error] [pid 58625:tid 58646] [client 20.9.82.33:7093] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sko.php"] [unique_id "afe3cvZfjPGFqq6KSLkHWwAAARI"]
[Mon May 04 05:00:35.575851 2026] [:error] [pid 58625:tid 58652] [client 20.9.82.33:6850] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sko.php"] [unique_id "afe3c_ZfjPGFqq6KSLkHYAAAARg"]
[Mon May 04 05:00:36.510557 2026] [:error] [pid 58625:tid 58631] [client 20.9.82.33:7020] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sko.php"] [unique_id "afe3dPZfjPGFqq6KSLkHZAAAAQM"]
[Mon May 04 05:00:37.237896 2026] [:error] [pid 57046:tid 57069] [client 20.9.82.33:6864] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shorw.php"] [unique_id "afe3dYDA4d1tYGL7mqAbtwAAAAg"]
[Mon May 04 05:00:37.963409 2026] [:error] [pid 57154:tid 57162] [client 20.9.82.33:6936] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shorw.php"] [unique_id "afe3df4DAn7umy_ATRzRcgAAAMU"]
[Mon May 04 05:00:39.733504 2026] [:error] [pid 31168:tid 31185] [client 20.9.82.33:6892] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shorw.php"] [unique_id "afe3d7JUVgN8GV2P4h5FawAAAU8"]
[Mon May 04 05:00:40.325044 2026] [:error] [pid 57047:tid 57111] [client 20.9.82.33:6860] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shorw.php"] [unique_id "afe3eFtCAxKLCAMkLV2QmAAAAFU"]
[Mon May 04 05:00:41.505366 2026] [:error] [pid 57154:tid 57178] [client 20.9.82.33:7030] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shelp.php"] [unique_id "afe3ef4DAn7umy_ATRzRdQAAANU"]
[Mon May 04 05:00:42.329045 2026] [:error] [pid 31168:tid 31192] [client 20.9.82.33:6868] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shelp.php"] [unique_id "afe3erJUVgN8GV2P4h5FbQAAAVY"]
[Mon May 04 05:00:43.346780 2026] [:error] [pid 57046:tid 57078] [client 20.9.82.33:6165] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shelp.php"] [unique_id "afe3e4DA4d1tYGL7mqAbvwAAABE"]
[Mon May 04 05:00:44.698870 2026] [:error] [pid 57046:tid 57073] [client 20.9.82.33:6968] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shelp.php"] [unique_id "afe3fIDA4d1tYGL7mqAbxAAAAAw"]
[Mon May 04 05:00:46.047223 2026] [:error] [pid 57047:tid 57095] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/seyv.php
[Mon May 04 05:00:46.236408 2026] [:error] [pid 57047:tid 57091] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/sad821.php
[Mon May 04 05:00:46.433528 2026] [:error] [pid 57047:tid 57105] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8210.php
[Mon May 04 05:00:46.622644 2026] [:error] [pid 57047:tid 57103] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8rd1.php
[Mon May 04 05:00:46.863053 2026] [:error] [pid 57047:tid 57093] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/saxzgf5.php
[Mon May 04 05:00:47.060087 2026] [:error] [pid 57047:tid 57110] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/saxzw9t.php
[Mon May 04 05:00:47.249475 2026] [:error] [pid 57047:tid 57090] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/sder5252u.php
[Mon May 04 05:00:47.438798 2026] [:error] [pid 57047:tid 57094] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/sderty5u.php
[Mon May 04 05:00:47.627667 2026] [:error] [pid 57047:tid 57111] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/hilk.php
[Mon May 04 05:00:47.823367 2026] [:error] [pid 57047:tid 57099] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/miso.php
[Mon May 04 05:00:48.213004 2026] [:error] [pid 57047:tid 57113] [client 20.9.82.33:6932] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Mon May 04 05:00:48.407921 2026] [:error] [pid 57047:tid 57109] [client 20.9.82.33:6932] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/checkout.php"] [unique_id "afe3gFtCAxKLCAMkLV2QrAAAAFM"]
[Mon May 04 05:00:49.114864 2026] [:error] [pid 57154:tid 57177] [client 20.9.82.33:7059] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/checkout.php"] [unique_id "afe3gf4DAn7umy_ATRzRdwAAANQ"]
[Mon May 04 05:00:49.990038 2026] [:error] [pid 58625:tid 58628] [client 20.9.82.33:7157] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/checkout.php"] [unique_id "afe3gfZfjPGFqq6KSLkHbwAAAQA"]
[Mon May 04 05:00:50.975014 2026] [:error] [pid 58625:tid 58648] [client 20.9.82.33:6970] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/checkout.php"] [unique_id "afe3gvZfjPGFqq6KSLkHcgAAARQ"]
[Mon May 04 05:00:51.607211 2026] [:error] [pid 31168:tid 31173] [client 20.9.82.33:6877] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fictioner.php"] [unique_id "afe3g7JUVgN8GV2P4h5FdQAAAUM"]
[Mon May 04 05:00:52.305784 2026] [:error] [pid 57048:tid 57139] [client 20.9.82.33:6954] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fictioner.php"] [unique_id "afe3hIZINtpBgqE164JEvQAAAJY"]
[Mon May 04 05:00:53.080941 2026] [:error] [pid 58625:tid 58631] [client 20.9.82.33:6950] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fictioner.php"] [unique_id "afe3hfZfjPGFqq6KSLkHegAAAQM"]
[Mon May 04 05:00:53.935138 2026] [:error] [pid 58625:tid 58651] [client 20.9.82.33:7113] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fictioner.php"] [unique_id "afe3hfZfjPGFqq6KSLkHfwAAARc"]
[Mon May 04 05:00:55.093963 2026] [:error] [pid 57046:tid 57061] [client 20.9.82.33:6960] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "afe3h4DA4d1tYGL7mqAbzQAAAAA"]
[Mon May 04 05:00:55.806551 2026] [:error] [pid 57048:tid 57130] [client 20.9.82.33:7156] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "afe3h4ZINtpBgqE164JEwAAAAI0"]
[Mon May 04 05:00:57.844045 2026] [:error] [pid 58625:tid 58643] [client 20.9.82.33:6953] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "afe3ifZfjPGFqq6KSLkHhgAAAQ8"]
[Mon May 04 05:00:58.902465 2026] [:error] [pid 58625:tid 58628] [client 20.9.82.33:6886] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "afe3ivZfjPGFqq6KSLkHigAAAQA"]
[Mon May 04 05:00:59.631660 2026] [:error] [pid 58625:tid 58648] [client 20.9.82.33:7131] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "afe3i_ZfjPGFqq6KSLkHjQAAARQ"]
[Mon May 04 05:01:00.996972 2026] [:error] [pid 57048:tid 57133] [client 20.9.82.33:6919] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "afe3jIZINtpBgqE164JEwgAAAJA"]
[Mon May 04 05:01:02.254116 2026] [:error] [pid 58625:tid 58632] [client 20.9.82.33:7153] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "afe3jvZfjPGFqq6KSLkHkQAAAQQ"]
[Mon May 04 05:01:03.056045 2026] [:error] [pid 57046:tid 57065] [client 20.9.82.33:7111] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "afe3j4DA4d1tYGL7mqAb0wAAAAQ"]
[Mon May 04 05:01:04.601750 2026] [:error] [pid 58625:tid 58630] [client 20.9.82.33:6869] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "afe3kPZfjPGFqq6KSLkHkgAAAQI"]
[Mon May 04 05:01:05.580509 2026] [:error] [pid 58625:tid 58649] [client 20.9.82.33:6154] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "afe3kfZfjPGFqq6KSLkHlAAAARU"]
[Mon May 04 05:01:06.274914 2026] [:error] [pid 58625:tid 58634] [client 20.9.82.33:7124] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "afe3kvZfjPGFqq6KSLkHmAAAAQY"]
[Mon May 04 05:01:07.143937 2026] [:error] [pid 58625:tid 58636] [client 20.9.82.33:7002] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "afe3k_ZfjPGFqq6KSLkHmwAAAQg"]
[Mon May 04 05:01:08.104216 2026] [:error] [pid 58625:tid 58650] [client 20.9.82.33:6875] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "afe3lPZfjPGFqq6KSLkHnwAAARY"]
[Mon May 04 05:01:09.196103 2026] [:error] [pid 58625:tid 58646] [client 20.9.82.33:6939] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "afe3lfZfjPGFqq6KSLkHoQAAARI"]
[Mon May 04 05:01:09.780488 2026] [:error] [pid 58625:tid 58629] [client 20.9.82.33:6880] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "afe3lfZfjPGFqq6KSLkHowAAAQE"]
[Mon May 04 05:01:10.560486 2026] [:error] [pid 31168:tid 31174] [client 20.9.82.33:7021] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "afe3lrJUVgN8GV2P4h5FggAAAUQ"]
[Mon May 04 05:01:11.776383 2026] [:error] [pid 58625:tid 58650] [client 20.9.82.33:6204] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/redixsx.php"] [unique_id "afe3l_ZfjPGFqq6KSLkHpwAAARY"]
[Mon May 04 05:01:12.626727 2026] [:error] [pid 31168:tid 31193] [client 20.9.82.33:7081] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/redixsx.php"] [unique_id "afe3mLJUVgN8GV2P4h5FhAAAAVc"]
[Mon May 04 05:01:14.015877 2026] [:error] [pid 57154:tid 57175] [client 20.9.82.33:7137] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/redixsx.php"] [unique_id "afe3mv4DAn7umy_ATRzRfQAAANI"]
[Mon May 04 05:01:14.560804 2026] [:error] [pid 57154:tid 57173] [client 20.9.82.33:6940] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/redixsx.php"] [unique_id "afe3mv4DAn7umy_ATRzRfgAAANA"]
[Mon May 04 05:01:15.227342 2026] [:error] [pid 58625:tid 58636] [client 20.9.82.33:7165] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "afe3m_ZfjPGFqq6KSLkHrAAAAQg"]
[Mon May 04 05:01:16.160864 2026] [:error] [pid 57154:tid 57168] [client 20.9.82.33:7140] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "afe3nP4DAn7umy_ATRzRhQAAAMs"]
[Mon May 04 05:01:17.169732 2026] [:error] [pid 31168:tid 31185] [client 20.9.82.33:6898] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "afe3nbJUVgN8GV2P4h5FiQAAAU8"]
[Mon May 04 05:01:17.858424 2026] [:error] [pid 57046:tid 57066] [client 20.9.82.33:7120] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "afe3nYDA4d1tYGL7mqAb2AAAAAU"]
[Mon May 04 05:01:18.497051 2026] [:error] [pid 57046:tid 57078] [client 20.9.82.33:7105] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "afe3noDA4d1tYGL7mqAb2gAAABE"]
[Mon May 04 05:01:20.513658 2026] [:error] [pid 57154:tid 57164] [client 20.9.82.33:7142] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "afe3oP4DAn7umy_ATRzRjQAAAMc"]
[Mon May 04 05:01:21.062209 2026] [:error] [pid 58625:tid 58650] [client 20.9.82.33:7107] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "afe3ofZfjPGFqq6KSLkHtQAAARY"]
[Mon May 04 05:01:22.529576 2026] [:error] [pid 57154:tid 57163] [client 20.9.82.33:7139] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "afe3ov4DAn7umy_ATRzRkQAAAMY"]
[Mon May 04 05:01:23.369566 2026] [:error] [pid 57047:tid 57092] [client 20.9.82.33:6184] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/67.php"] [unique_id "afe3o1tCAxKLCAMkLV2QsQAAAEI"]
[Mon May 04 05:01:24.155530 2026] [:error] [pid 58625:tid 58647] [client 20.9.82.33:7160] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/67.php"] [unique_id "afe3pPZfjPGFqq6KSLkHuwAAARM"]
[Mon May 04 05:01:24.969493 2026] [:error] [pid 58625:tid 58634] [client 20.9.82.33:7108] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/67.php"] [unique_id "afe3pPZfjPGFqq6KSLkHvwAAAQY"]
[Mon May 04 05:01:25.928042 2026] [:error] [pid 58625:tid 58635] [client 20.9.82.33:6899] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/67.php"] [unique_id "afe3pfZfjPGFqq6KSLkHwwAAAQc"]
[Mon May 04 05:01:27.204002 2026] [:error] [pid 57046:tid 57076] [client 20.9.82.33:7129] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1mrX.php"] [unique_id "afe3p4DA4d1tYGL7mqAb3AAAAA8"]
[Mon May 04 05:01:28.184687 2026] [:error] [pid 57154:tid 57167] [client 20.9.82.33:7152] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1mrX.php"] [unique_id "afe3qP4DAn7umy_ATRzRmQAAAMo"]
[Mon May 04 05:01:29.296918 2026] [:error] [pid 58625:tid 58644] [client 20.9.82.33:6159] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1mrX.php"] [unique_id "afe3qfZfjPGFqq6KSLkH0AAAARA"]
[Mon May 04 05:01:30.407903 2026] [:error] [pid 58625:tid 58633] [client 20.9.82.33:6167] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1mrX.php"] [unique_id "afe3qvZfjPGFqq6KSLkH0wAAAQU"]
[Mon May 04 05:01:31.127961 2026] [:error] [pid 31168:tid 31181] [client 20.9.82.33:7112] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x402.php"] [unique_id "afe3q7JUVgN8GV2P4h5FjwAAAUs"]
[Mon May 04 05:01:32.654764 2026] [:error] [pid 58625:tid 58638] [client 20.9.82.33:7069] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x402.php"] [unique_id "afe3rPZfjPGFqq6KSLkH2AAAAQo"]
[Mon May 04 05:01:33.403011 2026] [:error] [pid 58625:tid 58647] [client 20.9.82.33:7166] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x402.php"] [unique_id "afe3rfZfjPGFqq6KSLkH2wAAARM"]
[Mon May 04 05:01:34.733004 2026] [:error] [pid 58625:tid 58640] [client 20.9.82.33:7121] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/x402.php"] [unique_id "afe3rvZfjPGFqq6KSLkH4AAAAQw"]
[Mon May 04 05:01:35.760839 2026] [:error] [pid 57046:tid 57074] [client 20.9.82.33:7053] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/485.php"] [unique_id "afe3r4DA4d1tYGL7mqAb4wAAAA0"]
[Mon May 04 05:01:37.156694 2026] [:error] [pid 57047:tid 57102] [client 20.9.82.33:7127] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/485.php"] [unique_id "afe3sVtCAxKLCAMkLV2QswAAAEw"]
[Mon May 04 05:01:38.213210 2026] [:error] [pid 57048:tid 57137] [client 20.9.82.33:6749] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/485.php"] [unique_id "afe3soZINtpBgqE164JE0QAAAJQ"]
[Mon May 04 05:01:38.920079 2026] [:error] [pid 57047:tid 57105] [client 20.9.82.33:6933] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/485.php"] [unique_id "afe3sltCAxKLCAMkLV2QtgAAAE8"]
[Mon May 04 05:01:40.867728 2026] [:error] [pid 57154:tid 57160] [client 20.9.82.33:7116] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/drykl.php"] [unique_id "afe3tP4DAn7umy_ATRzRvwAAAMM"]
[Mon May 04 05:01:43.776285 2026] [:error] [pid 57154:tid 57159] [client 20.9.82.33:7057] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/drykl.php"] [unique_id "afe3t_4DAn7umy_ATRzRzgAAAMI"]
[Mon May 04 05:01:45.862111 2026] [:error] [pid 31168:tid 31176] [client 20.9.82.33:7055] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/drykl.php"] [unique_id "afe3ubJUVgN8GV2P4h5FnAAAAUY"]
[Mon May 04 05:01:46.994503 2026] [:error] [pid 57047:tid 57112] [client 20.9.82.33:7134] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/drykl.php"] [unique_id "afe3ultCAxKLCAMkLV2QuQAAAFY"]
[Mon May 04 05:01:47.757166 2026] [:error] [pid 31168:tid 31190] [client 20.9.82.33:7072] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "afe3u7JUVgN8GV2P4h5FowAAAVQ"]
[Mon May 04 05:01:48.709438 2026] [:error] [pid 57047:tid 57106] [client 20.9.82.33:7110] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Mon May 04 07:32:45.649872 2026] [:error] [pid 12051:tid 12076] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Mon May 04 07:32:45.840095 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/card.php
[Mon May 04 07:32:46.044587 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Mon May 04 07:32:46.236181 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lacoto.php
[Mon May 04 07:32:46.803217 2026] [:error] [pid 12051:tid 12057] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Mon May 04 07:32:46.993454 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/ganja.php
[Mon May 04 07:32:47.182879 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Mon May 04 07:32:47.373186 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-X1s2e6h3p7.php
[Mon May 04 07:32:47.574467 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/dragonshell.php
[Mon May 04 07:32:47.772951 2026] [:error] [pid 12051:tid 12064] [client 20.9.82.33:26609] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Mon May 04 07:32:47.958835 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:26609] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "affbH-rVB-w_PyOHK6kaygAAAVU"]
[Mon May 04 07:32:49.081318 2026] [:error] [pid 11959:tid 11995] [client 20.9.82.33:26581] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "affbIQojk2nvxs7h5Ku6iwAAAMc"]
[Mon May 04 07:32:50.110150 2026] [:error] [pid 12022:tid 12045] [client 20.9.82.33:26505] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "affbIkVhgvCNKBWnaTISjgAAAJU"]
[Mon May 04 07:32:51.736194 2026] [:error] [pid 12022:tid 12033] [client 20.9.82.33:26575] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/G-In.php"] [unique_id "affbI0VhgvCNKBWnaTISkgAAAIk"]
[Mon May 04 07:32:53.059624 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:26570] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj11.php"] [unique_id "affbJQojk2nvxs7h5Ku6jwAAAMQ"]
[Mon May 04 07:32:54.279131 2026] [:error] [pid 12051:tid 12059] [client 20.9.82.33:26569] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj11.php"] [unique_id "affbJurVB-w_PyOHK6ka1gAAAUY"]
[Mon May 04 07:32:56.023991 2026] [:error] [pid 11959:tid 12011] [client 20.9.82.33:26510] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj11.php"] [unique_id "affbKAojk2nvxs7h5Ku6lAAAANc"]
[Mon May 04 07:32:58.494091 2026] [:error] [pid 12051:tid 12059] [client 20.9.82.33:26602] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aj11.php"] [unique_id "affbKurVB-w_PyOHK6ka4QAAAUY"]
[Mon May 04 07:33:00.785764 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:26619] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "affbLOrVB-w_PyOHK6ka5gAAAU4"]
[Mon May 04 07:33:01.750819 2026] [:error] [pid 12022:tid 12041] [client 20.9.82.33:26591] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "affbLUVhgvCNKBWnaTISmwAAAJE"]
[Mon May 04 07:33:02.756713 2026] [:error] [pid 11958:tid 11967] [client 20.9.82.33:26573] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "affbLjAK_o2NLEdfAUkeAwAAAEY"]
[Mon May 04 07:33:03.982706 2026] [:error] [pid 12022:tid 12046] [client 20.9.82.33:26528] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "affbL0VhgvCNKBWnaTISnwAAAJY"]
[Mon May 04 07:33:05.250841 2026] [:error] [pid 11959:tid 11996] [client 20.9.82.33:26596] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xroot.php"] [unique_id "affbMQojk2nvxs7h5Ku6ngAAAMg"]
[Mon May 04 07:33:06.350457 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:26598] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xroot.php"] [unique_id "affbMurVB-w_PyOHK6ka6QAAAUo"]
[Mon May 04 07:33:07.671655 2026] [:error] [pid 11959:tid 12002] [client 20.9.82.33:26509] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xroot.php"] [unique_id "affbMwojk2nvxs7h5Ku6oQAAAM4"]
[Mon May 04 07:33:09.058655 2026] [:error] [pid 11958:tid 11979] [client 20.9.82.33:26580] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xroot.php"] [unique_id "affbNTAK_o2NLEdfAUkeCgAAAFI"]
[Mon May 04 07:33:10.086377 2026] [:error] [pid 12022:tid 12040] [client 20.9.82.33:26607] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "affbNkVhgvCNKBWnaTISpQAAAJA"]
[Mon May 04 07:33:10.936451 2026] [:error] [pid 11959:tid 12004] [client 20.9.82.33:26611] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "affbNgojk2nvxs7h5Ku6rQAAANA"]
[Mon May 04 07:33:12.629558 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:26577] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "affbOOrVB-w_PyOHK6ka8wAAAUw"]
[Mon May 04 07:33:13.821111 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26504] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tea.php"] [unique_id "affbOerVB-w_PyOHK6ka9wAAAU8"]
[Mon May 04 07:33:17.469454 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:26506] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uwu.php"] [unique_id "affbPerVB-w_PyOHK6kbBAAAAUE"]
[Mon May 04 07:33:18.806855 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:26516] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uwu.php"] [unique_id "affbPurVB-w_PyOHK6kbCAAAAVI"]
[Mon May 04 07:33:20.004307 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:26526] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uwu.php"] [unique_id "affbQOrVB-w_PyOHK6kbCwAAAVg"]
[Mon May 04 07:33:21.324370 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:26592] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uwu.php"] [unique_id "affbQUVhgvCNKBWnaTISrAAAAI4"]
[Mon May 04 07:33:23.608014 2026] [:error] [pid 12022:tid 12046] [client 20.9.82.33:26593] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aios-bootstrap.php"] [unique_id "affbQ0VhgvCNKBWnaTISrgAAAJY"]
[Mon May 04 07:33:25.421046 2026] [:error] [pid 11958:tid 11966] [client 20.9.82.33:26600] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aios-bootstrap.php"] [unique_id "affbRTAK_o2NLEdfAUkeIgAAAEU"]
[Mon May 04 07:33:27.063265 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:26501] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aios-bootstrap.php"] [unique_id "affbR0VhgvCNKBWnaTISswAAAIs"]
[Mon May 04 07:33:28.096342 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26597] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aios-bootstrap.php"] [unique_id "affbSOrVB-w_PyOHK6kbEwAAAVE"]
[Mon May 04 07:33:29.180561 2026] [:error] [pid 11958:tid 11981] [client 20.9.82.33:26585] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "affbSTAK_o2NLEdfAUkeLQAAAFQ"]
[Mon May 04 07:33:31.163445 2026] [:error] [pid 12022:tid 12031] [client 20.9.82.33:26610] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "affbS0VhgvCNKBWnaTISvAAAAIc"]
[Mon May 04 07:33:35.060173 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26583] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "affbT-rVB-w_PyOHK6kbOwAAAVE"]
[Mon May 04 07:33:36.189458 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:26507] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "affbUDAK_o2NLEdfAUkeNwAAAE0"]
[Mon May 04 07:33:37.352762 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:26616] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/006.php"] [unique_id "affbUUVhgvCNKBWnaTITUgAAAJc"]
[Mon May 04 07:33:39.347718 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:26613] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/006.php"] [unique_id "affbU-rVB-w_PyOHK6kbbwAAAUE"]
[Mon May 04 07:33:41.017175 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:26435] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/006.php"] [unique_id "affbVerVB-w_PyOHK6kbdwAAAUI"]
[Mon May 04 07:33:42.696947 2026] [:error] [pid 12051:tid 12072] [client 20.9.82.33:26578] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/006.php"] [unique_id "affbVurVB-w_PyOHK6kbfAAAAVM"]
[Mon May 04 07:33:45.899321 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:26502] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "affbWUVhgvCNKBWnaTITfgAAAJc"]
[Mon May 04 07:33:46.923169 2026] [:error] [pid 12022:tid 12032] [client 20.9.82.33:26512] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kikikoko.php"] [unique_id "affbWkVhgvCNKBWnaTITgAAAAIg"]
[Mon May 04 07:33:47.897279 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Mon May 04 07:33:48.086391 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Mon May 04 07:33:48.281924 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Mon May 04 07:33:48.488441 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/amxloxxr.php
[Mon May 04 07:33:48.695788 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/qhupyoon.php
[Mon May 04 07:33:48.889010 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Mon May 04 07:33:49.078205 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Mon May 04 07:33:49.302813 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/6ap7e.php
[Mon May 04 07:33:49.492034 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Mon May 04 07:33:49.693451 2026] [:error] [pid 12051:tid 12059] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Mon May 04 07:33:49.883321 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:26582] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Mon May 04 07:33:50.079818 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:26582] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "affbXurVB-w_PyOHK6kblAAAAVY"]
[Mon May 04 07:33:51.100886 2026] [:error] [pid 11958:tid 11961] [client 20.9.82.33:26508] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "affbXzAK_o2NLEdfAUkeQgAAAEA"]
[Mon May 04 07:33:52.874025 2026] [:error] [pid 12022:tid 12027] [client 20.9.82.33:26447] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "affbYEVhgvCNKBWnaTITigAAAIM"]
[Mon May 04 07:33:54.442548 2026] [:error] [pid 12022:tid 12029] [client 20.9.82.33:26513] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zogy1.php"] [unique_id "affbYkVhgvCNKBWnaTITjAAAAIU"]
[Mon May 04 07:33:55.589972 2026] [:error] [pid 11959:tid 11998] [client 20.9.82.33:26623] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoper1.php"] [unique_id "affbYwojk2nvxs7h5Ku63QAAAMo"]
[Mon May 04 07:33:58.190702 2026] [:error] [pid 11959:tid 12006] [client 20.9.82.33:26599] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoper1.php"] [unique_id "affbZgojk2nvxs7h5Ku64AAAANI"]
[Mon May 04 07:34:00.049898 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:26612] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoper1.php"] [unique_id "affbaEVhgvCNKBWnaTITmQAAAIo"]
[Mon May 04 07:34:01.147525 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:26533] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoper1.php"] [unique_id "affbaerVB-w_PyOHK6kbnwAAAVA"]
[Mon May 04 07:34:02.052952 2026] [:error] [pid 11958:tid 11966] [client 20.9.82.33:26530] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atkno.php"] [unique_id "affbajAK_o2NLEdfAUkeSQAAAEU"]
[Mon May 04 07:34:03.080809 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:26497] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atkno.php"] [unique_id "affba0VhgvCNKBWnaTIToAAAAI4"]
[Mon May 04 07:34:05.377945 2026] [:error] [pid 11959:tid 11989] [client 20.9.82.33:26589] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atkno.php"] [unique_id "affbbQojk2nvxs7h5Ku67gAAAME"]
[Mon May 04 07:34:06.024586 2026] [:error] [pid 11959:tid 12004] [client 20.9.82.33:26595] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atkno.php"] [unique_id "affbbgojk2nvxs7h5Ku67wAAANA"]
[Mon May 04 07:34:08.628019 2026] [:error] [pid 11959:tid 11990] [client 20.9.82.33:26537] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "affbcAojk2nvxs7h5Ku68wAAAMI"]
[Mon May 04 07:34:09.278401 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:26603] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "affbcerVB-w_PyOHK6kbqgAAAUM"]
[Mon May 04 07:34:10.938227 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:26511] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "affbcurVB-w_PyOHK6kbsAAAAU0"]
[Mon May 04 07:34:12.107496 2026] [:error] [pid 12022:tid 12041] [client 20.9.82.33:26546] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "affbdEVhgvCNKBWnaTITqAAAAJE"]
[Mon May 04 07:34:13.083678 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:26567] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/insta.php"] [unique_id "affbderVB-w_PyOHK6kbtwAAAUM"]
[Mon May 04 07:34:13.822440 2026] [:error] [pid 12022:tid 12025] [client 20.9.82.33:26543] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/insta.php"] [unique_id "affbdUVhgvCNKBWnaTITqwAAAIE"]
[Mon May 04 07:34:14.655774 2026] [:error] [pid 11959:tid 11991] [client 20.9.82.33:26614] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/insta.php"] [unique_id "affbdgojk2nvxs7h5Ku69gAAAMM"]
[Mon May 04 07:34:15.453650 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:26594] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/insta.php"] [unique_id "affbd-rVB-w_PyOHK6kbugAAAUU"]
[Mon May 04 07:34:16.205081 2026] [:error] [pid 12022:tid 12033] [client 20.9.82.33:26551] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpxl.php"] [unique_id "affbeEVhgvCNKBWnaTITsAAAAIk"]
[Mon May 04 07:34:17.646209 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26559] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpxl.php"] [unique_id "affbeerVB-w_PyOHK6kbvQAAAU8"]
[Mon May 04 07:34:18.605481 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:26565] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpxl.php"] [unique_id "affbekVhgvCNKBWnaTITtgAAAJM"]
[Mon May 04 07:34:19.505824 2026] [:error] [pid 11959:tid 12009] [client 20.9.82.33:26548] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpxl.php"] [unique_id "affbewojk2nvxs7h5Ku6-wAAANU"]
[Mon May 04 07:34:22.695300 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:26563] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admlo.php"] [unique_id "affbfurVB-w_PyOHK6kbxAAAAUU"]
[Mon May 04 07:34:24.412687 2026] [:error] [pid 12022:tid 12027] [client 20.9.82.33:26560] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admlo.php"] [unique_id "affbgEVhgvCNKBWnaTITwAAAAIM"]
[Mon May 04 07:34:25.132183 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:26608] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admlo.php"] [unique_id "affbgerVB-w_PyOHK6kbyAAAAUI"]
[Mon May 04 07:34:26.989826 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:26520] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admlo.php"] [unique_id "affbgkVhgvCNKBWnaTITwwAAAIo"]
[Mon May 04 07:34:27.966559 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:26498] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f5.php"] [unique_id "affbg0VhgvCNKBWnaTITxgAAAJg"]
[Mon May 04 07:34:29.601694 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:26568] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f5.php"] [unique_id "affbhUVhgvCNKBWnaTITzAAAAI4"]
[Mon May 04 07:34:31.414861 2026] [:error] [pid 11958:tid 11978] [client 20.9.82.33:26586] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f5.php"] [unique_id "affbhzAK_o2NLEdfAUkeWAAAAFE"]
[Mon May 04 07:34:32.945669 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:26531] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f5.php"] [unique_id "affbiOrVB-w_PyOHK6kb0wAAAUA"]
[Mon May 04 07:34:33.859756 2026] [:error] [pid 12022:tid 12041] [client 20.9.82.33:26588] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ptanf.php"] [unique_id "affbiUVhgvCNKBWnaTIT2AAAAJE"]
[Mon May 04 07:34:36.308208 2026] [:error] [pid 12022:tid 12030] [client 20.9.82.33:26525] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ptanf.php"] [unique_id "affbjEVhgvCNKBWnaTIT3AAAAIY"]
[Mon May 04 07:34:37.795040 2026] [:error] [pid 11959:tid 11997] [client 20.9.82.33:26445] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ptanf.php"] [unique_id "affbjQojk2nvxs7h5Ku7AgAAAMk"]
[Mon May 04 07:34:38.801530 2026] [:error] [pid 12022:tid 12046] [client 20.9.82.33:26576] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ptanf.php"] [unique_id "affbjkVhgvCNKBWnaTIT6wAAAJY"]
[Mon May 04 07:34:40.741327 2026] [:error] [pid 12022:tid 12030] [client 20.9.82.33:26552] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "affbkEVhgvCNKBWnaTIT9wAAAIY"]
[Mon May 04 07:34:41.736095 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26617] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "affbkerVB-w_PyOHK6kb7QAAAVE"]
[Mon May 04 07:34:44.461197 2026] [:error] [pid 12051:tid 12057] [client 20.9.82.33:26496] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "affblOrVB-w_PyOHK6kb9gAAAUQ"]
[Mon May 04 07:34:45.486797 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26459] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ctex1.php"] [unique_id "affblerVB-w_PyOHK6kb-wAAAVE"]
[Mon May 04 07:34:46.861388 2026] [:error] [pid 12022:tid 12037] [client 20.9.82.33:26441] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "affblkVhgvCNKBWnaTIUHgAAAI0"]
[Mon May 04 07:34:47.549714 2026] [:error] [pid 11958:tid 11977] [client 20.9.82.33:26492] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "affblzAK_o2NLEdfAUkeYAAAAFA"]
[Mon May 04 07:34:48.834519 2026] [:error] [pid 12022:tid 12029] [client 20.9.82.33:26556] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gelio1.php"] [unique_id "affbmEVhgvCNKBWnaTIUIwAAAIU"]
[Mon May 04 07:34:49.962186 2026] [:error] [pid 11958:tid 11968] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Mon May 04 07:34:50.413982 2026] [:error] [pid 11958:tid 11985] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Mon May 04 07:34:50.623824 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Mon May 04 07:34:50.888507 2026] [:error] [pid 11958:tid 11963] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/axe.php
[Mon May 04 07:34:51.078681 2026] [:error] [pid 11958:tid 11979] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/index0.php
[Mon May 04 07:34:51.272136 2026] [:error] [pid 11958:tid 11973] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-01ul.php
[Mon May 04 07:34:51.481677 2026] [:error] [pid 11958:tid 11983] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/e3.php
[Mon May 04 07:34:51.674535 2026] [:error] [pid 11958:tid 11969] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/fkohd.php
[Mon May 04 07:34:51.864741 2026] [:error] [pid 11958:tid 11961] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Mon May 04 07:34:52.054570 2026] [:error] [pid 11958:tid 11971] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Mon May 04 07:34:52.260742 2026] [:error] [pid 11958:tid 11962] [client 20.9.82.33:26527] File does not exist: /usr/local/apache/htdocs/suspended-page/zo.php
[Mon May 04 07:34:52.464391 2026] [:error] [pid 11958:tid 11975] [client 20.9.82.33:26527] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "affbnDAK_o2NLEdfAUkecAAAAE4"]
[Mon May 04 07:34:54.107218 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26432] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "affbnurVB-w_PyOHK6kcCwAAAUc"]
[Mon May 04 07:34:54.997083 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:26555] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "affbnurVB-w_PyOHK6kcDQAAAVg"]
[Mon May 04 07:34:56.961621 2026] [:error] [pid 11958:tid 11963] [client 20.9.82.33:26618] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xy.php"] [unique_id "affboDAK_o2NLEdfAUkedQAAAEI"]
[Mon May 04 07:34:57.780861 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26604] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/masks.php"] [unique_id "affboerVB-w_PyOHK6kcFAAAAU8"]
[Mon May 04 07:34:59.395623 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:26620] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/masks.php"] [unique_id "affbo-rVB-w_PyOHK6kcGQAAAUA"]
[Mon May 04 07:35:00.881717 2026] [:error] [pid 12022:tid 12040] [client 20.9.82.33:26379] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/masks.php"] [unique_id "affbpEVhgvCNKBWnaTIULwAAAJA"]
[Mon May 04 07:35:03.680354 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:26561] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/masks.php"] [unique_id "affbp0VhgvCNKBWnaTIUMQAAAIs"]
[Mon May 04 07:35:04.589554 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:26503] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "affbqOrVB-w_PyOHK6kcKQAAAUw"]
[Mon May 04 07:35:06.975461 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:26518] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "affbqurVB-w_PyOHK6kcLwAAAUM"]
[Mon May 04 07:35:07.839740 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26443] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "affbq-rVB-w_PyOHK6kcMQAAAUc"]
[Mon May 04 07:35:10.644674 2026] [:error] [pid 12022:tid 12024] [client 20.9.82.33:26438] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "affbrkVhgvCNKBWnaTIUNwAAAIA"]
[Mon May 04 07:35:12.021286 2026] [:error] [pid 11958:tid 11981] [client 20.9.82.33:26562] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "affbsDAK_o2NLEdfAUkeeQAAAFQ"]
[Mon May 04 07:35:14.081739 2026] [:error] [pid 12022:tid 12032] [client 20.9.82.33:26606] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "affbskVhgvCNKBWnaTIUOwAAAIg"]
[Mon May 04 07:35:14.724502 2026] [:error] [pid 11958:tid 11976] [client 20.9.82.33:26536] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "affbsjAK_o2NLEdfAUkeewAAAE8"]
[Mon May 04 07:35:15.550736 2026] [:error] [pid 12022:tid 12026] [client 20.9.82.33:26574] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xfun.php"] [unique_id "affbs0VhgvCNKBWnaTIUPAAAAII"]
[Mon May 04 07:35:17.300800 2026] [:error] [pid 11959:tid 11997] [client 20.9.82.33:26524] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "affbtQojk2nvxs7h5Ku7JgAAAMk"]
[Mon May 04 07:35:18.351693 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:26615] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "affbturVB-w_PyOHK6kcXAAAAUw"]
[Mon May 04 07:35:19.876228 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:26493] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "affbt0VhgvCNKBWnaTIUQQAAAIs"]
[Mon May 04 07:35:21.466886 2026] [:error] [pid 11958:tid 11971] [client 20.9.82.33:26522] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "affbuTAK_o2NLEdfAUkehQAAAEo"]
[Mon May 04 07:35:23.869784 2026] [:error] [pid 11958:tid 11968] [client 20.9.82.33:26456] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vv.php"] [unique_id "affbuzAK_o2NLEdfAUkeiwAAAEc"]
[Mon May 04 07:35:24.633365 2026] [:error] [pid 12022:tid 12046] [client 20.9.82.33:26471] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vv.php"] [unique_id "affbvEVhgvCNKBWnaTIUSAAAAJY"]
[Mon May 04 07:35:25.316847 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:26463] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vv.php"] [unique_id "affbvQojk2nvxs7h5Ku7MgAAAMQ"]
[Mon May 04 07:35:27.916110 2026] [:error] [pid 11959:tid 12006] [client 20.9.82.33:26553] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vv.php"] [unique_id "affbvwojk2nvxs7h5Ku7PgAAANI"]
[Mon May 04 07:35:28.983564 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:26457] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpconf.php"] [unique_id "affbwEVhgvCNKBWnaTIUTwAAAJg"]
[Mon May 04 07:35:30.522092 2026] [:error] [pid 11959:tid 12001] [client 20.9.82.33:26446] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpconf.php"] [unique_id "affbwgojk2nvxs7h5Ku7RwAAAM0"]
[Mon May 04 07:35:32.334123 2026] [:error] [pid 11959:tid 12009] [client 20.9.82.33:26601] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpconf.php"] [unique_id "affbxAojk2nvxs7h5Ku7SgAAANU"]
[Mon May 04 07:35:34.166543 2026] [:error] [pid 11959:tid 12004] [client 20.9.82.33:26547] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpconf.php"] [unique_id "affbxgojk2nvxs7h5Ku7TwAAANA"]
[Mon May 04 07:35:34.906671 2026] [:error] [pid 11959:tid 11990] [client 20.9.82.33:26488] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "affbxgojk2nvxs7h5Ku7UwAAAMI"]
[Mon May 04 07:35:36.038143 2026] [:error] [pid 12022:tid 12041] [client 20.9.82.33:26519] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "affbyEVhgvCNKBWnaTIUWQAAAJE"]
[Mon May 04 07:35:37.357419 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:26539] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "affbyQojk2nvxs7h5Ku7WAAAAMQ"]
[Mon May 04 07:35:38.603593 2026] [:error] [pid 12022:tid 12045] [client 20.9.82.33:26478] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib.php"] [unique_id "affbykVhgvCNKBWnaTIUXgAAAJU"]
[Mon May 04 07:35:40.365705 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:26587] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-zx.php"] [unique_id "affbzEVhgvCNKBWnaTIUZQAAAJI"]
[Mon May 04 07:35:41.559522 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:26514] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-zx.php"] [unique_id "affbzerVB-w_PyOHK6kcewAAAUE"]
[Mon May 04 07:35:42.389994 2026] [:error] [pid 11958:tid 11984] [client 20.9.82.33:26434] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-zx.php"] [unique_id "affbzjAK_o2NLEdfAUkergAAAFc"]
[Mon May 04 07:35:43.414305 2026] [:error] [pid 11958:tid 11979] [client 20.9.82.33:26467] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-zx.php"] [unique_id "affbzzAK_o2NLEdfAUkerwAAAFI"]
[Mon May 04 07:35:45.471766 2026] [:error] [pid 11958:tid 11977] [client 20.9.82.33:26500] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "affb0TAK_o2NLEdfAUkesgAAAFA"]
[Mon May 04 07:35:47.442356 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:26465] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "affb0-rVB-w_PyOHK6kciAAAAUE"]
[Mon May 04 07:35:49.656096 2026] [:error] [pid 12022:tid 12029] [client 20.9.82.33:26521] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/000.php"] [unique_id "affb1UVhgvCNKBWnaTIUbgAAAIU"]
[Mon May 04 07:35:53.149779 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Mon May 04 07:35:53.348148 2026] [:error] [pid 12022:tid 12033] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Mon May 04 07:35:53.555780 2026] [:error] [pid 12022:tid 12039] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/iov.php
[Mon May 04 07:35:53.745663 2026] [:error] [pid 12022:tid 12029] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/jodohghi.php
[Mon May 04 07:35:54.015558 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/rendi59.php
[Mon May 04 07:35:54.314401 2026] [:error] [pid 12022:tid 12030] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/rivasqup.php
[Mon May 04 07:35:54.750496 2026] [:error] [pid 12022:tid 12032] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/mga.php
[Mon May 04 07:35:54.945510 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/dshtv.php
[Mon May 04 07:35:55.135219 2026] [:error] [pid 12022:tid 12033] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/sym403.php
[Mon May 04 07:35:55.325361 2026] [:error] [pid 12022:tid 12039] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/temp1.php
[Mon May 04 07:35:55.697401 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Mon May 04 07:35:56.049345 2026] [:error] [pid 12022:tid 12029] [client 20.9.82.33:26482] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "affb3EVhgvCNKBWnaTIUlgAAAIU"]
[Mon May 04 07:35:56.870538 2026] [:error] [pid 11958:tid 11963] [client 20.9.82.33:26566] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "affb3DAK_o2NLEdfAUkevwAAAEI"]
[Mon May 04 07:35:58.482827 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:26378] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "affb3kVhgvCNKBWnaTIUngAAAJc"]
[Mon May 04 07:36:00.582186 2026] [:error] [pid 11959:tid 12000] [client 20.9.82.33:26369] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "affb4Aojk2nvxs7h5Ku7sgAAAMw"]
[Mon May 04 07:36:01.745654 2026] [:error] [pid 11959:tid 11997] [client 20.9.82.33:26621] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "affb4Qojk2nvxs7h5Ku7tgAAAMk"]
[Mon May 04 07:36:03.021516 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:26439] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "affb4-rVB-w_PyOHK6kc3wAAAU0"]
[Mon May 04 07:36:03.885806 2026] [:error] [pid 11959:tid 12004] [client 20.9.82.33:26605] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "affb4wojk2nvxs7h5Ku7ugAAANA"]
[Mon May 04 07:36:05.127828 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26380] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/Sanskrit.php"] [unique_id "affb5erVB-w_PyOHK6kc5QAAAVE"]
[Mon May 04 07:36:06.665470 2026] [:error] [pid 12051:tid 12064] [client 20.9.82.33:26437] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bbny.php"] [unique_id "affb5urVB-w_PyOHK6kc6wAAAUs"]
[Mon May 04 07:36:07.820071 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:26472] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bbny.php"] [unique_id "affb5-rVB-w_PyOHK6kc7gAAAUI"]
[Mon May 04 07:36:10.607443 2026] [:error] [pid 11959:tid 12004] [client 20.9.82.33:26529] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bbny.php"] [unique_id "affb6gojk2nvxs7h5Ku7xQAAANA"]
[Mon May 04 07:36:11.736211 2026] [:error] [pid 11958:tid 11969] [client 20.9.82.33:26458] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bbny.php"] [unique_id "affb6zAK_o2NLEdfAUkeyQAAAEg"]
[Mon May 04 07:36:12.455208 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:26579] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "affb7OrVB-w_PyOHK6kc9gAAAU0"]
[Mon May 04 07:36:13.674611 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:26411] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "affb7TAK_o2NLEdfAUkezAAAAE0"]
[Mon May 04 07:36:14.406993 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:26540] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "affb7urVB-w_PyOHK6kc_QAAAUk"]
[Mon May 04 07:36:16.367328 2026] [:error] [pid 12022:tid 12028] [client 20.9.82.33:26311] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ggb.php"] [unique_id "affb8EVhgvCNKBWnaTIUwwAAAIQ"]
[Mon May 04 07:36:17.630312 2026] [:error] [pid 11959:tid 11990] [client 20.9.82.33:26554] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zhw.php"] [unique_id "affb8Qojk2nvxs7h5Ku72gAAAMI"]
[Mon May 04 07:36:19.285527 2026] [:error] [pid 11958:tid 11966] [client 20.9.82.33:26534] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zhw.php"] [unique_id "affb8zAK_o2NLEdfAUkezwAAAEU"]
[Mon May 04 07:36:20.328920 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:26455] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zhw.php"] [unique_id "affb9EVhgvCNKBWnaTIUygAAAI4"]
[Mon May 04 07:36:21.307938 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:26421] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zhw.php"] [unique_id "affb9erVB-w_PyOHK6kdDQAAAUg"]
[Mon May 04 07:36:24.673303 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:26454] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "affb-EVhgvCNKBWnaTIUzwAAAJg"]
[Mon May 04 07:36:25.991506 2026] [:error] [pid 12022:tid 12046] [client 20.9.82.33:26370] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "affb-UVhgvCNKBWnaTIU1AAAAJY"]
[Mon May 04 07:36:27.097718 2026] [:error] [pid 11959:tid 12000] [client 20.9.82.33:26449] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "affb-wojk2nvxs7h5Ku76AAAAMw"]
[Mon May 04 07:36:27.969095 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:26484] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "affb--rVB-w_PyOHK6kdIgAAAVA"]
[Mon May 04 07:36:28.960297 2026] [:error] [pid 11959:tid 12003] [client 20.9.82.33:26462] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "affb_Aojk2nvxs7h5Ku76gAAAM8"]
[Mon May 04 07:36:31.018448 2026] [:error] [pid 11958:tid 11983] [client 20.9.82.33:26374] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "affb_zAK_o2NLEdfAUke4gAAAFY"]
[Mon May 04 07:36:32.883674 2026] [:error] [pid 11958:tid 11964] [client 20.9.82.33:26452] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "affcADAK_o2NLEdfAUke6QAAAEM"]
[Mon May 04 07:36:33.540161 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26391] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "affcAerVB-w_PyOHK6kdMAAAAUc"]
[Mon May 04 07:36:35.445324 2026] [:error] [pid 11959:tid 12012] [client 20.9.82.33:26433] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lov.php"] [unique_id "affcAwojk2nvxs7h5Ku79QAAANg"]
[Mon May 04 07:36:37.055505 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:26406] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lov.php"] [unique_id "affcBerVB-w_PyOHK6kdNwAAAUk"]
[Mon May 04 07:36:38.875825 2026] [:error] [pid 12022:tid 12037] [client 20.9.82.33:26476] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lov.php"] [unique_id "affcBkVhgvCNKBWnaTIVBgAAAI0"]
[Mon May 04 07:36:40.722831 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:26409] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lov.php"] [unique_id "affcCEVhgvCNKBWnaTIVCgAAAJg"]
[Mon May 04 07:36:44.596965 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:26477] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/knw.php"] [unique_id "affcDOrVB-w_PyOHK6kdPAAAAUk"]
[Mon May 04 07:36:46.106988 2026] [:error] [pid 11959:tid 11990] [client 20.9.82.33:26460] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/knw.php"] [unique_id "affcDgojk2nvxs7h5Ku8LQAAAMI"]
[Mon May 04 07:36:46.961026 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26487] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/knw.php"] [unique_id "affcDurVB-w_PyOHK6kdUAAAAVE"]
[Mon May 04 07:36:47.581970 2026] [:error] [pid 12051:tid 12064] [client 20.9.82.33:26480] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/knw.php"] [unique_id "affcD-rVB-w_PyOHK6kdVgAAAUs"]
[Mon May 04 07:36:49.778276 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:26469] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "affcEerVB-w_PyOHK6kdYwAAAU4"]
[Mon May 04 07:36:50.508393 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:26474] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "affcEurVB-w_PyOHK6kdZgAAAVg"]
[Mon May 04 07:36:51.843547 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:26405] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "affcE-rVB-w_PyOHK6kdbwAAAVY"]
[Mon May 04 07:36:52.684993 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:26622] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fi.php"] [unique_id "affcFEVhgvCNKBWnaTIVNAAAAJI"]
[Mon May 04 07:36:54.303016 2026] [:error] [pid 11958:tid 11977] [client 20.9.82.33:26489] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jlex.php"] [unique_id "affcFjAK_o2NLEdfAUkfQAAAAFA"]
[Mon May 04 07:36:55.759860 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex.php
[Mon May 04 07:36:55.962399 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k7djufwez2.php
[Mon May 04 07:36:56.154947 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-tiroto.php
[Mon May 04 07:36:56.462117 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/son.php
[Mon May 04 07:36:56.925354 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/99.php
[Mon May 04 07:36:57.114837 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Mon May 04 07:36:57.304647 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Mon May 04 07:36:57.606606 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/ay.php
[Mon May 04 07:36:57.802033 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26386] File does not exist: /usr/local/apache/htdocs/suspended-page/options.php
[Mon May 04 07:36:57.995024 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:26386] [client 20.9.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "affcGerVB-w_PyOHK6kdygAAAVY"]
[Mon May 04 07:36:59.024689 2026] [:error] [pid 11958:tid 11965] [client 20.9.82.33:26372] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Mon May 04 07:36:59.214889 2026] [:error] [pid 11958:tid 11963] [client 20.9.82.33:26372] File does not exist: /usr/local/apache/htdocs/suspended-page/1a.php
[Mon May 04 07:36:59.412019 2026] [:error] [pid 11958:tid 11978] [client 20.9.82.33:26372] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rh.php"] [unique_id "affcGzAK_o2NLEdfAUkfRwAAAFE"]
[Mon May 04 07:37:01.041693 2026] [:error] [pid 12022:tid 12027] [client 20.9.82.33:26515] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rh.php"] [unique_id "affcHUVhgvCNKBWnaTIVUwAAAIM"]
[Mon May 04 07:37:02.232073 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:26473] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rh.php"] [unique_id "affcHkVhgvCNKBWnaTIVXQAAAIo"]
[Mon May 04 07:37:03.178912 2026] [:error] [pid 11959:tid 11991] [client 20.9.82.33:26450] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/rh.php"] [unique_id "affcHwojk2nvxs7h5Ku8VwAAAMM"]
[Mon May 04 07:37:04.832683 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:26481] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file-kikikoko.php"] [unique_id "affcIOrVB-w_PyOHK6kdzgAAAU4"]
[Mon May 04 07:37:05.732309 2026] [:error] [pid 12051:tid 12064] [client 20.9.82.33:26448] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file-kikikoko.php"] [unique_id "affcIerVB-w_PyOHK6kd0wAAAUs"]
[Mon May 04 07:37:08.112348 2026] [:error] [pid 11958:tid 11985] [client 20.9.82.33:26341] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file-kikikoko.php"] [unique_id "affcJDAK_o2NLEdfAUkfjQAAAFg"]
[Mon May 04 07:37:09.481091 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:26486] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file-kikikoko.php"] [unique_id "affcJerVB-w_PyOHK6kd4QAAAUw"]
[Mon May 04 07:37:11.337448 2026] [:error] [pid 11959:tid 12005] [client 20.9.82.33:26444] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "affcJwojk2nvxs7h5Ku8ZgAAANE"]
[Mon May 04 07:37:13.703126 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:26309] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "affcKerVB-w_PyOHK6keEwAAAUA"]
[Mon May 04 07:37:14.772860 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:26321] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "affcKjAK_o2NLEdfAUkfmAAAAE0"]
[Mon May 04 07:37:17.652844 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:26387] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cu.php"] [unique_id "affcLerVB-w_PyOHK6keMwAAAUM"]
[Mon May 04 07:37:18.439835 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:26345] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tramuibs.php"] [unique_id "affcLurVB-w_PyOHK6keNgAAAVY"]
[Mon May 04 07:37:19.922053 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:26532] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tramuibs.php"] [unique_id "affcL-rVB-w_PyOHK6kePAAAAU4"]
[Mon May 04 07:37:21.081974 2026] [:error] [pid 12022:tid 12032] [client 20.9.82.33:26424] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tramuibs.php"] [unique_id "affcMUVhgvCNKBWnaTIVlgAAAIg"]
[Mon May 04 07:37:23.242491 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:26590] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tramuibs.php"] [unique_id "affcMwojk2nvxs7h5Ku8hgAAAMQ"]
[Mon May 04 07:37:25.388088 2026] [:error] [pid 11959:tid 12005] [client 20.9.82.33:26494] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/19.php"] [unique_id "affcNQojk2nvxs7h5Ku8hwAAANE"]
[Mon May 04 07:37:26.350957 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:26376] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/19.php"] [unique_id "affcNurVB-w_PyOHK6keUAAAAUw"]
[Mon May 04 07:37:27.001876 2026] [:error] [pid 12022:tid 12045] [client 20.9.82.33:26510] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/19.php"] [unique_id "affcN0VhgvCNKBWnaTIVpwAAAJU"]
[Mon May 04 07:37:28.969634 2026] [:error] [pid 11958:tid 11968] [client 20.9.82.33:26436] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/19.php"] [unique_id "affcODAK_o2NLEdfAUkfpwAAAEc"]
[Mon May 04 07:37:34.090441 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26422] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "affcPurVB-w_PyOHK6kebAAAAUc"]
[Mon May 04 07:37:35.104886 2026] [:error] [pid 11959:tid 11991] [client 20.9.82.33:26542] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "affcPwojk2nvxs7h5Ku8lgAAAMM"]
[Mon May 04 07:37:35.991608 2026] [:error] [pid 11959:tid 12010] [client 20.9.82.33:26571] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "affcPwojk2nvxs7h5Ku8mAAAANY"]
[Mon May 04 07:37:36.714367 2026] [:error] [pid 11959:tid 12009] [client 20.9.82.33:26619] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "affcQAojk2nvxs7h5Ku8nQAAANU"]
[Mon May 04 07:37:40.837082 2026] [:error] [pid 11958:tid 11964] [client 20.9.82.33:26416] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bpxrn.php"] [unique_id "affcRDAK_o2NLEdfAUkfuAAAAEM"]
[Mon May 04 07:37:41.744941 2026] [:error] [pid 11959:tid 11993] [client 20.9.82.33:26384] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bpxrn.php"] [unique_id "affcRQojk2nvxs7h5Ku8qgAAAMU"]
[Mon May 04 07:37:43.097175 2026] [:error] [pid 12022:tid 12030] [client 20.9.82.33:26535] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bpxrn.php"] [unique_id "affcR0VhgvCNKBWnaTIVzgAAAIY"]
[Mon May 04 07:37:44.148048 2026] [:error] [pid 11959:tid 12005] [client 20.9.82.33:26572] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bpxrn.php"] [unique_id "affcSAojk2nvxs7h5Ku8rgAAANE"]
[Mon May 04 07:37:45.066153 2026] [:error] [pid 11958:tid 11980] [client 20.9.82.33:26404] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "affcSTAK_o2NLEdfAUkfwwAAAFM"]
[Mon May 04 07:37:46.166340 2026] [:error] [pid 12022:tid 12024] [client 20.9.82.33:26557] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "affcSkVhgvCNKBWnaTIV1wAAAIA"]
[Mon May 04 07:37:47.507800 2026] [:error] [pid 12022:tid 12030] [client 20.9.82.33:26390] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "affcS0VhgvCNKBWnaTIV3AAAAIY"]
[Mon May 04 07:37:48.431666 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:26607] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "affcTOrVB-w_PyOHK6kedwAAAVI"]
[Mon May 04 07:37:49.539682 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:26545] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws37.php"] [unique_id "affcTUVhgvCNKBWnaTIV4gAAAIo"]
[Mon May 04 07:37:51.285003 2026] [:error] [pid 11959:tid 12012] [client 20.9.82.33:26490] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws37.php"] [unique_id "affcTwojk2nvxs7h5Ku8wwAAANg"]
[Mon May 04 07:37:52.229497 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26317] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws37.php"] [unique_id "affcUOrVB-w_PyOHK6kehgAAAU8"]
[Mon May 04 07:37:53.428888 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26420] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws37.php"] [unique_id "affcUerVB-w_PyOHK6kejAAAAUc"]
[Mon May 04 07:37:54.216630 2026] [:error] [pid 11958:tid 11983] [client 20.9.82.33:26504] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "affcUjAK_o2NLEdfAUkfywAAAFY"]
[Mon May 04 07:37:55.989328 2026] [:error] [pid 12051:tid 12076] [client 20.9.82.33:26573] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "affcU-rVB-w_PyOHK6kekgAAAVc"]
[Mon May 04 07:37:58.609892 2026] [:error] [pid 12051:tid 12072] [client 20.9.82.33:26591] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "affcVurVB-w_PyOHK6keowAAAVM"]
[Mon May 04 07:38:00.504635 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/sky.php
[Mon May 04 07:38:00.780749 2026] [:error] [pid 12022:tid 12029] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/bojcdooq.php
[Mon May 04 07:38:00.972038 2026] [:error] [pid 12022:tid 12039] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/zdd.php
[Mon May 04 07:38:01.299020 2026] [:error] [pid 12022:tid 12024] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/133.php
[Mon May 04 07:38:01.489940 2026] [:error] [pid 12022:tid 12026] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/jq.php
[Mon May 04 07:38:01.724935 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/cro.php
[Mon May 04 07:38:01.914360 2026] [:error] [pid 12022:tid 12030] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/wwx.php
[Mon May 04 07:38:02.103151 2026] [:error] [pid 12022:tid 12036] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon May 04 07:38:02.295595 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/blox.php
[Mon May 04 07:38:02.507886 2026] [:error] [pid 12022:tid 12027] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/berax.php
[Mon May 04 07:38:03.005383 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:26538] File does not exist: /usr/local/apache/htdocs/suspended-page/bkxzo.php
[Mon May 04 07:38:03.198724 2026] [:error] [pid 12022:tid 12024] [client 20.9.82.33:26538] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cdxadmin.php"] [unique_id "affcW0VhgvCNKBWnaTIWDAAAAIA"]
[Mon May 04 07:38:09.746323 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:26523] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cdxadmin.php"] [unique_id "affcYerVB-w_PyOHK6keuQAAAVI"]
[Mon May 04 07:38:14.809861 2026] [:error] [pid 12022:tid 12046] [client 20.9.82.33:26440] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cdxadmin.php"] [unique_id "affcZkVhgvCNKBWnaTIWRgAAAJY"]
[Mon May 04 07:38:16.180598 2026] [:error] [pid 11959:tid 12010] [client 20.9.82.33:26240] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cdxadmin.php"] [unique_id "affcaAojk2nvxs7h5Ku83wAAANY"]
[Mon May 04 07:38:16.835929 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:26516] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dfre.php"] [unique_id "affcaDAK_o2NLEdfAUkf1AAAAE0"]
[Mon May 04 07:38:17.572622 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26461] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dfre.php"] [unique_id "affcaerVB-w_PyOHK6keywAAAU8"]
[Mon May 04 07:38:19.327601 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:26564] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dfre.php"] [unique_id "affca-rVB-w_PyOHK6ke0wAAAUM"]
[Mon May 04 07:38:20.662907 2026] [:error] [pid 11958:tid 11977] [client 20.9.82.33:26509] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dfre.php"] [unique_id "affcbDAK_o2NLEdfAUkf3QAAAFA"]
[Mon May 04 07:38:22.666471 2026] [:error] [pid 11959:tid 12006] [client 20.9.82.33:26389] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sko.php"] [unique_id "affcbgojk2nvxs7h5Ku86QAAANI"]
[Mon May 04 07:38:26.181305 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:26442] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sko.php"] [unique_id "affccurVB-w_PyOHK6ke7QAAAVg"]
[Mon May 04 07:38:27.630680 2026] [:error] [pid 12051:tid 12072] [client 20.9.82.33:26613] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sko.php"] [unique_id "affcc-rVB-w_PyOHK6ke8gAAAVM"]
[Mon May 04 07:38:28.639826 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:26447] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sko.php"] [unique_id "affcdOrVB-w_PyOHK6ke9gAAAUo"]
[Mon May 04 07:38:29.460701 2026] [:error] [pid 11958:tid 11980] [client 20.9.82.33:26435] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shorw.php"] [unique_id "affcdTAK_o2NLEdfAUkf5wAAAFM"]
[Mon May 04 07:38:31.099987 2026] [:error] [pid 11959:tid 11990] [client 20.9.82.33:26609] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shorw.php"] [unique_id "affcdwojk2nvxs7h5Ku89wAAAMI"]
[Mon May 04 07:38:38.528300 2026] [:error] [pid 11958:tid 11964] [client 20.9.82.33:26570] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shorw.php"] [unique_id "affcfjAK_o2NLEdfAUkf9QAAAEM"]
[Mon May 04 07:38:40.619915 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:26569] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shorw.php"] [unique_id "affcgEVhgvCNKBWnaTIWegAAAIo"]
[Mon May 04 07:38:41.963252 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:26583] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shelp.php"] [unique_id "affcgUVhgvCNKBWnaTIWfAAAAI4"]
[Mon May 04 07:38:43.785555 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:26593] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shelp.php"] [unique_id "affcg-rVB-w_PyOHK6kfDQAAAU4"]
[Mon May 04 07:38:47.350161 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26610] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shelp.php"] [unique_id "affch-rVB-w_PyOHK6kfGAAAAVE"]
[Mon May 04 07:38:50.433148 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:26565] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shelp.php"] [unique_id "affciurVB-w_PyOHK6kfHQAAAUo"]
[Mon May 04 07:38:51.912707 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26377] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/seyv.php"] [unique_id "affci-rVB-w_PyOHK6kfHgAAAU8"]
[Mon May 04 07:38:59.990566 2026] [:error] [pid 11958:tid 11976] [client 20.9.82.33:26598] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/seyv.php"] [unique_id "affckzAK_o2NLEdfAUkgEgAAAE8"]
[Mon May 04 07:39:00.958132 2026] [:error] [pid 11959:tid 11993] [client 20.9.82.33:26517] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/seyv.php"] [unique_id "affclAojk2nvxs7h5Ku9GgAAAMU"]
[Mon May 04 07:39:07.729649 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/sad821.php
[Mon May 04 07:39:07.921077 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8210.php
[Mon May 04 07:39:08.114603 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8rd1.php
[Mon May 04 07:39:08.329554 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/saxzgf5.php
[Mon May 04 07:39:08.548411 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/saxzw9t.php
[Mon May 04 07:39:08.738769 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/sder5252u.php
[Mon May 04 07:39:08.929064 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/sderty5u.php
[Mon May 04 07:39:09.119707 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/hilk.php
[Mon May 04 07:39:09.309056 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/miso.php
[Mon May 04 07:39:09.498249 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Mon May 04 07:39:09.687690 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:26417] File does not exist: /usr/local/apache/htdocs/suspended-page/checkout.php
[Mon May 04 07:39:09.874141 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:26417] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fictioner.php"] [unique_id "affcnerVB-w_PyOHK6kfTgAAAUg"]
[Mon May 04 07:39:10.489718 2026] [:error] [pid 12022:tid 12028] [client 20.9.82.33:26392] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fictioner.php"] [unique_id "affcnkVhgvCNKBWnaTIWkQAAAIQ"]
[Mon May 04 07:39:14.293978 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:26537] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fictioner.php"] [unique_id "affcourVB-w_PyOHK6kfVwAAAVU"]
[Mon May 04 07:39:15.519311 2026] [:error] [pid 12022:tid 12039] [client 20.9.82.33:26396] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fictioner.php"] [unique_id "affco0VhgvCNKBWnaTIWlQAAAI8"]
[Mon May 04 07:39:16.831163 2026] [:error] [pid 11958:tid 11980] [client 20.9.82.33:26511] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "affcpDAK_o2NLEdfAUkgHAAAAFM"]
[Mon May 04 07:39:18.744470 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:26549] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "affcpurVB-w_PyOHK6kfXQAAAUI"]
[Mon May 04 07:39:20.399930 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:26367] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "affcqEVhgvCNKBWnaTIWngAAAIo"]
[Mon May 04 07:39:24.682388 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:26470] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ortasekerli1.php"] [unique_id "affcrOrVB-w_PyOHK6kfZQAAAUk"]
[Mon May 04 07:39:25.535126 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:26453] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "affcrerVB-w_PyOHK6kfZwAAAUw"]
[Mon May 04 07:39:26.534948 2026] [:error] [pid 11959:tid 12007] [client 20.9.82.33:26533] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "affcrgojk2nvxs7h5Ku9LwAAANM"]
[Mon May 04 07:39:28.476983 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:26617] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "affcsOrVB-w_PyOHK6kfbQAAAUA"]
[Mon May 04 07:39:29.907322 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26313] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxa.php"] [unique_id "affcserVB-w_PyOHK6kfdAAAAVE"]
[Mon May 04 07:39:30.868225 2026] [:error] [pid 11959:tid 11991] [client 20.9.82.33:26581] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "affcsgojk2nvxs7h5Ku9MAAAAMM"]
[Mon May 04 07:39:31.989674 2026] [:error] [pid 12022:tid 12032] [client 20.9.82.33:26445] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "affcs0VhgvCNKBWnaTIWqwAAAIg"]
[Mon May 04 07:39:33.267903 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:26577] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "affcterVB-w_PyOHK6kfegAAAU8"]
[Mon May 04 07:39:35.064592 2026] [:error] [pid 11959:tid 12003] [client 20.9.82.33:26604] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "affctwojk2nvxs7h5Ku9OAAAAM8"]
[Mon May 04 07:39:38.651516 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:26496] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "affcuurVB-w_PyOHK6kffQAAAUc"]
[Mon May 04 07:39:40.178737 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:26245] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "affcvOrVB-w_PyOHK6kfhgAAAVY"]
[Mon May 04 07:39:42.249057 2026] [:error] [pid 11958:tid 11983] [client 20.9.82.33:26602] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "affcvjAK_o2NLEdfAUkgNQAAAFY"]
[Mon May 04 07:39:44.764727 2026] [:error] [pid 12022:tid 12026] [client 20.9.82.33:26375] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-asyn-upload.php"] [unique_id "affcwEVhgvCNKBWnaTIWvgAAAII"]
[Mon May 04 07:39:45.473359 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:26567] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/redixsx.php"] [unique_id "affcwerVB-w_PyOHK6kflAAAAVE"]
[Mon May 04 07:39:47.356818 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:26501] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/redixsx.php"] [unique_id "affcw-rVB-w_PyOHK6kfmQAAAUU"]
[Mon May 04 07:39:50.354805 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:26586] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/redixsx.php"] [unique_id "affcxurVB-w_PyOHK6kfogAAAUo"]
[Mon May 04 07:39:53.059007 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:26410] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/redixsx.php"] [unique_id "affcyUVhgvCNKBWnaTIWzwAAAJc"]
[Mon May 04 07:39:55.870898 2026] [:error] [pid 12022:tid 12036] [client 20.9.82.33:26620] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "affcy0VhgvCNKBWnaTIW1QAAAIw"]
[Mon May 04 07:39:57.954232 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:26575] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "affczUVhgvCNKBWnaTIW2wAAAJI"]
[Mon May 04 07:39:58.514578 2026] [:error] [pid 11959:tid 11990] [client 20.9.82.33:26589] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "affczgojk2nvxs7h5Ku9RAAAAMI"]
[Mon May 04 07:39:59.813954 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:26497] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alpha.php"] [unique_id "affcz-rVB-w_PyOHK6kfvwAAAVY"]
[Mon May 04 07:40:01.729783 2026] [:error] [pid 11958:tid 11975] [client 20.9.82.33:26432] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "affc0TAK_o2NLEdfAUkgPQAAAE4"]
[Mon May 04 07:40:05.367915 2026] [:error] [pid 11959:tid 11997] [client 20.9.82.33:26520] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "affc1Qojk2nvxs7h5Ku9SQAAAMk"]
[Mon May 04 07:40:06.175355 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:26530] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "affc1urVB-w_PyOHK6kfxQAAAUE"]
[Mon May 04 07:40:07.902209 2026] [:error] [pid 11959:tid 11996] [client 20.9.82.33:26563] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "affc1wojk2nvxs7h5Ku9TQAAAMg"]
[Mon May 04 07:40:09.762914 2026] [:error] [pid 11958:tid 11962] [client 20.9.82.33:26541] File does not exist: /usr/local/apache/htdocs/suspended-page/67.php
[Mon May 04 07:40:09.954101 2026] [:error] [pid 11958:tid 11985] [client 20.9.82.33:26541] File does not exist: /usr/local/apache/htdocs/suspended-page/1mrX.php
[Mon May 04 07:40:10.146521 2026] [:error] [pid 11958:tid 11984] [client 20.9.82.33:26541] File does not exist: /usr/local/apache/htdocs/suspended-page/x402.php
[Mon May 04 07:40:10.337100 2026] [:error] [pid 11958:tid 11977] [client 20.9.82.33:26541] File does not exist: /usr/local/apache/htdocs/suspended-page/485.php
[Mon May 04 07:40:10.773362 2026] [:error] [pid 11958:tid 11968] [client 20.9.82.33:26541] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Mon May 04 07:40:10.963857 2026] [:error] [pid 11958:tid 11964] [client 20.9.82.33:26541] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Mon May 04 09:49:00.753674 2026] [:error] [pid 33186:tid 33198] [client 20.9.90.138:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Mon May 04 09:49:00.944257 2026] [:error] [pid 33186:tid 33207] [client 20.9.90.138:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon May 04 09:49:01.131360 2026] [:error] [pid 33186:tid 33189] [client 20.9.90.138:12345] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff7Dbqlqe0DcmBS9VzqEgAAAAA"]
[Mon May 04 09:49:01.887374 2026] [:error] [pid 12051:tid 12070] [client 20.9.90.138:12302] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff7DerVB-w_PyOHK6lbcAAAAVE"]
[Mon May 04 09:49:02.673752 2026] [:error] [pid 12022:tid 12037] [client 20.9.90.138:12616] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff7DkVhgvCNKBWnaTJDYQAAAI0"]
[Mon May 04 09:49:03.441309 2026] [:error] [pid 12022:tid 12028] [client 20.9.90.138:23635] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff7D0VhgvCNKBWnaTJDaQAAAIQ"]
[Mon May 04 09:54:03.227493 2026] [:error] [pid 33186:tid 33191] [client 20.9.90.138:15257] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Mon May 04 09:54:03.417379 2026] [:error] [pid 33186:tid 33192] [client 20.9.90.138:15257] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon May 04 09:54:03.628621 2026] [:error] [pid 33186:tid 33208] [client 20.9.90.138:15257] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff8O7qlqe0DcmBS9VztyAAAABM"]
[Mon May 04 09:54:04.385070 2026] [:error] [pid 12051:tid 12067] [client 20.9.90.138:15234] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff8POrVB-w_PyOHK6leHwAAAU4"]
[Mon May 04 09:54:05.169083 2026] [:error] [pid 12051:tid 12064] [client 20.9.90.138:27722] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff8PerVB-w_PyOHK6leKQAAAUs"]
[Mon May 04 09:54:05.924515 2026] [:error] [pid 12051:tid 12067] [client 20.9.90.138:27744] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aff8PerVB-w_PyOHK6leMQAAAU4"]
[Mon May 04 10:36:08.778153 2026] [:error] [pid 33186:tid 33191] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Mon May 04 10:36:08.921478 2026] [:error] [pid 33186:tid 33201] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Mon May 04 10:36:09.065070 2026] [:error] [pid 33186:tid 33208] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon May 04 10:36:09.208396 2026] [:error] [pid 33186:tid 33200] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Mon May 04 10:36:09.352728 2026] [:error] [pid 33186:tid 33203] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Mon May 04 10:36:09.496041 2026] [:error] [pid 33186:tid 33189] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Mon May 04 10:36:11.165351 2026] [:error] [pid 33186:tid 33192] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Mon May 04 10:36:11.308077 2026] [:error] [pid 33186:tid 33200] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Mon May 04 10:36:11.451541 2026] [:error] [pid 33186:tid 33203] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon May 04 10:36:11.595491 2026] [:error] [pid 33186:tid 33199] [client 20.219.187.195:1551] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 04 10:36:11.907589 2026] [:error] [pid 33186:tid 33207] [client 20.219.187.195:1551] [client 20.219.187.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afgGG7qlqe0DcmBS9VwDRQAAABI"]
[Mon May 04 10:36:12.471414 2026] [:error] [pid 33186:tid 33212] [client 20.219.187.195:1555] [client 20.219.187.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afgGHLqlqe0DcmBS9VwDRgAAABc"]
[Mon May 04 10:36:13.229540 2026] [:error] [pid 33186:tid 33210] [client 20.219.187.195:1539] [client 20.219.187.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afgGHbqlqe0DcmBS9VwDRwAAABU"]
[Mon May 04 10:36:13.840199 2026] [:error] [pid 12051:tid 12062] [client 20.219.187.195:1553] [client 20.219.187.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afgGHerVB-w_PyOHK6lskAAAAUk"]
[Mon May 04 11:15:30.132304 2026] [:error] [pid 11958:tid 11979] [client 20.104.98.52:14436] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon May 04 11:15:30.534379 2026] [:error] [pid 11958:tid 11983] [client 20.104.98.52:14436] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon May 04 11:15:30.957799 2026] [:error] [pid 11958:tid 11968] [client 20.104.98.52:14436] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon May 04 11:15:31.168678 2026] [:error] [pid 11958:tid 11981] [client 20.104.98.52:14436] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 04 11:15:31.625320 2026] [:error] [pid 11958:tid 11982] [client 20.104.98.52:14436] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon May 04 11:15:31.837958 2026] [:error] [pid 11958:tid 11974] [client 20.104.98.52:14436] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon May 04 11:15:32.084855 2026] [:error] [pid 11958:tid 11966] [client 20.104.98.52:14436] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon May 04 11:15:32.507419 2026] [:error] [pid 11958:tid 11975] [client 20.104.98.52:14436] [client 20.104.98.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "afgPVDAK_o2NLEdfAUlNPwAAAE4"]
[Mon May 04 11:15:35.460278 2026] [:error] [pid 64610:tid 64624] [client 20.104.98.52:17102] [client 20.104.98.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "afgPV2hJ7aZW62UOoWgcEgAAAQw"]
[Mon May 04 11:15:38.285569 2026] [:error] [pid 64610:tid 64631] [client 20.104.98.52:62137] [client 20.104.98.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "afgPWmhJ7aZW62UOoWgcLAAAARM"]
[Mon May 04 11:15:40.581967 2026] [:error] [pid 11959:tid 12006] [client 20.104.98.52:17125] [client 20.104.98.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "afgPXAojk2nvxs7h5KvzAAAAANI"]
[Mon May 04 17:10:52.545529 2026] [:error] [pid 61150:tid 61159] [client 209.87.169.53:49469] [client 209.87.169.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afhinO8QXWVLiwIGVpdbmQAAAUY"]
[Mon May 04 23:07:19.498268 2026] [:error] [pid 32471:tid 32497] [client 34.74.139.90:35262] [client 34.74.139.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "afi2J3mjpb9EYq6AqhKFPgAAARc"]
[Tue May 05 01:12:17.221800 2026] [:error] [pid 3341:tid 3368] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Tue May 05 01:12:17.314999 2026] [:error] [pid 3341:tid 3361] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Tue May 05 01:12:17.406984 2026] [:error] [pid 3341:tid 3360] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue May 05 01:12:17.500622 2026] [:error] [pid 3341:tid 3344] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Tue May 05 01:12:17.593840 2026] [:error] [pid 3341:tid 3367] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Tue May 05 01:12:17.687286 2026] [:error] [pid 3341:tid 3366] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue May 05 01:12:17.781400 2026] [:error] [pid 3341:tid 3357] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Tue May 05 01:12:17.875985 2026] [:error] [pid 3341:tid 3359] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue May 05 01:12:17.968271 2026] [:error] [pid 3341:tid 3347] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue May 05 01:12:18.061353 2026] [:error] [pid 3341:tid 3346] [client 23.98.69.148:5143] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue May 05 01:12:18.243538 2026] [:error] [pid 3341:tid 3352] [client 23.98.69.148:5143] [client 23.98.69.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afjTck9o3_LordU0wW6_DQAAAIg"]
[Tue May 05 01:12:18.620542 2026] [:error] [pid 3341:tid 3350] [client 23.98.69.148:5136] [client 23.98.69.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afjTck9o3_LordU0wW6_DwAAAIY"]
[Tue May 05 01:12:18.997605 2026] [:error] [pid 3341:tid 3365] [client 23.98.69.148:6921] [client 23.98.69.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afjTck9o3_LordU0wW6_EAAAAJU"]
[Tue May 05 01:12:19.357919 2026] [:error] [pid 61042:tid 61065] [client 23.98.69.148:5165] [client 23.98.69.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afjTc0nAPPS1fjubA9R9DwAAANM"]
[Tue May 05 02:43:09.000824 2026] [:error] [pid 32471:tid 32484] [client 209.87.169.31:48087] [client 209.87.169.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afjovHmjpb9EYq6AqhLFNQAAAQo"]
[Tue May 05 07:53:54.398017 2026] [:error] [pid 53856:tid 53876] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue May 05 07:53:54.675344 2026] [:error] [pid 53856:tid 53870] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue May 05 07:53:54.960939 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue May 05 07:53:55.236762 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue May 05 07:53:55.524358 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue May 05 07:53:55.795461 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue May 05 07:53:56.076378 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue May 05 07:53:56.380925 2026] [:error] [pid 53856:tid 53876] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue May 05 07:53:56.946278 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue May 05 07:53:57.228369 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue May 05 07:53:57.500048 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue May 05 07:53:57.782068 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue May 05 07:53:58.080147 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue May 05 07:53:58.358156 2026] [:error] [pid 53856:tid 53870] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue May 05 07:53:58.648917 2026] [:error] [pid 53856:tid 53879] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue May 05 07:53:58.944196 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue May 05 07:53:59.225710 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue May 05 07:53:59.510843 2026] [:error] [pid 53856:tid 53870] [client 45.86.200.79:59605] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue May 05 07:54:03.621840 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.79:59605] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afkxm3G_NPOxSH0O9aRkmgAAAUw"]
[Tue May 05 07:54:05.082602 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.105:29711] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "afkxnXG_NPOxSH0O9aRk5wAAAUY"]
[Tue May 05 07:54:06.552136 2026] [:error] [pid 53856:tid 53886] [client 45.86.200.112:62485] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue May 05 07:54:07.411539 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.112:62485] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinyfilemanager.php"] [unique_id "afkxn3G_NPOxSH0O9aRlXgAAAVc"]
[Tue May 05 07:54:08.523777 2026] [:error] [pid 39072:tid 39118] [client 45.86.200.78:50195] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue May 05 07:54:08.795437 2026] [:error] [pid 39072:tid 39119] [client 45.86.200.78:50195] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "afkxoPolSHl4aAnrIotniwAAAEw"]
[Tue May 05 07:54:09.626854 2026] [:error] [pid 41055:tid 41061] [client 185.82.72.3:46529] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue May 05 07:54:11.011374 2026] [:error] [pid 41055:tid 41064] [client 185.82.72.3:46529] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "afkxoyepFwKgA_SKOHhKlgAAAQY"]
[Tue May 05 07:54:11.546898 2026] [:error] [pid 39073:tid 39146] [client 45.86.200.77:39071] [client 45.86.200.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/function.php"] [unique_id "afkxo_0kT1BNjk46BkehEwAAAIw"]
[Tue May 05 07:54:13.502740 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.94:40329] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "afkxpXG_NPOxSH0O9aRmcAAAAUY"]
[Tue May 05 07:54:14.099721 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.103:53915] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "afkxpnG_NPOxSH0O9aRmiwAAAUk"]
[Tue May 05 07:54:14.664912 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.111:44537] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "afkxpnG_NPOxSH0O9aRmqQAAAVE"]
[Tue May 05 07:54:15.230796 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.77:25659] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "afkxp3G_NPOxSH0O9aRmyQAAAVc"]
[Tue May 05 07:54:15.765858 2026] [:error] [pid 53856:tid 53876] [client 45.86.200.96:48205] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "afkxp3G_NPOxSH0O9aRm5QAAAUs"]
[Tue May 05 07:54:17.673382 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.89:21189] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "afkxqXG_NPOxSH0O9aRnNQAAAUw"]
[Tue May 05 07:54:18.244972 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.110:48383] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue May 05 07:54:18.811553 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.110:48383] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager.php"] [unique_id "afkxqnG_NPOxSH0O9aRnbQAAAUY"]
[Tue May 05 07:54:19.957168 2026] [:error] [pid 39071:tid 39084] [client 45.86.200.95:50589] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "afkxq4vmnRMz9gRzix3SmwAAAAQ"]
[Tue May 05 07:54:20.815292 2026] [:error] [pid 39178:tid 39199] [client 185.82.72.4:32135] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "afkxrDaPrgTaiOD_15vmEgAAANM"]
[Tue May 05 07:54:22.421708 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.76:20049] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue May 05 07:54:22.688500 2026] [:error] [pid 53856:tid 53886] [client 45.86.200.76:20049] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "afkxrnG_NPOxSH0O9aRoIwAAAVU"]
[Tue May 05 07:54:24.299344 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.100:50783] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue May 05 07:54:25.169848 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.100:50783] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue May 05 07:54:25.982928 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.100:50783] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "afkxsXG_NPOxSH0O9aRo1gAAAUc"]
[Tue May 05 07:54:27.529346 2026] [:error] [pid 39073:tid 39153] [client 45.86.200.79:56531] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue May 05 07:54:27.803165 2026] [:error] [pid 39073:tid 39148] [client 45.86.200.79:56531] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "afkxs_0kT1BNjk46BkeimAAAAI4"]
[Tue May 05 07:54:29.430506 2026] [:error] [pid 39073:tid 39134] [client 45.86.200.60:25917] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue May 05 07:54:29.991126 2026] [:error] [pid 39073:tid 39158] [client 45.86.200.60:25917] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "afkxtf0kT1BNjk46Bkei1AAAAJg"]
[Tue May 05 07:54:30.831788 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.56:33481] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "afkxtvolSHl4aAnrIotqqwAAAEI"]
[Tue May 05 07:54:31.655137 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.109:55397] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Tue May 05 07:54:31.927434 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.109:55397] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue May 05 07:54:32.476573 2026] [:error] [pid 53856:tid 53886] [client 45.86.200.109:55397] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "afkxuHG_NPOxSH0O9aRqBwAAAVU"]
[Tue May 05 07:54:33.311411 2026] [:error] [pid 41055:tid 41061] [client 45.86.200.111:33951] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "afkxuSepFwKgA_SKOHhMfQAAAQM"]
[Tue May 05 07:54:34.116458 2026] [:error] [pid 39073:tid 39156] [client 45.86.200.108:41103] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "afkxuv0kT1BNjk46BkejSQAAAJY"]
[Tue May 05 07:54:34.689587 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.80:24103] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "afkxunG_NPOxSH0O9aRqdgAAAUg"]
[Tue May 05 07:54:35.227852 2026] [:error] [pid 39072:tid 39110] [client 45.86.200.91:21445] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "afkxu_olSHl4aAnrIotrIgAAAEM"]
[Tue May 05 07:54:36.321695 2026] [:error] [pid 41055:tid 41068] [client 45.86.200.88:45971] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue May 05 07:54:36.589710 2026] [:error] [pid 41055:tid 41069] [client 45.86.200.88:45971] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "afkxvCepFwKgA_SKOHhM1gAAAQs"]
[Tue May 05 07:54:38.200874 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.73:33925] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "afkxvnG_NPOxSH0O9aRrKQAAAU0"]
[Tue May 05 07:54:38.742600 2026] [:error] [pid 39073:tid 39138] [client 45.86.200.101:29949] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "afkxvv0kT1BNjk46Bkej2QAAAIQ"]
[Tue May 05 07:54:40.868508 2026] [:error] [pid 53856:tid 53879] [client 45.86.200.93:42947] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue May 05 07:54:41.434646 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.93:42947] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue May 05 07:54:42.519601 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.93:42947] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/admin.php"] [unique_id "afkxwnG_NPOxSH0O9aRsBQAAAUo"]
[Tue May 05 07:54:44.922388 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.98:58403] [client 45.86.200.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.98, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "afkxxDaPrgTaiOD_15vn2gAAAMU"]
[Tue May 05 07:54:45.224180 2026] [:error] [pid 39178:tid 39189] [client 45.86.200.98:58403] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue May 05 07:54:46.616448 2026] [:error] [pid 39178:tid 39181] [client 45.86.200.98:58403] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue May 05 07:54:46.885245 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.98:58403] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue May 05 07:54:48.246407 2026] [:error] [pid 39178:tid 39200] [client 45.86.200.98:58403] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "afkxyDaPrgTaiOD_15voPAAAANQ"]
[Tue May 05 07:54:49.090652 2026] [:error] [pid 39071:tid 39104] [client 45.86.200.99:54977] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue May 05 07:54:49.367541 2026] [:error] [pid 39071:tid 39094] [client 45.86.200.99:54977] [client 45.86.200.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.99, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "afkxyYvmnRMz9gRzix3VWAAAAA4"]
[Tue May 05 07:54:49.931429 2026] [:error] [pid 39071:tid 39082] [client 45.86.200.99:54977] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/item.php"] [unique_id "afkxyYvmnRMz9gRzix3VZwAAAAI"]
[Tue May 05 07:54:51.681131 2026] [:error] [pid 39071:tid 39103] [client 45.86.200.112:51067] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue May 05 07:54:52.238354 2026] [:error] [pid 39071:tid 39088] [client 45.86.200.112:51067] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Tue May 05 07:54:52.778142 2026] [:error] [pid 39071:tid 39082] [client 45.86.200.112:51067] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "afkxzIvmnRMz9gRzix3VtwAAAAI"]
[Tue May 05 07:54:54.377008 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.94:55597] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue May 05 07:54:55.222934 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.94:55597] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Tue May 05 07:54:55.787319 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.94:55597] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Tue May 05 07:54:56.387903 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.94:55597] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue May 05 07:54:56.665705 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.94:55597] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "afkx0HG_NPOxSH0O9aRuAgAAAUA"]
[Tue May 05 07:54:57.222996 2026] [:error] [pid 39073:tid 39137] [client 45.86.200.60:41365] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Tue May 05 07:54:57.510637 2026] [:error] [pid 39073:tid 39143] [client 45.86.200.60:41365] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue May 05 07:54:57.796411 2026] [:error] [pid 39073:tid 39155] [client 45.86.200.60:41365] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "afkx0f0kT1BNjk46BkemNAAAAJU"]
[Tue May 05 07:54:58.606948 2026] [:error] [pid 41055:tid 41058] [client 45.86.200.51:49665] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue May 05 07:54:59.240618 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.51:49665] [client 45.86.200.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.51, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "afkx0yepFwKgA_SKOHhOuwAAARM"]
[Tue May 05 07:54:59.507717 2026] [:error] [pid 41055:tid 41059] [client 45.86.200.51:49665] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "afkx0yepFwKgA_SKOHhOwQAAAQE"]
[Tue May 05 07:55:02.977840 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.105:20725] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Tue May 05 07:55:04.689197 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.105:20725] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue May 05 07:55:04.967002 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.105:20725] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "afkx2DaPrgTaiOD_15vqEAAAANE"]
[Tue May 05 07:55:05.515715 2026] [:error] [pid 39072:tid 39121] [client 45.86.200.77:41031] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue May 05 07:55:06.350680 2026] [:error] [pid 39072:tid 39124] [client 45.86.200.77:41031] [client 45.86.200.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.77, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "afkx2volSHl4aAnrIotu7wAAAFE"]
[Tue May 05 07:55:06.637518 2026] [:error] [pid 39072:tid 39122] [client 45.86.200.77:41031] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue May 05 07:55:06.918162 2026] [:error] [pid 39072:tid 39128] [client 45.86.200.77:41031] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue May 05 07:55:07.193999 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.77:41031] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Tue May 05 07:55:07.469846 2026] [:error] [pid 39072:tid 39119] [client 45.86.200.77:41031] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "afkx2_olSHl4aAnrIotvEgAAAEw"]
[Tue May 05 07:55:08.016497 2026] [:error] [pid 41055:tid 41061] [client 45.86.200.75:45875] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue May 05 07:55:08.289696 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.75:45875] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/infi.php"] [unique_id "afkx3CepFwKgA_SKOHhPsQAAAQc"]
[Tue May 05 07:55:09.099940 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.82:46613] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue May 05 07:55:09.366712 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.82:46613] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "afkx3TaPrgTaiOD_15vqrAAAANE"]
[Tue May 05 07:55:10.172676 2026] [:error] [pid 39071:tid 39082] [client 45.86.200.79:32991] [client 45.86.200.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/images/index22.php"] [unique_id "afkx3ovmnRMz9gRzix3XlQAAAAI"]
[Tue May 05 07:55:10.990291 2026] [:error] [pid 41055:tid 41078] [client 45.86.200.57:55509] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue May 05 07:55:11.258555 2026] [:error] [pid 41055:tid 41061] [client 45.86.200.57:55509] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "afkx3yepFwKgA_SKOHhQCwAAAQM"]
[Tue May 05 07:55:11.793371 2026] [:error] [pid 39073:tid 39155] [client 45.86.200.81:51069] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "afkx3_0kT1BNjk46Bken7AAAAJU"]
[Tue May 05 07:55:12.325906 2026] [:error] [pid 39072:tid 39107] [client 45.86.200.104:20321] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Tue May 05 07:55:12.604815 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.104:20321] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Tue May 05 07:55:13.697350 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.104:20321] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "afkx4folSHl4aAnrIotv2wAAAFY"]
[Tue May 05 07:55:15.563665 2026] [:error] [pid 39073:tid 39140] [client 45.86.200.54:39199] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "afkx4_0kT1BNjk46BkeoMwAAAIY"]
[Tue May 05 07:55:18.031356 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.78:24181] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/edit.php"] [unique_id "afkx5volSHl4aAnrIotwXQAAAEE"]
[Tue May 05 07:55:18.583249 2026] [:error] [pid 39073:tid 39148] [client 45.86.200.77:34605] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue May 05 07:55:19.126140 2026] [:error] [pid 39073:tid 39144] [client 45.86.200.77:34605] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue May 05 07:55:19.398033 2026] [:error] [pid 39073:tid 39140] [client 45.86.200.77:34605] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "afkx5_0kT1BNjk46BkeojwAAAIY"]
[Tue May 05 07:55:19.940847 2026] [:error] [pid 39073:tid 39139] [client 45.86.200.110:37111] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue May 05 07:55:20.488859 2026] [:error] [pid 39073:tid 39143] [client 45.86.200.110:37111] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/click.php"] [unique_id "afkx6P0kT1BNjk46BkeorQAAAIk"]
[Tue May 05 07:55:21.857834 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.76:30397] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "afkx6XG_NPOxSH0O9aRxUgAAAUk"]
[Tue May 05 07:55:25.846361 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.99:52459] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue May 05 07:55:26.664955 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.99:52459] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue May 05 07:55:27.207508 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.99:52459] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue May 05 07:55:27.479183 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.99:52459] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "afkx73G_NPOxSH0O9aRx-AAAAVA"]
[Tue May 05 07:55:28.018530 2026] [:error] [pid 39072:tid 39130] [client 45.86.200.76:63617] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "afkx8PolSHl4aAnrIotxXgAAAFc"]
[Tue May 05 07:55:28.548813 2026] [:error] [pid 39073:tid 39150] [client 45.86.200.87:62217] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "afkx8P0kT1BNjk46BkepcQAAAJA"]
[Tue May 05 07:55:29.085375 2026] [:error] [pid 39071:tid 39101] [client 45.86.200.85:28655] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "afkx8YvmnRMz9gRzix3ZCAAAABU"]
[Tue May 05 07:55:29.630007 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.103:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Tue May 05 07:55:29.897629 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.103:23583] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "afkx8TaPrgTaiOD_15vsnwAAAMU"]
[Tue May 05 07:55:30.431789 2026] [:error] [pid 39073:tid 39148] [client 45.86.200.90:32849] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "afkx8v0kT1BNjk46BkepkgAAAI4"]
[Tue May 05 07:55:30.971003 2026] [:error] [pid 39071:tid 39091] [client 45.86.200.73:49613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue May 05 07:55:31.525744 2026] [:error] [pid 39071:tid 39089] [client 45.86.200.73:49613] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "afkx84vmnRMz9gRzix3ZLQAAAAk"]
[Tue May 05 07:55:32.061057 2026] [:error] [pid 41055:tid 41068] [client 45.86.200.84:58931] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "afkx9CepFwKgA_SKOHhSdwAAAQo"]
[Tue May 05 07:55:33.712033 2026] [:error] [pid 39071:tid 39103] [client 45.86.200.91:45707] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "afkx9YvmnRMz9gRzix3ZTgAAABc"]
[Tue May 05 07:55:36.786059 2026] [:error] [pid 39178:tid 39192] [client 45.86.200.76:25687] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "afkx-DaPrgTaiOD_15vtKgAAAMw"]
[Tue May 05 07:55:37.602840 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.54:27667] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "afkx-XG_NPOxSH0O9aRy4wAAAVE"]
[Tue May 05 07:55:38.702057 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.59:64159] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "afkx-volSHl4aAnrIotycAAAAEc"]
[Tue May 05 07:55:39.236747 2026] [:error] [pid 41055:tid 41080] [client 45.86.200.52:21303] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Tue May 05 07:55:40.048101 2026] [:error] [pid 41055:tid 41080] [client 45.86.200.52:21303] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Tue May 05 07:55:40.317838 2026] [:error] [pid 41055:tid 41078] [client 45.86.200.52:21303] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "afkx_CepFwKgA_SKOHhTVQAAARQ"]
[Tue May 05 07:55:41.125042 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.97:41711] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue May 05 07:55:41.393085 2026] [:error] [pid 39178:tid 39186] [client 45.86.200.97:41711] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue May 05 07:55:42.745380 2026] [:error] [pid 39178:tid 39195] [client 45.86.200.97:41711] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "afkx_jaPrgTaiOD_15vtsQAAAM8"]
[Tue May 05 07:55:44.100184 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.90:63283] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "afkyAHG_NPOxSH0O9aRziwAAAVg"]
[Tue May 05 07:55:44.641403 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.87:30027] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "afkyAHG_NPOxSH0O9aRzngAAAUk"]
[Tue May 05 07:55:46.275828 2026] [:error] [pid 39072:tid 39117] [client 45.86.200.51:39127] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "afkyAvolSHl4aAnrIotzSQAAAEo"]
[Tue May 05 07:55:47.360810 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.80:34693] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue May 05 07:55:47.639578 2026] [:error] [pid 39072:tid 39118] [client 45.86.200.80:34693] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Tue May 05 07:55:47.915347 2026] [:error] [pid 39072:tid 39127] [client 45.86.200.80:34693] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Tue May 05 07:55:48.196647 2026] [:error] [pid 39072:tid 39125] [client 45.86.200.80:34693] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Tue May 05 07:55:49.579537 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.80:34693] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "afkyBfolSHl4aAnrIotztAAAAFY"]
[Tue May 05 07:55:50.112756 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.85:23135] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "afkyBiepFwKgA_SKOHhT3wAAARM"]
[Tue May 05 07:55:50.655058 2026] [:error] [pid 41055:tid 41063] [client 45.86.200.58:20983] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "afkyBiepFwKgA_SKOHhT5gAAAQU"]
[Tue May 05 07:55:51.186937 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.55:37641] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "afkyB3G_NPOxSH0O9aR0ZQAAAVg"]
[Tue May 05 07:55:51.719451 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.101:58501] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "afkyB3G_NPOxSH0O9aR0cgAAAUE"]
[Tue May 05 07:55:52.271427 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.97:55007] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "afkyCHG_NPOxSH0O9aR0gQAAAUE"]
[Tue May 05 07:55:54.140441 2026] [:error] [pid 39072:tid 39117] [client 45.86.200.99:37885] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "afkyCvolSHl4aAnrIot0cQAAAEo"]
[Tue May 05 07:55:54.694069 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.88:63067] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "afkyCjaPrgTaiOD_15vufwAAANE"]
[Tue May 05 07:55:55.224515 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.88:60737] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "afkyC3G_NPOxSH0O9aR0wQAAAUw"]
[Tue May 05 07:55:55.788434 2026] [:error] [pid 39073:tid 39142] [client 45.86.200.107:58121] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "afkyC_0kT1BNjk46BkerowAAAIg"]
[Tue May 05 07:55:56.919479 2026] [:error] [pid 39072:tid 39125] [client 45.86.200.55:48075] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "afkyDPolSHl4aAnrIot04QAAAFI"]
[Tue May 05 07:55:57.748875 2026] [:error] [pid 41055:tid 41079] [client 45.86.200.92:45431] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "afkyDSepFwKgA_SKOHhUKAAAARU"]
[Tue May 05 07:55:58.294007 2026] [:error] [pid 39178:tid 39195] [client 45.86.200.110:49737] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue May 05 07:55:58.830731 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.110:49737] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "afkyDjaPrgTaiOD_15vupwAAAMM"]
[Tue May 05 07:55:59.921575 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.82:40591] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "afkyDzaPrgTaiOD_15vuuQAAANE"]
[Tue May 05 07:56:01.023320 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.99:63291] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue May 05 07:56:01.290818 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.99:63291] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "afkyEXG_NPOxSH0O9aR1TgAAAU0"]
[Tue May 05 07:56:02.127344 2026] [:error] [pid 39178:tid 39192] [client 45.86.200.52:33533] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue May 05 07:56:02.404428 2026] [:error] [pid 39178:tid 39200] [client 45.86.200.52:33533] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Tue May 05 07:56:02.689520 2026] [:error] [pid 39178:tid 39196] [client 45.86.200.52:33533] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue May 05 07:56:02.968027 2026] [:error] [pid 39178:tid 39193] [client 45.86.200.52:33533] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "afkyEjaPrgTaiOD_15vu1QAAAM0"]
[Tue May 05 07:56:03.503778 2026] [:error] [pid 39072:tid 39113] [client 45.86.200.95:40335] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue May 05 07:56:03.772463 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.95:40335] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "afkyE_olSHl4aAnrIot1ugAAAEI"]
[Tue May 05 07:56:04.870692 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.100:58457] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue May 05 07:56:05.139771 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.100:58457] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue May 05 07:56:05.409098 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.100:58457] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Tue May 05 07:56:06.787820 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.100:58457] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue May 05 07:56:07.054642 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.100:58457] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Tue May 05 07:56:07.592914 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.100:58457] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Tue May 05 07:56:08.402672 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.100:58457] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue May 05 07:56:08.668124 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.100:58457] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "afkyGHG_NPOxSH0O9aR2MAAAAVI"]
[Tue May 05 07:56:09.206486 2026] [:error] [pid 39178:tid 39191] [client 45.86.200.89:36857] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "afkyGTaPrgTaiOD_15vvFgAAAMs"]
[Tue May 05 07:56:09.736598 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.111:40847] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Tue May 05 07:56:10.003327 2026] [:error] [pid 53856:tid 53880] [client 45.86.200.111:40847] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "afkyGnG_NPOxSH0O9aR2WgAAAU8"]
[Tue May 05 07:56:10.829160 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.89:21007] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue May 05 07:56:11.097991 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.89:21007] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "afkyG_olSHl4aAnrIot2ZAAAAEk"]
[Tue May 05 07:56:11.635988 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.57:50899] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "afkyG_olSHl4aAnrIot2dQAAAEE"]
[Tue May 05 07:56:13.283845 2026] [:error] [pid 39072:tid 39130] [client 45.86.200.85:25605] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afkyHfolSHl4aAnrIot2oQAAAFc"]
[Tue May 05 07:56:13.821011 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.53:31923] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "afkyHXG_NPOxSH0O9aR2vgAAAUM"]
[Tue May 05 07:56:15.199217 2026] [:error] [pid 53856:tid 53879] [client 45.86.200.109:20813] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue May 05 07:56:15.741604 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.109:20813] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "afkyH3G_NPOxSH0O9aR3BQAAAUA"]
[Tue May 05 07:56:16.556209 2026] [:error] [pid 41055:tid 41075] [client 45.86.200.99:53933] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Tue May 05 07:56:17.102405 2026] [:error] [pid 41055:tid 41059] [client 45.86.200.99:53933] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/function.php"] [unique_id "afkyISepFwKgA_SKOHhVGwAAAQE"]
[Tue May 05 07:56:17.635470 2026] [:error] [pid 39072:tid 39107] [client 45.86.200.73:54987] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "afkyIfolSHl4aAnrIot2_AAAAEA"]
[Tue May 05 07:56:20.374597 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.57:47111] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Tue May 05 07:56:20.645901 2026] [:error] [pid 53856:tid 53880] [client 45.86.200.57:47111] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "afkyJHG_NPOxSH0O9aR3oQAAAU8"]
[Tue May 05 07:56:21.187943 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.73:58625] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "afkyJfolSHl4aAnrIot3IQAAAEI"]
[Tue May 05 07:56:22.283395 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.103:43347] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Tue May 05 07:56:22.555596 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.103:43347] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Tue May 05 07:56:23.102179 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.103:43347] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Tue May 05 07:56:23.656627 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.103:43347] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "afkyJ_olSHl4aAnrIot3SwAAAEc"]
[Tue May 05 07:56:25.295807 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.91:39545] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "afkyKTaPrgTaiOD_15vv-QAAANE"]
[Tue May 05 07:56:26.696041 2026] [:error] [pid 39178:tid 39180] [client 45.86.200.100:38337] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue May 05 07:56:26.966551 2026] [:error] [pid 39178:tid 39204] [client 45.86.200.100:38337] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/index.php"] [unique_id "afkyKjaPrgTaiOD_15vwJwAAANg"]
[Tue May 05 07:56:27.494916 2026] [:error] [pid 39072:tid 39131] [client 45.86.200.89:63383] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "afkyK_olSHl4aAnrIot3hAAAAFg"]
[Tue May 05 07:56:29.141536 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.52:27173] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "afkyLTaPrgTaiOD_15vwSwAAANY"]
[Tue May 05 07:56:30.827431 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.79:25297] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Tue May 05 07:56:31.099186 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.79:25297] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "afkyL3G_NPOxSH0O9aR4gwAAAUI"]
[Tue May 05 07:56:31.904891 2026] [:error] [pid 41055:tid 41081] [client 45.86.200.89:24155] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "afkyLyepFwKgA_SKOHhV_gAAARc"]
[Tue May 05 07:56:33.609817 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue May 05 07:56:33.878446 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue May 05 07:56:34.418495 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Tue May 05 07:56:35.495901 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.85:38995] [client 45.86.200.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.85, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/wp-login.php"] [unique_id "afkyM3G_NPOxSH0O9aR40wAAAUA"]
[Tue May 05 07:56:36.042776 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Tue May 05 07:56:36.501431 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Tue May 05 07:56:36.779158 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Tue May 05 07:56:37.559187 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.85:38995] [client 45.86.200.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.85, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "afkyNXG_NPOxSH0O9aR48wAAAUM"]
[Tue May 05 07:56:38.384562 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue May 05 07:56:38.657293 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Tue May 05 07:56:39.195923 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Tue May 05 07:56:39.738411 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue May 05 07:56:40.554333 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Tue May 05 07:56:42.469212 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue May 05 07:56:42.748444 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Tue May 05 07:56:44.130253 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.85:38995] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Tue May 05 07:56:44.666809 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.85:38995] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "afkyPHG_NPOxSH0O9aR5dwAAAUo"]
[Tue May 05 07:56:45.794641 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.101:24071] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue May 05 07:56:46.060058 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.101:24071] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "afkyPjaPrgTaiOD_15vxbwAAAMM"]
[Tue May 05 07:56:46.895427 2026] [:error] [pid 53856:tid 53880] [client 185.82.72.4:46333] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Tue May 05 07:56:47.179492 2026] [:error] [pid 53856:tid 53886] [client 185.82.72.4:46333] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "afkyP3G_NPOxSH0O9aR5kAAAAVU"]
[Tue May 05 07:56:48.265869 2026] [:error] [pid 39072:tid 39119] [client 45.86.200.51:61073] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Tue May 05 07:56:48.813980 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.51:61073] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Tue May 05 07:56:49.352256 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.51:61073] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Tue May 05 07:56:49.645632 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.51:61073] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Tue May 05 07:56:50.185376 2026] [:error] [pid 39072:tid 39121] [client 45.86.200.51:61073] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "afkyQvolSHl4aAnrIot5UwAAAE4"]
[Tue May 05 07:56:50.765503 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.73:34417] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Tue May 05 07:56:51.048394 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.73:34417] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Tue May 05 07:56:51.325412 2026] [:error] [pid 39178:tid 39196] [client 45.86.200.73:34417] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "afkyQzaPrgTaiOD_15vxqQAAANA"]
[Tue May 05 07:56:53.163810 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.75:23401] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "afkyRXG_NPOxSH0O9aR58gAAAUc"]
[Tue May 05 07:56:53.971713 2026] [:error] [pid 41055:tid 41074] [client 45.86.200.84:40689] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue May 05 07:56:54.786707 2026] [:error] [pid 41055:tid 41070] [client 45.86.200.84:40689] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Tue May 05 07:56:55.068905 2026] [:error] [pid 41055:tid 41071] [client 45.86.200.84:40689] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Tue May 05 07:56:55.339381 2026] [:error] [pid 41055:tid 41060] [client 45.86.200.84:40689] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "afkyRyepFwKgA_SKOHhXVQAAAQI"]
[Tue May 05 07:56:55.871842 2026] [:error] [pid 39071:tid 39081] [client 45.86.200.78:48203] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "afkyR4vmnRMz9gRzix3bNgAAAAE"]
[Tue May 05 07:56:58.877615 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.56:43251] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Tue May 05 07:56:59.410718 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.56:43251] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "afkyS3G_NPOxSH0O9aR6jgAAAVI"]
[Tue May 05 07:57:00.246290 2026] [:error] [pid 53856:tid 53876] [client 45.86.200.107:52495] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "afkyTHG_NPOxSH0O9aR6qwAAAUs"]
[Tue May 05 07:57:02.098918 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.110:31293] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue May 05 07:57:02.378668 2026] [:error] [pid 39178:tid 39196] [client 45.86.200.110:31293] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Tue May 05 07:57:02.645792 2026] [:error] [pid 39178:tid 39180] [client 45.86.200.110:31293] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "afkyTjaPrgTaiOD_15vyMQAAAMA"]
[Tue May 05 07:57:03.461594 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.59:30145] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Tue May 05 07:57:03.738260 2026] [:error] [pid 41055:tid 41058] [client 45.86.200.59:30145] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Tue May 05 07:57:04.287632 2026] [:error] [pid 41055:tid 41079] [client 45.86.200.59:30145] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Tue May 05 07:57:05.108864 2026] [:error] [pid 41055:tid 41080] [client 45.86.200.59:30145] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "afkyUSepFwKgA_SKOHhXpgAAARY"]
[Tue May 05 07:57:05.675609 2026] [:error] [pid 39072:tid 39122] [client 45.86.200.111:54489] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Tue May 05 07:57:06.520596 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.111:54489] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "afkyUvolSHl4aAnrIot6OAAAAFY"]
[Tue May 05 07:57:07.372938 2026] [:error] [pid 39071:tid 39083] [client 45.86.200.52:58193] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Tue May 05 07:57:08.183893 2026] [:error] [pid 39071:tid 39094] [client 45.86.200.52:58193] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Tue May 05 07:57:08.459076 2026] [:error] [pid 39071:tid 39087] [client 45.86.200.52:58193] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue May 05 07:57:08.999512 2026] [:error] [pid 39071:tid 39091] [client 45.86.200.52:58193] [client 45.86.200.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.52, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "afkyVIvmnRMz9gRzix3bXwAAAAs"]
[Tue May 05 07:57:10.361785 2026] [:error] [pid 39071:tid 39092] [client 45.86.200.52:58193] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "afkyVovmnRMz9gRzix3baQAAAAw"]
[Tue May 05 07:57:10.896357 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.75:58459] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Tue May 05 07:57:11.160841 2026] [:error] [pid 39072:tid 39124] [client 45.86.200.75:58459] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "afkyV_olSHl4aAnrIot6aAAAAFE"]
[Tue May 05 07:57:11.701727 2026] [:error] [pid 39072:tid 39119] [client 45.86.200.58:58293] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Tue May 05 07:57:12.253292 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.58:58293] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Tue May 05 07:57:12.797956 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.58:58293] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "afkyWPolSHl4aAnrIot6gQAAAEE"]
[Tue May 05 07:57:13.616094 2026] [:error] [pid 41055:tid 41072] [client 45.86.200.52:64857] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Tue May 05 07:57:13.888090 2026] [:error] [pid 41055:tid 41064] [client 45.86.200.52:64857] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Tue May 05 07:57:14.154845 2026] [:error] [pid 41055:tid 41079] [client 45.86.200.52:64857] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "afkyWiepFwKgA_SKOHhX5QAAARU"]
[Tue May 05 07:57:14.691845 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.75:32323] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "afkyWjaPrgTaiOD_15vy3wAAANY"]
[Tue May 05 07:57:15.232062 2026] [:error] [pid 39073:tid 39134] [client 45.86.200.92:42059] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Tue May 05 07:57:15.499781 2026] [:error] [pid 39073:tid 39155] [client 45.86.200.92:42059] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Tue May 05 07:57:16.041440 2026] [:error] [pid 39073:tid 39141] [client 45.86.200.92:42059] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "afkyXP0kT1BNjk46BkevDAAAAIc"]
[Tue May 05 07:57:16.604745 2026] [:error] [pid 39072:tid 39123] [client 45.86.200.60:38273] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Tue May 05 07:57:17.173311 2026] [:error] [pid 39072:tid 39125] [client 45.86.200.60:38273] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Tue May 05 07:57:17.451930 2026] [:error] [pid 39072:tid 39122] [client 45.86.200.60:38273] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "afkyXfolSHl4aAnrIot60wAAAE8"]
[Tue May 05 07:57:18.261712 2026] [:error] [pid 39073:tid 39154] [client 45.86.200.57:27011] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/db.php"] [unique_id "afkyXv0kT1BNjk46BkevEAAAAJQ"]
[Tue May 05 07:57:18.826541 2026] [:error] [pid 39178:tid 39188] [client 45.86.200.98:24481] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "afkyXjaPrgTaiOD_15vzFwAAAMg"]
[Tue May 05 07:57:19.358220 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.89:64083] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "afkyX3G_NPOxSH0O9aR8fAAAAVE"]
[Tue May 05 07:57:19.898374 2026] [:error] [pid 39072:tid 39116] [client 45.86.200.82:29731] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "afkyX_olSHl4aAnrIot6-gAAAEk"]
[Tue May 05 07:57:20.439369 2026] [:error] [pid 39072:tid 39119] [client 45.86.200.95:30985] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "afkyYPolSHl4aAnrIot7AwAAAEw"]
[Tue May 05 07:57:20.972418 2026] [:error] [pid 39072:tid 39110] [client 45.86.200.56:41065] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "afkyYPolSHl4aAnrIot7DwAAAEM"]
[Tue May 05 07:57:22.043615 2026] [:error] [pid 39072:tid 39112] [client 45.86.200.100:32103] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "afkyYvolSHl4aAnrIot7JAAAAEU"]
[Tue May 05 07:57:22.596613 2026] [:error] [pid 39073:tid 39155] [client 45.86.200.101:60663] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "afkyYv0kT1BNjk46BkevGQAAAJU"]
[Tue May 05 07:57:23.159926 2026] [:error] [pid 39073:tid 39142] [client 45.86.200.53:46883] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "afkyY_0kT1BNjk46BkevGgAAAIg"]
[Tue May 05 07:57:23.691933 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.99:37455] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "afkyYzaPrgTaiOD_15vzVQAAANc"]
[Tue May 05 07:57:24.249499 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.97:27331] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "afkyZHG_NPOxSH0O9aR8wwAAAVA"]
[Tue May 05 07:57:24.807793 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.51:42869] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Tue May 05 07:57:25.625425 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.51:42869] [client 45.86.200.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.51, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "afkyZXG_NPOxSH0O9aR82gAAAVQ"]
[Tue May 05 07:57:27.027067 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.51:42869] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "afkyZ3G_NPOxSH0O9aR8-AAAAVM"]
[Tue May 05 07:57:35.257185 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.51:30707] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Tue May 05 07:57:35.538674 2026] [:error] [pid 53856:tid 53870] [client 45.86.200.51:30707] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Tue May 05 07:57:36.698944 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.51:30707] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Tue May 05 07:57:36.992038 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.51:30707] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Tue May 05 07:57:38.161519 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.51:30707] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Tue May 05 07:57:38.449461 2026] [:error] [pid 53856:tid 53880] [client 45.86.200.51:30707] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Tue May 05 07:57:38.772499 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.51:30707] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Tue May 05 07:57:39.109949 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.51:30707] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Tue May 05 07:57:39.417106 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.51:30707] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "afkyc3G_NPOxSH0O9aR93AAAAVE"]
[Tue May 05 07:57:39.977653 2026] [:error] [pid 39178:tid 39191] [client 45.86.200.56:26949] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "afkyczaPrgTaiOD_15v0BgAAAMs"]
[Tue May 05 07:57:40.538158 2026] [:error] [pid 39073:tid 39137] [client 45.86.200.87:56341] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "afkydP0kT1BNjk46BkevQAAAAIM"]
[Tue May 05 07:57:41.380646 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.51:65451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Tue May 05 07:57:41.666279 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.51:65451] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Tue May 05 07:57:42.239869 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.51:65451] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Tue May 05 07:57:42.835889 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.51:65451] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "afkydnG_NPOxSH0O9aR-JwAAAUM"]
[Tue May 05 07:57:43.427053 2026] [:error] [pid 39072:tid 39126] [client 45.86.200.94:49749] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "afkyd_olSHl4aAnrIot8ZQAAAFM"]
[Tue May 05 07:57:44.040748 2026] [:error] [pid 41055:tid 41068] [client 45.86.200.87:20785] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "afkyeCepFwKgA_SKOHhZIwAAAQo"]
[Tue May 05 07:57:45.714102 2026] [:error] [pid 53856:tid 53870] [client 185.82.72.4:50045] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "afkyeXG_NPOxSH0O9aR-YQAAAUU"]
[Tue May 05 07:57:46.593195 2026] [:error] [pid 39073:tid 39151] [client 45.86.200.112:41659] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "afkyev0kT1BNjk46BkevYwAAAJE"]
[Tue May 05 07:57:47.696385 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.73:29195] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "afkye3G_NPOxSH0O9aR-iQAAAVQ"]
[Tue May 05 07:57:52.902522 2026] [:error] [pid 39072:tid 39119] [client 45.86.200.58:22851] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "afkygPolSHl4aAnrIot8qAAAAEw"]
[Tue May 05 07:57:53.480015 2026] [:error] [pid 39178:tid 39192] [client 45.86.200.77:57501] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Tue May 05 07:57:53.760418 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.77:57501] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/about.php"] [unique_id "afkygTaPrgTaiOD_15v0qQAAANI"]
[Tue May 05 07:58:31.923243 2026] [autoindex:error] [pid 39178:tid 39195] [client 45.86.200.112:37323] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 15:46:24.922154 2026] [:error] [pid 25743:tid 25753] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Tue May 05 15:46:25.093907 2026] [:error] [pid 25743:tid 25755] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Tue May 05 15:46:25.242540 2026] [:error] [pid 25743:tid 25754] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue May 05 15:46:25.389165 2026] [:error] [pid 25743:tid 25751] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Tue May 05 15:46:25.536953 2026] [:error] [pid 25743:tid 25764] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Tue May 05 15:46:25.684092 2026] [:error] [pid 25743:tid 25763] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue May 05 15:46:25.830918 2026] [:error] [pid 25743:tid 25771] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Tue May 05 15:46:25.978025 2026] [:error] [pid 25743:tid 25769] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue May 05 15:46:26.125556 2026] [:error] [pid 25743:tid 25768] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue May 05 15:46:26.272727 2026] [:error] [pid 25743:tid 25762] [client 4.224.121.20:1439] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue May 05 15:46:26.593186 2026] [:error] [pid 25743:tid 25765] [client 4.224.121.20:1439] [client 4.224.121.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afmgUm-PCMRhF5DdUnOimQAAABI"]
[Tue May 05 15:46:27.216986 2026] [:error] [pid 54732:tid 54754] [client 4.224.121.20:1410] [client 4.224.121.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afmgU7GgYlDOb3nfuJTOlgAAAFQ"]
[Tue May 05 15:46:27.779584 2026] [:error] [pid 25835:tid 25847] [client 4.224.121.20:1425] [client 4.224.121.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afmgU1DT5nGJyh1439ynrQAAAQo"]
[Tue May 05 15:46:28.464272 2026] [:error] [pid 25835:tid 25853] [client 4.224.121.20:1472] [client 4.224.121.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "afmgVFDT5nGJyh1439ynrgAAARA"]
[Wed May 06 06:17:46.770982 2026] [:error] [pid 33660:tid 33666] [client 212.24.109.223:53572] [client 212.24.109.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.24.109.223, incrementing brute counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "afpsiv6jj6Ce_ERq7qN2pQAAAQQ"]
[Wed May 06 06:17:46.774936 2026] [:error] [pid 33660:tid 33666] [client 212.24.109.223:53572] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed May 06 06:17:47.347773 2026] [:error] [pid 33660:tid 33671] [client 212.24.109.223:53560] [client 212.24.109.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.24.109.223, incrementing ddos counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "afpsi_6jj6Ce_ERq7qN2qAAAAQk"]
[Wed May 06 06:17:47.350480 2026] [:error] [pid 33660:tid 33671] [client 212.24.109.223:53560] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed May 06 10:52:05.144049 2026] [:error] [pid 9664:tid 9770] [client 165.227.158.221:56618] [client 165.227.158.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.158.221, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "afqs1QH4OZbrg1SjsBP2zAAAAIg"]
[Wed May 06 10:52:05.147539 2026] [:error] [pid 9664:tid 9770] [client 165.227.158.221:56618] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu May 07 04:33:47.708441 2026] [:error] [pid 29710:tid 29717] [client 52.138.0.210:29191] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu May 07 04:33:47.917668 2026] [:error] [pid 29710:tid 29714] [client 52.138.0.210:29191] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu May 07 04:33:48.337492 2026] [:error] [pid 29710:tid 29720] [client 52.138.0.210:29191] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Thu May 07 04:33:48.546631 2026] [:error] [pid 29710:tid 29723] [client 52.138.0.210:29191] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu May 07 04:33:48.980537 2026] [:error] [pid 29710:tid 29729] [client 52.138.0.210:29191] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Thu May 07 04:33:49.191313 2026] [:error] [pid 29710:tid 29715] [client 52.138.0.210:29191] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu May 07 04:33:49.399430 2026] [:error] [pid 29710:tid 29719] [client 52.138.0.210:29191] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Thu May 07 04:33:49.815902 2026] [:error] [pid 29710:tid 29730] [client 52.138.0.210:29191] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "afulrf0atTQld9Y2ht-_nwAAANI"]
[Thu May 07 04:33:50.646328 2026] [:error] [pid 29606:tid 29652] [client 52.138.0.210:11089] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "afulrhR5HjZ1PlSAiKtQsQAAAEs"]
[Thu May 07 04:33:51.509296 2026] [:error] [pid 29606:tid 29658] [client 52.138.0.210:26201] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "afulrxR5HjZ1PlSAiKtQswAAAFE"]
[Thu May 07 04:33:52.352358 2026] [:error] [pid 29606:tid 29663] [client 52.138.0.210:12516] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "afulsBR5HjZ1PlSAiKtQuQAAAFY"]
[Thu May 07 15:16:38.727140 2026] [:error] [pid 15715:tid 15726] [client 206.189.36.189:55283] [client 206.189.36.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 206.189.36.189, incrementing ddos counter"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "afw8ViY4dZsLOttMkcdb2gAAAQk"]
[Thu May 07 15:16:38.731213 2026] [:error] [pid 15715:tid 15726] [client 206.189.36.189:55283] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu May 07 15:16:39.787546 2026] [:error] [pid 15715:tid 15721] [client 206.189.36.189:55283] [client 206.189.36.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blog/robots.txt"] [unique_id "afw8VyY4dZsLOttMkcdb3gAAAQQ"]
[Thu May 07 15:16:40.304742 2026] [:error] [pid 28098:tid 28112] [client 206.189.36.189:64797] [client 206.189.36.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/blog/"] [unique_id "afw8WMvhwfljlt8trSqFYwAAAEw"]
[Thu May 07 15:16:40.906362 2026] [:error] [pid 28098:tid 28117] [client 206.189.36.189:63170] [client 206.189.36.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wordpress/"] [unique_id "afw8WMvhwfljlt8trSqFZgAAAFE"]
[Thu May 07 15:16:41.502030 2026] [:error] [pid 15715:tid 15739] [client 206.189.36.189:64769] [client 206.189.36.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp/"] [unique_id "afw8WSY4dZsLOttMkcdb6AAAARM"]
[Thu May 07 18:10:23.260452 2026] [:error] [pid 28098:tid 28117] [client 34.150.161.155:63077] [client 34.150.161.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.150.161.155, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "afxlD8vhwfljlt8trSrGuAAAAFE"]
[Thu May 07 18:10:23.263984 2026] [:error] [pid 28098:tid 28117] [client 34.150.161.155:63077] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu May 07 18:10:23.526077 2026] [:error] [pid 28098:tid 28114] [client 34.150.161.155:63077] [client 34.150.161.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "afxlD8vhwfljlt8trSrGvwAAAE4"]
[Thu May 07 18:10:24.509922 2026] [:error] [pid 15715:tid 15718] [client 34.150.161.155:63788] [client 34.150.161.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "afxlECY4dZsLOttMkceGdAAAAQE"]
[Thu May 07 18:10:25.385728 2026] [:error] [pid 15715:tid 15743] [client 34.150.161.155:58457] [client 34.150.161.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "afxlESY4dZsLOttMkceGeQAAARc"]
[Thu May 07 18:10:26.549763 2026] [:error] [pid 15630:tid 15678] [client 34.150.161.155:58491] [client 34.150.161.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "afxlEnTithRAi4821qulaQAAAJI"]
[Thu May 07 18:10:27.611369 2026] [:error] [pid 28098:tid 28122] [client 34.150.161.155:58508] [client 34.150.161.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "afxlE8vhwfljlt8trSrGwgAAAFY"]
[Thu May 07 18:10:28.330319 2026] [:error] [pid 15630:tid 15675] [client 34.150.161.155:56143] [client 34.150.161.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "afxlFHTithRAi4821qulbwAAAI8"]
[Thu May 07 18:10:28.845311 2026] [:error] [pid 15631:tid 15689] [client 34.150.161.155:50771] [client 34.150.161.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "afxlFHvP1GkPUuuLfqUqPgAAAMI"]
[Thu May 07 20:38:11.142872 2026] [:error] [pid 28098:tid 28123] [client 34.41.82.126:57764] [client 34.41.82.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.41.82.126, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "afyHs8vhwfljlt8trSr08QAAAFc"]
[Thu May 07 20:38:11.148606 2026] [:error] [pid 28098:tid 28123] [client 34.41.82.126:57764] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu May 07 20:38:11.375211 2026] [:error] [pid 28098:tid 28119] [client 34.41.82.126:57764] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "afyHs8vhwfljlt8trSr09gAAAFM"]
[Thu May 07 20:38:11.882189 2026] [:error] [pid 15631:tid 15689] [client 34.41.82.126:56660] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "afyHs3vP1GkPUuuLfqVAmgAAAMI"]
[Thu May 07 20:38:12.383980 2026] [:error] [pid 15630:tid 15680] [client 34.41.82.126:61178] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "afyHtHTithRAi4821qu26AAAAJQ"]
[Thu May 07 20:38:12.841413 2026] [:error] [pid 15631:tid 15692] [client 34.41.82.126:56714] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "afyHtHvP1GkPUuuLfqVAnAAAAMU"]
[Thu May 07 20:38:13.300811 2026] [:error] [pid 15629:tid 15642] [client 34.41.82.126:62794] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "afyHtfrIJCALdUrO43l7qgAAAAk"]
[Thu May 07 20:38:13.722220 2026] [:error] [pid 15630:tid 15677] [client 34.41.82.126:65392] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "afyHtXTithRAi4821qu28wAAAJE"]
[Thu May 07 20:38:14.194838 2026] [:error] [pid 15631:tid 15696] [client 34.41.82.126:54607] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "afyHtnvP1GkPUuuLfqVAoQAAAMk"]
[Thu May 07 20:38:14.613091 2026] [:error] [pid 15715:tid 15723] [client 34.41.82.126:64510] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "afyHtiY4dZsLOttMkcekswAAAQY"]
[Thu May 07 20:38:15.009371 2026] [:error] [pid 15631:tid 15700] [client 34.41.82.126:63198] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "afyHt3vP1GkPUuuLfqVAqAAAAM0"]
[Thu May 07 20:38:15.437594 2026] [:error] [pid 15715:tid 15718] [client 34.41.82.126:61335] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "afyHtyY4dZsLOttMkcektgAAAQE"]
[Thu May 07 20:38:15.905195 2026] [:error] [pid 15715:tid 15744] [client 34.41.82.126:54323] [client 34.41.82.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "afyHtyY4dZsLOttMkcektwAAARg"]
[Fri May 08 00:15:47.806210 2026] [:error] [pid 28098:tid 28124] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Fri May 08 00:15:47.900869 2026] [:error] [pid 28098:tid 28101] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri May 08 00:15:47.992340 2026] [:error] [pid 28098:tid 28118] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri May 08 00:15:48.084817 2026] [:error] [pid 28098:tid 28112] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri May 08 00:15:48.176753 2026] [:error] [pid 28098:tid 28104] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Fri May 08 00:15:48.268658 2026] [:error] [pid 28098:tid 28109] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri May 08 00:15:48.360146 2026] [:error] [pid 28098:tid 28110] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Fri May 08 00:15:48.452387 2026] [:error] [pid 28098:tid 28119] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri May 08 00:15:48.565523 2026] [:error] [pid 28098:tid 28120] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri May 08 00:15:48.748832 2026] [:error] [pid 28098:tid 28116] [client 4.193.137.131:8168] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri May 08 00:15:48.837320 2026] [:error] [pid 28098:tid 28107] [client 4.193.137.131:8168] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "afy6tMvhwfljlt8trSo6-wAAAEc"]
[Fri May 08 00:15:49.208052 2026] [:error] [pid 15629:tid 15634] [client 4.193.137.131:8129] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "afy6tfrIJCALdUrO43magwAAAAE"]
[Fri May 08 00:15:49.592995 2026] [:error] [pid 15715:tid 15726] [client 4.193.137.131:8154] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "afy6tSY4dZsLOttMkcfmPwAAAQk"]
[Fri May 08 00:15:49.958388 2026] [:error] [pid 15715:tid 15732] [client 4.193.137.131:8163] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "afy6tSY4dZsLOttMkcfmQAAAAQw"]
[Fri May 08 06:07:29.358682 2026] [:error] [pid 51113:tid 51129] [client 34.32.204.223:57974] [client 34.32.204.223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "af0NIUQfs7sWtqkpQIch0QAAAM4"]
[Fri May 08 10:04:35.619472 2026] [:error] [pid 51008:tid 51067] [client 34.129.140.54:52518] [client 34.129.140.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "af1Es3B58C2Y1tgLtuJJVwAAAFI"]
[Fri May 08 10:11:36.665840 2026] [:error] [pid 61356:tid 61404] [client 172.70.240.168:11248] [client 172.70.240.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "af1GWIx3vpB8oWhUq2PNUQAAAdA"], referer: https://www.google.com/search?q=www.windfc.windfarmcoolants.com.au
[Fri May 08 12:19:20.001852 2026] [:error] [pid 51008:tid 51072] [client 4.193.137.131:4629] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xleet.php"] [unique_id "af1kSHB58C2Y1tgLtuJbowAAAFc"]
[Fri May 08 12:19:20.361922 2026] [:error] [pid 51008:tid 51064] [client 4.193.137.131:4633] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xleet.php"] [unique_id "af1kSHB58C2Y1tgLtuJbpQAAAE8"]
[Fri May 08 12:19:20.717145 2026] [:error] [pid 51009:tid 51099] [client 4.193.137.131:4611] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xleet.php"] [unique_id "af1kSOB0GbUWhxgzX9XRQgAAAJc"]
[Fri May 08 12:19:21.129300 2026] [:error] [pid 61317:tid 61323] [client 4.193.137.131:4628] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xleet.php"] [unique_id "af1kSc-fFk_CedOCOYt2zQAAAUM"]
[Fri May 08 21:16:10.708296 2026] [:error] [pid 51009:tid 51076] [client 34.10.76.198:51860] [client 34.10.76.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.76.198, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "af3iGuB0GbUWhxgzX9VK9gAAAIA"]
[Fri May 08 21:16:10.710876 2026] [:error] [pid 51009:tid 51076] [client 34.10.76.198:51860] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri May 08 21:16:10.904943 2026] [:error] [pid 51009:tid 51100] [client 34.10.76.198:51860] [client 34.10.76.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "af3iGuB0GbUWhxgzX9VK-QAAAJg"]
[Fri May 08 21:16:11.315220 2026] [:error] [pid 61355:tid 61367] [client 34.10.76.198:64454] [client 34.10.76.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "af3iG_khJTi30CBXmMm_kQAAAYY"]
[Fri May 08 21:16:11.717696 2026] [:error] [pid 51007:tid 51032] [client 34.10.76.198:63592] [client 34.10.76.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "af3iG1MagSGstWKyzzX0AgAAAAo"]
[Fri May 08 21:16:12.113901 2026] [:error] [pid 51009:tid 51085] [client 34.10.76.198:58953] [client 34.10.76.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "af3iHOB0GbUWhxgzX9VK_gAAAIk"]
[Fri May 08 21:16:12.518666 2026] [:error] [pid 51008:tid 51058] [client 34.10.76.198:58619] [client 34.10.76.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "af3iHHB58C2Y1tgLtuKqdgAAAEk"]
[Fri May 08 21:16:12.974931 2026] [:error] [pid 51009:tid 51084] [client 34.10.76.198:50055] [client 34.10.76.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "af3iHOB0GbUWhxgzX9VLAwAAAIg"]
[Fri May 08 21:16:13.369889 2026] [:error] [pid 61356:tid 61400] [client 34.10.76.198:51896] [client 34.10.76.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "af3iHYx3vpB8oWhUq2PAzwAAAcw"]
[Sat May 09 01:24:07.534064 2026] [:error] [pid 61317:tid 61320] [client 18.140.197.47:60932] [client 18.140.197.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "af4cN8-fFk_CedOCOYsJNwAAAUA"]
[Sat May 09 01:24:08.197364 2026] [:error] [pid 61355:tid 61368] [client 18.140.197.47:37784] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "af4cOPkhJTi30CBXmMkpGgAAAYc"]
[Sat May 09 01:24:09.163104 2026] [:error] [pid 61356:tid 61395] [client 18.140.197.47:37816] [client 18.140.197.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4cOYx3vpB8oWhUq2Mi9QAAAcc"]
[Sat May 09 01:24:09.733129 2026] [:error] [pid 34318:tid 34320] [client 18.140.197.47:37866] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php"] [unique_id "af4cOcr3guirgJiKhzACAwAAAQA"]
[Sat May 09 01:24:10.369037 2026] [:error] [pid 51113:tid 51121] [client 18.140.197.47:37900] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "af4cOkQfs7sWtqkpQIeZ3gAAAMY"]
[Sat May 09 01:24:12.331323 2026] [:error] [pid 61355:tid 61381] [client 18.140.197.47:37938] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/php.php"] [unique_id "af4cPPkhJTi30CBXmMkpQwAAAZQ"]
[Sat May 09 01:24:14.418296 2026] [:error] [pid 61355:tid 61379] [client 18.140.197.47:37996] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/i.php"] [unique_id "af4cPvkhJTi30CBXmMkpTgAAAZI"]
[Sat May 09 01:24:15.243448 2026] [:error] [pid 61355:tid 61372] [client 18.140.197.47:38044] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pi.php"] [unique_id "af4cP_khJTi30CBXmMkpVgAAAYs"]
[Sat May 09 01:24:15.971686 2026] [:error] [pid 51009:tid 51081] [client 18.140.197.47:38092] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pinfo.php"] [unique_id "af4cP-B0GbUWhxgzX9WOAQAAAIU"]
[Sat May 09 01:24:16.959067 2026] [:error] [pid 61355:tid 61384] [client 18.140.197.47:38158] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test.php"] [unique_id "af4cQPkhJTi30CBXmMkpYgAAAZc"]
[Sat May 09 01:24:17.623141 2026] [:error] [pid 61356:tid 61403] [client 18.140.197.47:53210] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpinfo"] [unique_id "af4cQYx3vpB8oWhUq2MjKwAAAc8"]
[Sat May 09 01:24:18.519840 2026] [:error] [pid 61355:tid 61367] [client 18.140.197.47:53268] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "af4cQvkhJTi30CBXmMkpbgAAAYY"]
[Sat May 09 01:24:19.272340 2026] [:error] [pid 51009:tid 51077] [client 18.140.197.47:53328] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/debug.php"] [unique_id "af4cQ-B0GbUWhxgzX9WOEAAAAIE"]
[Sat May 09 01:24:20.719446 2026] [:error] [pid 61355:tid 61382] [client 18.140.197.47:53360] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/phpinfo.php"] [unique_id "af4cRPkhJTi30CBXmMkpdAAAAZU"]
[Sat May 09 01:24:22.008701 2026] [:error] [pid 51008:tid 51065] [client 18.140.197.47:53392] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test/phpinfo.php"] [unique_id "af4cRnB58C2Y1tgLtuLYjwAAAFA"]
[Sat May 09 01:24:22.835102 2026] [:error] [pid 61355:tid 61381] [client 18.140.197.47:53444] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dev/phpinfo.php"] [unique_id "af4cRvkhJTi30CBXmMkpewAAAZQ"]
[Sat May 09 01:24:23.594127 2026] [:error] [pid 61356:tid 61404] [client 18.140.197.47:53498] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/old/phpinfo.php"] [unique_id "af4cR4x3vpB8oWhUq2MjPgAAAdA"]
[Sat May 09 01:24:24.280752 2026] [:error] [pid 51009:tid 51089] [client 18.140.197.47:53576] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tmp/phpinfo.php"] [unique_id "af4cSOB0GbUWhxgzX9WOIgAAAI0"]
[Sat May 09 01:24:24.992903 2026] [:error] [pid 61355:tid 61376] [client 18.140.197.47:53622] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/phpinfo.php"] [unique_id "af4cSPkhJTi30CBXmMkpgwAAAY8"]
[Sat May 09 01:24:26.044828 2026] [:error] [pid 61356:tid 61390] [client 18.140.197.47:53662] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/info"] [unique_id "af4cSox3vpB8oWhUq2MjRAAAAcI"]
[Sat May 09 01:24:26.755084 2026] [:error] [pid 61356:tid 61400] [client 18.140.197.47:53714] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/php-info.php"] [unique_id "af4cSox3vpB8oWhUq2MjSAAAAcw"]
[Sat May 09 01:24:27.356397 2026] [:error] [pid 61355:tid 61379] [client 18.140.197.47:53764] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpversion.php"] [unique_id "af4cS_khJTi30CBXmMkpmQAAAZI"]
[Sat May 09 01:24:28.016811 2026] [:error] [pid 61356:tid 61404] [client 18.140.197.47:35280] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/_phpinfo.php"] [unique_id "af4cTIx3vpB8oWhUq2MjUgAAAdA"]
[Sat May 09 01:24:28.699053 2026] [:error] [pid 61356:tid 61407] [client 18.140.197.47:35324] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/old_phpinfo.php"] [unique_id "af4cTIx3vpB8oWhUq2MjXQAAAdM"]
[Sat May 09 01:24:29.482227 2026] [:error] [pid 51113:tid 51137] [client 18.140.197.47:35398] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/server-info.php"] [unique_id "af4cTUQfs7sWtqkpQIeZ9AAAANY"]
[Sat May 09 01:24:30.169118 2026] [:error] [pid 51009:tid 51080] [client 18.140.197.47:35448] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/server-status.php"] [unique_id "af4cTuB0GbUWhxgzX9WOLAAAAIQ"]
[Sat May 09 01:24:30.746832 2026] [:error] [pid 34318:tid 34328] [client 18.140.197.47:35486] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/_profiler/phpinfo"] [unique_id "af4cTsr3guirgJiKhzACDAAAAQg"]
[Sat May 09 01:24:31.334263 2026] [:error] [pid 51008:tid 51059] [client 18.140.197.47:35536] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/_environment"] [unique_id "af4cT3B58C2Y1tgLtuLYoAAAAEo"]
[Sat May 09 01:24:32.121913 2026] [:error] [pid 51008:tid 51064] [client 18.140.197.47:35602] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/webroot/index.php/_environment"] [unique_id "af4cUHB58C2Y1tgLtuLYpwAAAE8"]
[Sat May 09 01:24:32.972374 2026] [:error] [pid 51007:tid 51026] [client 18.140.197.47:35658] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mail/phpinfo.php"] [unique_id "af4cUFMagSGstWKyzzUY0wAAAAQ"]
[Sat May 09 01:24:33.817876 2026] [:error] [pid 51008:tid 51059] [client 18.140.197.47:35722] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cpanel/phpinfo.php"] [unique_id "af4cUXB58C2Y1tgLtuLYswAAAEo"]
[Sat May 09 01:24:34.567881 2026] [:error] [pid 61355:tid 61371] [client 18.140.197.47:35790] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hosting/phpinfo.php"] [unique_id "af4cUvkhJTi30CBXmMkprwAAAYo"]
[Sat May 09 01:24:35.335444 2026] [:error] [pid 34318:tid 34326] [client 18.140.197.47:35854] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/webmail/phpinfo.php"] [unique_id "af4cU8r3guirgJiKhzACHQAAAQY"]
[Sat May 09 01:24:36.692650 2026] [:error] [pid 61356:tid 61402] [client 18.140.197.47:35900] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/smtp/phpinfo.php"] [unique_id "af4cVIx3vpB8oWhUq2MjfgAAAc4"]
[Sat May 09 01:24:37.401760 2026] [:error] [pid 61355:tid 61365] [client 18.140.197.47:35972] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php.bak"] [unique_id "af4cVfkhJTi30CBXmMkpugAAAYQ"]
[Sat May 09 01:24:38.088610 2026] [:error] [pid 61317:tid 61328] [client 18.140.197.47:35186] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php.old"] [unique_id "af4cVs-fFk_CedOCOYsJZQAAAUg"]
[Sat May 09 01:24:38.773079 2026] [:error] [pid 61356:tid 61398] [client 18.140.197.47:35250] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php~"] [unique_id "af4cVox3vpB8oWhUq2MjhwAAAco"]
[Sat May 09 01:24:39.514136 2026] [:error] [pid 34318:tid 34334] [client 18.140.197.47:35304] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/info.php.bak"] [unique_id "af4cV8r3guirgJiKhzACLAAAAQ4"]
[Sat May 09 01:24:40.303938 2026] [:error] [pid 34318:tid 34327] [client 18.140.197.47:35368] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php.save"] [unique_id "af4cWMr3guirgJiKhzACNgAAAQc"]
[Sat May 09 01:24:43.983585 2026] [:error] [pid 61317:tid 61339] [client 18.140.197.47:35412] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/staging/phpinfo.php"] [unique_id "af4cW8-fFk_CedOCOYsJbQAAAVM"]
[Sat May 09 01:24:44.750978 2026] [:error] [pid 51113:tid 51138] [client 18.140.197.47:35448] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/beta/phpinfo.php"] [unique_id "af4cXEQfs7sWtqkpQIeaDwAAANc"]
[Sat May 09 01:24:45.513490 2026] [:error] [pid 51009:tid 51077] [client 18.140.197.47:35484] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/uat/phpinfo.php"] [unique_id "af4cXeB0GbUWhxgzX9WOUgAAAIE"]
[Sat May 09 01:24:46.336520 2026] [:error] [pid 51007:tid 51032] [client 18.140.197.47:35522] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/qa/phpinfo.php"] [unique_id "af4cXlMagSGstWKyzzUY7gAAAAo"]
[Sat May 09 01:24:47.194165 2026] [:error] [pid 51008:tid 51058] [client 18.140.197.47:35568] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/preview/phpinfo.php"] [unique_id "af4cX3B58C2Y1tgLtuLYyQAAAEk"]
[Sat May 09 01:24:48.040376 2026] [:error] [pid 51113:tid 51134] [client 18.140.197.47:46980] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/www/phpinfo.php"] [unique_id "af4cYEQfs7sWtqkpQIeaEQAAANM"]
[Sat May 09 01:24:48.840040 2026] [:error] [pid 51008:tid 51067] [client 18.140.197.47:47014] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/htdocs/phpinfo.php"] [unique_id "af4cYHB58C2Y1tgLtuLY1gAAAFI"]
[Sat May 09 01:24:49.470166 2026] [:error] [pid 61355:tid 61377] [client 18.140.197.47:47032] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public_html/phpinfo.php"] [unique_id "af4cYfkhJTi30CBXmMkpxgAAAZA"]
[Sat May 09 01:24:50.683313 2026] [:error] [pid 61355:tid 61376] [client 18.140.197.47:47036] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/site/phpinfo.php"] [unique_id "af4cYvkhJTi30CBXmMkpzAAAAY8"]
[Sat May 09 01:24:51.287485 2026] [:error] [pid 61317:tid 61323] [client 18.140.197.47:47050] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/docs/phpinfo.php"] [unique_id "af4cY8-fFk_CedOCOYsJdgAAAUM"]
[Sat May 09 01:24:52.232903 2026] [:error] [pid 61355:tid 61378] [client 18.140.197.47:47056] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4cZPkhJTi30CBXmMkp0gAAAZE"]
[Sat May 09 01:24:53.035872 2026] [:error] [pid 61317:tid 61324] [client 18.140.197.47:47084] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/administrator/phpinfo.php"] [unique_id "af4cZc-fFk_CedOCOYsJeAAAAUQ"]
[Sat May 09 01:24:53.810422 2026] [:error] [pid 61356:tid 61405] [client 18.140.197.47:47088] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/phpinfo.php"] [unique_id "af4cZYx3vpB8oWhUq2MjmwAAAdE"]
[Sat May 09 01:24:54.672534 2026] [:error] [pid 51009:tid 51099] [client 18.140.197.47:47098] [client 18.140.197.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/includes/phpinfo.php"] [unique_id "af4cZuB0GbUWhxgzX9WOWAAAAJc"]
[Sat May 09 02:26:09.863063 2026] [:error] [pid 51008:tid 51056] [client 3.15.179.172:41910] [client 3.15.179.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "af4qwXB58C2Y1tgLtuLogQAAAEc"]
[Sat May 09 02:26:11.029071 2026] [:error] [pid 51009:tid 51095] [client 3.15.179.172:41960] [client 3.15.179.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4qw-B0GbUWhxgzX9WmnQAAAJM"]
[Sat May 09 02:26:11.996216 2026] [:error] [pid 51008:tid 51072] [client 3.15.179.172:42014] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sat May 09 02:26:12.237569 2026] [:error] [pid 51008:tid 51062] [client 3.15.179.172:42014] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat May 09 02:26:12.450626 2026] [:error] [pid 51008:tid 51073] [client 3.15.179.172:42014] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php.php"] [unique_id "af4qxHB58C2Y1tgLtuLojAAAAFg"]
[Sat May 09 02:26:13.431166 2026] [:error] [pid 51113:tid 51131] [client 3.15.179.172:42036] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/i.php"] [unique_id "af4qxUQfs7sWtqkpQIeh4wAAANA"]
[Sat May 09 02:26:14.374191 2026] [:error] [pid 61356:tid 61402] [client 3.15.179.172:42066] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pi.php"] [unique_id "af4qxox3vpB8oWhUq2NEJAAAAc4"]
[Sat May 09 02:26:15.251023 2026] [:error] [pid 61355:tid 61380] [client 3.15.179.172:42126] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pinfo.php"] [unique_id "af4qx_khJTi30CBXmMlZwwAAAZM"]
[Sat May 09 02:26:16.184180 2026] [:error] [pid 51113:tid 51139] [client 3.15.179.172:42206] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test.php"] [unique_id "af4qyEQfs7sWtqkpQIeh5gAAANg"]
[Sat May 09 02:26:17.199517 2026] [:error] [pid 34318:tid 34332] [client 3.15.179.172:34304] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo"] [unique_id "af4qycr3guirgJiKhzAMygAAAQw"]
[Sat May 09 02:26:18.192031 2026] [:error] [pid 61355:tid 61370] [client 3.15.179.172:34346] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/p.php"] [unique_id "af4qyvkhJTi30CBXmMlZyAAAAYk"]
[Sat May 09 02:26:19.132416 2026] [:error] [pid 34318:tid 34330] [client 3.15.179.172:34382] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/debug.php"] [unique_id "af4qy8r3guirgJiKhzAMzwAAAQo"]
[Sat May 09 02:26:20.127591 2026] [:error] [pid 51113:tid 51116] [client 3.15.179.172:34452] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/admin/phpinfo.php"] [unique_id "af4qzEQfs7sWtqkpQIeh6wAAAME"]
[Sat May 09 02:26:21.029175 2026] [:error] [pid 51113:tid 51130] [client 3.15.179.172:34492] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test/phpinfo.php"] [unique_id "af4qzUQfs7sWtqkpQIeh8wAAAM8"]
[Sat May 09 02:26:21.954926 2026] [:error] [pid 61355:tid 61365] [client 3.15.179.172:34538] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/dev/phpinfo.php"] [unique_id "af4qzfkhJTi30CBXmMlZ0AAAAYQ"]
[Sat May 09 02:26:22.967625 2026] [:error] [pid 51008:tid 51060] [client 3.15.179.172:34604] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/old/phpinfo.php"] [unique_id "af4qznB58C2Y1tgLtuLomQAAAEs"]
[Sat May 09 02:26:23.864462 2026] [:error] [pid 51007:tid 51024] [client 3.15.179.172:34662] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tmp/phpinfo.php"] [unique_id "af4qz1MagSGstWKyzzUloQAAAAI"]
[Sat May 09 02:26:24.825717 2026] [:error] [pid 61356:tid 61390] [client 3.15.179.172:34712] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public/phpinfo.php"] [unique_id "af4q0Ix3vpB8oWhUq2NEOAAAAcI"]
[Sat May 09 02:26:25.797325 2026] [:error] [pid 51008:tid 51067] [client 3.15.179.172:34760] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/info"] [unique_id "af4q0XB58C2Y1tgLtuLooQAAAFI"]
[Sat May 09 02:26:26.740802 2026] [:error] [pid 51009:tid 51079] [client 3.15.179.172:36080] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php-info.php"] [unique_id "af4q0uB0GbUWhxgzX9WmtgAAAIM"]
[Sat May 09 02:26:27.747010 2026] [:error] [pid 51007:tid 51044] [client 3.15.179.172:36142] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpversion.php"] [unique_id "af4q01MagSGstWKyzzUlpAAAABY"]
[Sat May 09 02:26:28.747373 2026] [:error] [pid 51009:tid 51097] [client 3.15.179.172:36176] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/_phpinfo.php"] [unique_id "af4q1OB0GbUWhxgzX9WmuwAAAJU"]
[Sat May 09 02:26:29.872081 2026] [:error] [pid 61355:tid 61383] [client 3.15.179.172:36232] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/old_phpinfo.php"] [unique_id "af4q1fkhJTi30CBXmMlZ6AAAAZY"]
[Sat May 09 02:26:30.849025 2026] [:error] [pid 61355:tid 61378] [client 3.15.179.172:36284] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/server-info.php"] [unique_id "af4q1vkhJTi30CBXmMlZ8AAAAZE"]
[Sat May 09 02:26:31.826736 2026] [:error] [pid 51008:tid 51057] [client 3.15.179.172:36346] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/server-status.php"] [unique_id "af4q13B58C2Y1tgLtuLopgAAAEg"]
[Sat May 09 02:26:32.842133 2026] [:error] [pid 61355:tid 61364] [client 3.15.179.172:36390] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/_profiler/phpinfo"] [unique_id "af4q2PkhJTi30CBXmMlZ_gAAAYM"]
[Sat May 09 02:26:33.836829 2026] [:error] [pid 51009:tid 51093] [client 3.15.179.172:36434] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/_environment"] [unique_id "af4q2eB0GbUWhxgzX9WmxAAAAJE"]
[Sat May 09 02:26:34.884676 2026] [:error] [pid 51008:tid 51060] [client 3.15.179.172:36498] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/webroot/index.php/_environment"] [unique_id "af4q2nB58C2Y1tgLtuLoqAAAAEs"]
[Sat May 09 02:26:36.051627 2026] [:error] [pid 51007:tid 51036] [client 3.15.179.172:36552] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mail/phpinfo.php"] [unique_id "af4q3FMagSGstWKyzzUlqwAAAA4"]
[Sat May 09 02:26:37.038964 2026] [:error] [pid 51009:tid 51076] [client 3.15.179.172:59360] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/cpanel/phpinfo.php"] [unique_id "af4q3eB0GbUWhxgzX9WmxQAAAIA"]
[Sat May 09 02:26:38.013863 2026] [:error] [pid 51009:tid 51097] [client 3.15.179.172:59404] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hosting/phpinfo.php"] [unique_id "af4q3uB0GbUWhxgzX9WmxwAAAJU"]
[Sat May 09 02:26:38.917888 2026] [:error] [pid 61317:tid 61323] [client 3.15.179.172:59452] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/webmail/phpinfo.php"] [unique_id "af4q3s-fFk_CedOCOYsb9AAAAUM"]
[Sat May 09 02:26:39.812125 2026] [:error] [pid 34318:tid 34342] [client 3.15.179.172:59520] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/smtp/phpinfo.php"] [unique_id "af4q38r3guirgJiKhzAM2AAAARY"]
[Sat May 09 02:26:40.817627 2026] [:error] [pid 34318:tid 34329] [client 3.15.179.172:59564] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php.bak"] [unique_id "af4q4Mr3guirgJiKhzAM3QAAAQk"]
[Sat May 09 02:26:41.748900 2026] [:error] [pid 61356:tid 61391] [client 3.15.179.172:59624] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php.old"] [unique_id "af4q4Yx3vpB8oWhUq2NEVgAAAcM"]
[Sat May 09 02:26:42.811796 2026] [:error] [pid 61356:tid 61407] [client 3.15.179.172:59656] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php~"] [unique_id "af4q4ox3vpB8oWhUq2NEWQAAAdM"]
[Sat May 09 02:26:43.810145 2026] [:error] [pid 61355:tid 61372] [client 3.15.179.172:59732] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/info.php.bak"] [unique_id "af4q4_khJTi30CBXmMlaEQAAAYs"]
[Sat May 09 02:26:44.794658 2026] [:error] [pid 51007:tid 51022] [client 3.15.179.172:59800] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo.php.save"] [unique_id "af4q5FMagSGstWKyzzUlsQAAAAA"]
[Sat May 09 02:26:45.743582 2026] [:error] [pid 51008:tid 51063] [client 3.15.179.172:59862] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/staging/phpinfo.php"] [unique_id "af4q5XB58C2Y1tgLtuLorwAAAE4"]
[Sat May 09 02:26:46.743681 2026] [:error] [pid 51008:tid 51053] [client 3.15.179.172:59912] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/beta/phpinfo.php"] [unique_id "af4q5nB58C2Y1tgLtuLoswAAAEQ"]
[Sat May 09 02:26:47.730534 2026] [:error] [pid 51009:tid 51077] [client 3.15.179.172:34826] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/uat/phpinfo.php"] [unique_id "af4q5-B0GbUWhxgzX9Wm2gAAAIE"]
[Sat May 09 02:26:48.727815 2026] [:error] [pid 34318:tid 34322] [client 3.15.179.172:34892] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/qa/phpinfo.php"] [unique_id "af4q6Mr3guirgJiKhzAM3wAAAQI"]
[Sat May 09 02:26:49.662466 2026] [:error] [pid 61317:tid 61321] [client 3.15.179.172:34962] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/preview/phpinfo.php"] [unique_id "af4q6c-fFk_CedOCOYscCwAAAUE"]
[Sat May 09 02:26:50.640490 2026] [:error] [pid 61355:tid 61378] [client 3.15.179.172:35026] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/www/phpinfo.php"] [unique_id "af4q6vkhJTi30CBXmMlaHQAAAZE"]
[Sat May 09 02:26:51.600374 2026] [:error] [pid 61317:tid 61341] [client 3.15.179.172:35066] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/htdocs/phpinfo.php"] [unique_id "af4q68-fFk_CedOCOYscDgAAAVU"]
[Sat May 09 02:26:52.564921 2026] [:error] [pid 61355:tid 61368] [client 3.15.179.172:35106] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/public_html/phpinfo.php"] [unique_id "af4q7PkhJTi30CBXmMlaIQAAAYc"]
[Sat May 09 02:26:53.495744 2026] [:error] [pid 61355:tid 61379] [client 3.15.179.172:35158] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/site/phpinfo.php"] [unique_id "af4q7fkhJTi30CBXmMlaJwAAAZI"]
[Sat May 09 02:26:54.516684 2026] [:error] [pid 61356:tid 61388] [client 3.15.179.172:35202] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/docs/phpinfo.php"] [unique_id "af4q7ox3vpB8oWhUq2NEdAAAAcA"]
[Sat May 09 02:26:55.552150 2026] [:error] [pid 51113:tid 51115] [client 3.15.179.172:35264] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4q70Qfs7sWtqkpQIeiCQAAAMA"]
[Sat May 09 02:26:56.485878 2026] [:error] [pid 61355:tid 61380] [client 3.15.179.172:35298] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/administrator/phpinfo.php"] [unique_id "af4q8PkhJTi30CBXmMlaMQAAAZM"]
[Sat May 09 02:26:57.419060 2026] [:error] [pid 61355:tid 61369] [client 3.15.179.172:49424] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/core/phpinfo.php"] [unique_id "af4q8fkhJTi30CBXmMlaNgAAAYg"]
[Sat May 09 02:26:58.377722 2026] [:error] [pid 34318:tid 34333] [client 3.15.179.172:49438] [client 3.15.179.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/includes/phpinfo.php"] [unique_id "af4q8sr3guirgJiKhzAM5AAAAQ0"]
[Sat May 09 14:56:52.252688 2026] [:error] [pid 9663:tid 9669] [client 34.82.81.216:50632] [client 34.82.81.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.82.81.216, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "af7atJcWIu01SCxbjwsxigAAAQM"]
[Sat May 09 14:56:52.256719 2026] [:error] [pid 9663:tid 9669] [client 34.82.81.216:50632] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat May 09 14:56:52.420516 2026] [:error] [pid 9663:tid 9679] [client 34.82.81.216:50632] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "af7atJcWIu01SCxbjwsxjgAAAQ0"]
[Sat May 09 14:56:52.875473 2026] [:error] [pid 9187:tid 9276] [client 34.82.81.216:52406] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "af7atBC7An6gkXsRsaGO6AAAAJc"]
[Sat May 09 14:56:53.532616 2026] [:error] [pid 9293:tid 9316] [client 34.82.81.216:57531] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "af7atZR__qEzV5O6Z2OXdwAAANM"]
[Sat May 09 14:56:53.918369 2026] [:error] [pid 9187:tid 9254] [client 34.82.81.216:57334] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "af7atRC7An6gkXsRsaGO6QAAAIE"]
[Sat May 09 14:56:54.580997 2026] [:error] [pid 9187:tid 9256] [client 34.82.81.216:61914] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "af7athC7An6gkXsRsaGO8gAAAIM"]
[Sat May 09 14:56:55.002288 2026] [:error] [pid 9187:tid 9254] [client 34.82.81.216:64893] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "af7atxC7An6gkXsRsaGO9wAAAIE"]
[Sat May 09 14:56:55.567358 2026] [:error] [pid 9760:tid 9783] [client 34.82.81.216:58448] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "af7at2IkCp-C_fh0s7JA8QAAAVE"]
[Sat May 09 14:56:56.064626 2026] [:error] [pid 9293:tid 9302] [client 34.82.81.216:61785] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "af7auJR__qEzV5O6Z2OXhQAAAMU"]
[Sat May 09 14:56:56.530218 2026] [:error] [pid 9293:tid 9318] [client 34.82.81.216:51788] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "af7auJR__qEzV5O6Z2OXhgAAANU"]
[Sat May 09 14:56:56.924494 2026] [:error] [pid 9187:tid 9272] [client 34.82.81.216:64217] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "af7auBC7An6gkXsRsaGPCAAAAJM"]
[Sat May 09 14:56:57.368122 2026] [:error] [pid 9187:tid 9274] [client 34.82.81.216:62047] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "af7auRC7An6gkXsRsaGPEgAAAJU"]
[Sat May 09 14:56:57.799765 2026] [:error] [pid 9187:tid 9277] [client 34.82.81.216:58015] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "af7auRC7An6gkXsRsaGPGgAAAJg"]
[Sat May 09 14:56:58.237790 2026] [:error] [pid 9187:tid 9265] [client 34.82.81.216:64284] [client 34.82.81.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "af7auhC7An6gkXsRsaGPHwAAAIw"]
[Sun May 10 05:43:01.019128 2026] [:error] [pid 62910:tid 62929] [client 34.65.88.197:46296] [client 34.65.88.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "af-qZd5YAy_h5VqgWqhcNQAAANE"]
[Mon May 11 03:00:30.119400 2026] [:error] [pid 9842:tid 9859] [client 35.228.33.228:57724] [client 35.228.33.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agDVzkKCvgYKKAjiZbJ5nQAAAQ4"]
[Mon May 11 03:16:23.713517 2026] [:error] [pid 16038:tid 16075] [client 158.173.67.91:44573] [client 158.173.67.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "agDZh04hf5Tcsfa2scKQQQAAAYc"]
[Mon May 11 03:16:24.246749 2026] [:error] [pid 9842:tid 9850] [client 158.173.67.234:41577] [client 158.173.67.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "agDZiEKCvgYKKAjiZbJ8DgAAAQU"]
[Mon May 11 21:29:39.387720 2026] [:error] [pid 58615:tid 58633] [client 34.165.115.211:42424] [client 34.165.115.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agHZw1K28yH055J8TSrolQAAAA4"]
[Mon May 11 22:53:07.611838 2026] [:error] [pid 4685:tid 4704] [client 34.105.155.76:54686] [client 34.105.155.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agHtU3wrjbU4NZilCZ8f5QAAARA"]
[Tue May 12 04:09:23.578983 2026] [:error] [pid 39958:tid 40042] [client 5.255.110.232:33858] [client 5.255.110.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agI3c-VI9FVDxXB2XxgdPAAAAJc"]
[Tue May 12 04:09:23.857799 2026] [:error] [pid 39957:tid 40014] [client 5.255.110.232:49682] [client 5.255.110.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "agI3c-AfHHyq0DBh5BLufwAAAFY"]
[Tue May 12 04:09:25.563801 2026] [:error] [pid 55559:tid 55637] [client 5.255.110.232:49658] [client 5.255.110.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.example"] [unique_id "agI3ddj0hVMLJAOI_fwuAQAAARE"]
[Wed May 13 05:55:47.112322 2026] [:error] [pid 23780:tid 23795] [client 62.60.130.228:58727] [client 62.60.130.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/images/images/cache.php"] [unique_id "agOh43XgOibPjrXgeTA-yAAAAAE"], referer: www.google.com
[Thu May 14 02:38:22.817709 2026] [:error] [pid 17873:tid 17881] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu May 14 02:38:23.036622 2026] [:error] [pid 17873:tid 17885] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu May 14 02:38:23.254812 2026] [:error] [pid 17873:tid 17883] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu May 14 02:38:23.489378 2026] [:error] [pid 17873:tid 17891] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu May 14 02:38:23.710618 2026] [:error] [pid 17873:tid 17890] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu May 14 02:38:23.928903 2026] [:error] [pid 17873:tid 17884] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu May 14 02:38:24.146753 2026] [:error] [pid 17873:tid 17875] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu May 14 02:38:24.582412 2026] [:error] [pid 17873:tid 17906] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu May 14 02:38:24.800243 2026] [:error] [pid 17873:tid 17876] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Thu May 14 02:38:25.018472 2026] [:error] [pid 17873:tid 17886] [client 40.85.229.173:3254] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu May 14 02:38:25.232837 2026] [:error] [pid 17873:tid 17896] [client 40.85.229.173:3254] [client 40.85.229.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agTFIfEqBQQrkyEyu_o5iwAAARQ"]
[Thu May 14 02:38:26.069928 2026] [:error] [pid 12340:tid 12400] [client 40.85.229.173:4049] [client 40.85.229.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agTFIsrxSPfvmN7BQjLJqgAAAIQ"]
[Thu May 14 02:38:26.915272 2026] [:error] [pid 12340:tid 12407] [client 40.85.229.173:34093] [client 40.85.229.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agTFIsrxSPfvmN7BQjLJrQAAAIs"]
[Thu May 14 02:38:27.782699 2026] [:error] [pid 12340:tid 12412] [client 40.85.229.173:39209] [client 40.85.229.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agTFI8rxSPfvmN7BQjLJrwAAAJA"]
[Thu May 14 09:57:37.891374 2026] [:error] [pid 11690:tid 11705] [client 88.151.33.232:38560] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "agUsESnxWuLN8Hptw8m9vAAAAMY"]
[Thu May 14 09:57:37.892129 2026] [:error] [pid 11690:tid 11700] [client 88.151.33.232:38634] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "agUsESnxWuLN8Hptw8m9vQAAAME"]
[Thu May 14 09:57:37.892525 2026] [:error] [pid 11690:tid 11709] [client 88.151.33.232:38604] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.bak"] [unique_id "agUsESnxWuLN8Hptw8m9vgAAAMo"]
[Thu May 14 09:57:37.893556 2026] [:error] [pid 47673:tid 47686] [client 88.151.33.232:38600] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.backup"] [unique_id "agUsEfCGe4cIn3sh5k3ZMQAAAUs"]
[Thu May 14 09:57:37.895719 2026] [:error] [pid 63033:tid 63054] [client 88.151.33.232:38594] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "agUsEVMY49UWn5BpqVaaXwAAARM"]
[Thu May 14 09:57:37.896619 2026] [:error] [pid 63033:tid 63053] [client 88.151.33.232:38570] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.example"] [unique_id "agUsEVMY49UWn5BpqVaaYQAAARI"]
[Thu May 14 09:57:37.900462 2026] [:error] [pid 47673:tid 47688] [client 88.151.33.232:38646] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env"] [unique_id "agUsEfCGe4cIn3sh5k3ZNAAAAU0"]
[Thu May 14 09:57:37.901650 2026] [:error] [pid 47673:tid 47676] [client 88.151.33.232:38524] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||windfc.windfarmcoolants.com.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/storage/logs/laravel.log"] [unique_id "agUsEfCGe4cIn3sh5k3ZNQAAAUE"]
[Thu May 14 09:57:37.902449 2026] [:error] [pid 11581:tid 11619] [client 88.151.33.232:38582] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "agUsEf0vF48FbzpvQMWgNAAAABY"]
[Thu May 14 09:57:37.904495 2026] [:error] [pid 11581:tid 11612] [client 88.151.33.232:38576] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "agUsEf0vF48FbzpvQMWgNQAAAA8"]
[Thu May 14 09:57:37.905133 2026] [:error] [pid 47673:tid 47694] [client 88.151.33.232:38678] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/.env"] [unique_id "agUsEfCGe4cIn3sh5k3ZOAAAAVM"]
[Thu May 14 09:57:37.905678 2026] [:error] [pid 47673:tid 47677] [client 88.151.33.232:38676] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env"] [unique_id "agUsEfCGe4cIn3sh5k3ZOQAAAUI"]
[Thu May 14 09:57:37.908479 2026] [:error] [pid 47673:tid 47687] [client 88.151.33.232:38620] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "agUsEfCGe4cIn3sh5k3ZOgAAAUw"]
[Thu May 14 09:57:37.909658 2026] [:error] [pid 47673:tid 47699] [client 88.151.33.232:38612] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.old"] [unique_id "agUsEfCGe4cIn3sh5k3ZOwAAAVg"]
[Thu May 14 09:57:37.912661 2026] [:error] [pid 11581:tid 11615] [client 88.151.33.232:38506] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agUsEf0vF48FbzpvQMWgOAAAABI"]
[Thu May 14 09:57:37.990096 2026] [:error] [pid 11581:tid 11606] [client 88.151.33.232:38666] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/backend/.env"] [unique_id "agUsEf0vF48FbzpvQMWgOgAAAAk"]
[Thu May 14 09:57:38.006030 2026] [:error] [pid 63033:tid 63044] [client 88.151.33.232:38658] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/.env"] [unique_id "agUsElMY49UWn5BpqVaaYgAAAQk"]
[Fri May 15 12:40:22.450331 2026] [:error] [pid 3254:tid 3265] [client 34.143.242.139:48474] [client 34.143.242.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agajtpUANYxu1KmrsL4aNQAAAYk"]
[Fri May 15 13:06:44.848155 2026] [:error] [pid 9392:tid 9398] [client 34.92.178.17:35956] [client 34.92.178.17] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agap5NBWJIjH1U9zGfaCFAAAAQQ"]
[Fri May 15 15:12:48.492558 2026] [:error] [pid 30240:tid 30242] [client 146.148.6.181:41284] [client 146.148.6.181] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agbHcK8ckHvaA6bpewtDPgAAAUA"]
[Fri May 15 15:44:33.837339 2026] [:error] [pid 9307:tid 9387] [client 34.176.123.22:54502] [client 34.176.123.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agbO4SC43jY1IRzK5VZF3wAAANY"]
[Fri May 15 15:47:43.307423 2026] [:error] [pid 30240:tid 30244] [client 34.26.206.254:35246] [client 34.26.206.254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agbPn68ckHvaA6bpewtIogAAAUI"]
[Fri May 15 17:30:34.693080 2026] [:error] [pid 30272:tid 30291] [client 34.19.244.237:37342] [client 34.19.244.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agbnunvc_jSFaQ_7_wfJQwAAAZE"]
[Sat May 16 01:56:55.056032 2026] [:error] [pid 9392:tid 9410] [client 20.211.160.243:4491] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat May 16 01:56:55.074957 2026] [:error] [pid 9392:tid 9406] [client 20.211.160.243:4491] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat May 16 01:56:55.116930 2026] [:error] [pid 9392:tid 9405] [client 20.211.160.243:4491] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat May 16 01:56:55.136383 2026] [:error] [pid 9392:tid 9404] [client 20.211.160.243:4491] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat May 16 01:56:55.173495 2026] [:error] [pid 9392:tid 9408] [client 20.211.160.243:4491] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat May 16 01:56:55.192429 2026] [:error] [pid 9392:tid 9416] [client 20.211.160.243:4491] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat May 16 01:56:55.239644 2026] [:error] [pid 9392:tid 9403] [client 20.211.160.243:4491] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat May 16 01:56:55.292490 2026] [:error] [pid 9392:tid 9409] [client 20.211.160.243:4491] [client 20.211.160.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agdeZ9BWJIjH1U9zGfYFcAAAAQ8"]
[Sat May 16 01:56:55.353844 2026] [:error] [pid 30240:tid 30247] [client 20.211.160.243:2708] [client 20.211.160.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agdeZ68ckHvaA6bpewuMwwAAAUU"]
[Sat May 16 01:56:55.419421 2026] [:error] [pid 30240:tid 30257] [client 20.211.160.243:1986] [client 20.211.160.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agdeZ68ckHvaA6bpewuMxAAAAU8"]
[Sat May 16 01:56:55.483895 2026] [:error] [pid 30272:tid 30297] [client 20.211.160.243:2735] [client 20.211.160.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agdeZ3vc_jSFaQ_7_wcukQAAAZc"]
[Sat May 16 05:10:35.499896 2026] [:error] [pid 24979:tid 24997] [client 34.138.196.151:56220] [client 34.138.196.151] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ageLy7vSFUQiwLaOL2ofbQAAANA"]
[Sun May 17 00:34:00.153285 2026] [:error] [pid 24874:tid 24956] [client 20.189.203.136:7979] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun May 17 00:34:01.220429 2026] [:error] [pid 24874:tid 24945] [client 20.189.203.136:7979] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sun May 17 00:34:01.468101 2026] [:error] [pid 24874:tid 24946] [client 20.189.203.136:7979] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun May 17 00:34:01.591458 2026] [:error] [pid 24874:tid 24936] [client 20.189.203.136:7979] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun May 17 00:34:01.727702 2026] [:error] [pid 24874:tid 24949] [client 20.189.203.136:7979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun May 17 00:34:01.973898 2026] [:error] [pid 24874:tid 24948] [client 20.189.203.136:7979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Sun May 17 00:34:02.219054 2026] [:error] [pid 24874:tid 24957] [client 20.189.203.136:7979] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sun May 17 00:34:02.345995 2026] [:error] [pid 24874:tid 24941] [client 20.189.203.136:7979] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sun May 17 00:34:02.466025 2026] [:error] [pid 24874:tid 24935] [client 20.189.203.136:7979] [client 20.189.203.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/control.php"] [unique_id "agicesiii6x3XidYGHHqrAAAAIA"]
[Sun May 17 00:34:02.966205 2026] [:error] [pid 24979:tid 24982] [client 20.189.203.136:7983] [client 20.189.203.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/control.php"] [unique_id "agicervSFUQiwLaOL2q9vAAAAME"]
[Sun May 17 00:34:03.447678 2026] [:error] [pid 62341:tid 62355] [client 20.189.203.136:7970] [client 20.189.203.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/control.php"] [unique_id "agice6nvQ59ep-XG78jR6AAAAok"]
[Sun May 17 00:34:03.999786 2026] [:error] [pid 62341:tid 62347] [client 20.189.203.136:8601] [client 20.189.203.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/control.php"] [unique_id "agice6nvQ59ep-XG78jR6QAAAoE"]
[Sun May 17 10:03:45.524861 2026] [:error] [pid 59062:tid 59130] [client 92.118.39.29:55272] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "agkiAT4V9GkVWmCFmGbPAAAAAIc"]
[Sun May 17 12:32:44.669136 2026] [:error] [pid 36652:tid 36676] [client 92.118.39.29:33578] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aglE7DZrzQadnZADvj9FuwAAARY"]
[Sun May 17 13:31:14.643975 2026] [:error] [pid 10834:tid 10846] [client 172.64.223.130:11347] [client 172.64.223.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "aglSohISNQ_Nf83-VpqHmQAAAcA"]
[Mon May 18 02:03:40.566167 2026] [:error] [pid 59061:tid 59106] [client 20.89.244.63:6082] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 18 02:03:40.689541 2026] [:error] [pid 59061:tid 59117] [client 20.89.244.63:6082] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Mon May 18 02:03:40.812836 2026] [:error] [pid 59061:tid 59104] [client 20.89.244.63:6082] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon May 18 02:03:40.935891 2026] [:error] [pid 59061:tid 59101] [client 20.89.244.63:6082] File does not exist: /usr/local/apache/htdocs/suspended-page/php8.php
[Mon May 18 02:03:41.059137 2026] [:error] [pid 59061:tid 59113] [client 20.89.244.63:6082] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Mon May 18 02:03:41.186582 2026] [:error] [pid 59061:tid 59099] [client 20.89.244.63:6082] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Mon May 18 02:03:41.310559 2026] [:error] [pid 59061:tid 59119] [client 20.89.244.63:6082] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon May 18 02:03:41.558204 2026] [:error] [pid 59061:tid 59109] [client 20.89.244.63:6082] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Mon May 18 02:03:41.811782 2026] [:error] [pid 59061:tid 59120] [client 20.89.244.63:6082] [client 20.89.244.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "agoC_YYS410zAmsYkoI-lwAAAFg"]
[Mon May 18 02:03:42.316284 2026] [:error] [pid 11079:tid 11101] [client 20.89.244.63:8530] [client 20.89.244.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "agoC_meR3-DrxhvUqxEjPgAAAkE"]
[Mon May 18 02:03:42.869283 2026] [:error] [pid 11079:tid 11114] [client 20.89.244.63:8552] [client 20.89.244.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "agoC_meR3-DrxhvUqxEjPwAAAko"]
[Mon May 18 02:03:43.413652 2026] [:error] [pid 10784:tid 10811] [client 20.89.244.63:8565] [client 20.89.244.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-blog.php"] [unique_id "agoC_2BWRlKsFkSZGxBf_gAAAYw"]
[Mon May 18 12:57:33.972559 2026] [:error] [pid 36579:tid 36597] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 18 12:57:34.183472 2026] [:error] [pid 36579:tid 36592] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon May 18 12:57:34.393724 2026] [:error] [pid 36579:tid 36586] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon May 18 12:57:34.702979 2026] [:error] [pid 36579:tid 36588] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon May 18 12:57:35.013570 2026] [:error] [pid 36579:tid 36584] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Mon May 18 12:57:35.224533 2026] [:error] [pid 36579:tid 36599] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon May 18 12:57:35.440757 2026] [:error] [pid 36579:tid 36585] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Mon May 18 12:57:35.865944 2026] [:error] [pid 36579:tid 36600] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Mon May 18 12:57:36.077556 2026] [:error] [pid 36579:tid 36596] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Mon May 18 12:57:36.352694 2026] [:error] [pid 36579:tid 36603] [client 20.151.141.70:16897] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Mon May 18 12:57:36.628440 2026] [:error] [pid 36579:tid 36591] [client 20.151.141.70:16897] [client 20.151.141.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agqcQF-aoZxBfgL5vDxUwAAAAEk"]
[Mon May 18 12:57:40.353013 2026] [:error] [pid 36579:tid 36595] [client 20.151.141.70:23097] [client 20.151.141.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agqcRF-aoZxBfgL5vDxUwQAAAE0"]
[Mon May 18 12:57:42.620671 2026] [:error] [pid 36579:tid 36602] [client 20.151.141.70:4771] [client 20.151.141.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agqcRl-aoZxBfgL5vDxUwgAAAFQ"]
[Mon May 18 12:57:45.200545 2026] [:error] [pid 36491:tid 36519] [client 20.151.141.70:4741] [client 20.151.141.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agqcSU555B9CZb6D60mJdgAAAVg"]
[Mon May 18 15:32:45.830828 2026] [:error] [pid 44087:tid 44100] [client 40.74.65.2:3823] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 18 15:32:46.137093 2026] [:error] [pid 44087:tid 44101] [client 40.74.65.2:3823] File does not exist: /usr/local/apache/htdocs/suspended-page/supyffqkrnyxagxcjucnCdefault.php
[Mon May 18 15:32:46.317284 2026] [:error] [pid 44087:tid 44109] [client 40.74.65.2:3823] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Mon May 18 15:32:46.468887 2026] [:error] [pid 44087:tid 44111] [client 40.74.65.2:3823] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon May 18 15:32:46.769931 2026] [:error] [pid 44087:tid 44092] [client 40.74.65.2:3823] File does not exist: /usr/local/apache/htdocs/suspended-page/php8.php
[Mon May 18 15:32:47.071363 2026] [:error] [pid 44087:tid 44107] [client 40.74.65.2:3823] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon May 18 15:32:47.222017 2026] [:error] [pid 44087:tid 44096] [client 40.74.65.2:3823] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon May 18 15:32:47.392651 2026] [:error] [pid 44087:tid 44106] [client 40.74.65.2:3823] [client 40.74.65.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "agrAn25HPHbH9GK7l6zf4QAAAdE"]
[Mon May 18 15:32:47.959552 2026] [:error] [pid 44010:tid 44031] [client 40.74.65.2:3730] [client 40.74.65.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "agrAnzcFUuogD3-74-ZqFQAAANM"]
[Mon May 18 15:32:48.517336 2026] [:error] [pid 36579:tid 36584] [client 40.74.65.2:3798] [client 40.74.65.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "agrAoF-aoZxBfgL5vDxxcQAAAEI"]
[Mon May 18 15:32:49.063513 2026] [:error] [pid 36492:tid 36540] [client 40.74.65.2:2042] [client 40.74.65.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "agrAoWCVlogrkn9m2w6rDwAAABI"]
[Mon May 18 23:28:23.060476 2026] [:error] [pid 36491:tid 36508] [client 34.82.154.86:64981] [client 34.82.154.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.82.154.86, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "agswF0555B9CZb6D60nlAAAAAU0"]
[Mon May 18 23:28:23.064341 2026] [:error] [pid 36491:tid 36508] [client 34.82.154.86:64981] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon May 18 23:28:24.206826 2026] [:error] [pid 36491:tid 36496] [client 34.82.154.86:64981] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "agswGE555B9CZb6D60nlCgAAAUE"]
[Mon May 18 23:28:24.556881 2026] [:error] [pid 44087:tid 44114] [client 34.82.154.86:64699] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "agswGG5HPHbH9GK7l6wC8wAAAdg"]
[Mon May 18 23:28:24.972111 2026] [:error] [pid 36491:tid 36515] [client 34.82.154.86:53615] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "agswGE555B9CZb6D60nlDQAAAVQ"]
[Mon May 18 23:28:25.374036 2026] [:error] [pid 44046:tid 44069] [client 34.82.154.86:52182] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "agswGYYF4k2jfXJBXk0GeAAAAZU"]
[Mon May 18 23:28:25.745229 2026] [:error] [pid 44046:tid 44053] [client 34.82.154.86:56140] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "agswGYYF4k2jfXJBXk0GeQAAAYU"]
[Mon May 18 23:28:26.147931 2026] [:error] [pid 36579:tid 36605] [client 34.82.154.86:57762] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "agswGl-aoZxBfgL5vDyiXAAAAFc"]
[Mon May 18 23:28:26.520078 2026] [:error] [pid 36579:tid 36606] [client 34.82.154.86:57758] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "agswGl-aoZxBfgL5vDyiYAAAAFg"]
[Mon May 18 23:28:26.853713 2026] [:error] [pid 36579:tid 36589] [client 34.82.154.86:64559] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "agswGl-aoZxBfgL5vDyiZAAAAEc"]
[Mon May 18 23:28:27.230575 2026] [:error] [pid 36491:tid 36510] [client 34.82.154.86:64573] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "agswG0555B9CZb6D60nlFAAAAU8"]
[Mon May 18 23:28:27.635515 2026] [:error] [pid 44046:tid 44070] [client 34.82.154.86:52781] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "agswG4YF4k2jfXJBXk0GfAAAAZY"]
[Mon May 18 23:28:28.017179 2026] [:error] [pid 36492:tid 36532] [client 34.82.154.86:55954] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "agswHGCVlogrkn9m2w4JwgAAAAo"]
[Mon May 18 23:28:28.381000 2026] [:error] [pid 36493:tid 36550] [client 34.82.154.86:52621] [client 34.82.154.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "agswHAynkzQB5nM668rWCgAAAQE"]
[Tue May 19 17:45:06.085901 2026] [:error] [pid 38697:tid 38734] [client 23.101.211.69:3116] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue May 19 17:45:06.104353 2026] [:error] [pid 38697:tid 38721] [client 23.101.211.69:3116] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue May 19 17:45:06.159647 2026] [:error] [pid 38697:tid 38739] [client 23.101.211.69:3116] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue May 19 17:45:06.185225 2026] [:error] [pid 38697:tid 38725] [client 23.101.211.69:3116] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue May 19 17:45:06.221769 2026] [:error] [pid 38697:tid 38729] [client 23.101.211.69:3116] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue May 19 17:45:06.241094 2026] [:error] [pid 38697:tid 38738] [client 23.101.211.69:3116] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue May 19 17:45:06.259804 2026] [:error] [pid 38697:tid 38716] [client 23.101.211.69:3116] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue May 19 17:45:06.313479 2026] [:error] [pid 38697:tid 38724] [client 23.101.211.69:3116] [client 23.101.211.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agwxIqXP9pP6Kgt-msQ-IwAAAAk"]
[Tue May 19 17:45:06.413000 2026] [:error] [pid 55881:tid 55886] [client 23.101.211.69:5776] [client 23.101.211.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agwxIu-UExma0LUC7WD7VgAAAkM"]
[Tue May 19 17:45:06.490855 2026] [:error] [pid 55881:tid 55888] [client 23.101.211.69:5556] [client 23.101.211.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agwxIu-UExma0LUC7WD7VwAAAkU"]
[Tue May 19 17:45:06.563030 2026] [:error] [pid 38705:tid 38786] [client 23.101.211.69:5527] [client 23.101.211.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agwxIsg5dNOZ5umN9ltaXgAAAJE"]
[Tue May 19 21:57:08.818768 2026] [:error] [pid 29823:tid 29839] [client 4.193.103.12:1997] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue May 19 21:57:08.911057 2026] [:error] [pid 29823:tid 29859] [client 4.193.103.12:1997] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue May 19 21:57:09.095320 2026] [:error] [pid 29823:tid 29852] [client 4.193.103.12:1997] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue May 19 21:57:09.186880 2026] [:error] [pid 29823:tid 29837] [client 4.193.103.12:1997] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue May 19 21:57:09.379499 2026] [:error] [pid 29823:tid 29855] [client 4.193.103.12:1997] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue May 19 21:57:09.480719 2026] [:error] [pid 29823:tid 29856] [client 4.193.103.12:1997] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue May 19 21:57:09.574963 2026] [:error] [pid 29823:tid 29860] [client 4.193.103.12:1997] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue May 19 21:57:09.849664 2026] [:error] [pid 29823:tid 29850] [client 4.193.103.12:1997] [client 4.193.103.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agxsNWO09C0nAz8vRk5YswAAAcs"]
[Tue May 19 21:57:10.221624 2026] [:error] [pid 46815:tid 46827] [client 4.193.103.12:2003] [client 4.193.103.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agxsNiPnRhJOmA06Lgp7lAAAAUo"]
[Tue May 19 21:57:10.579527 2026] [:error] [pid 41573:tid 41583] [client 4.193.103.12:2008] [client 4.193.103.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agxsNi1A2bd6JDSW9RafJAAAAQg"]
[Tue May 19 21:57:10.933786 2026] [:error] [pid 41573:tid 41598] [client 4.193.103.12:4942] [client 4.193.103.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws.php"] [unique_id "agxsNi1A2bd6JDSW9RafJQAAARc"]
[Wed May 20 05:21:16.057569 2026] [:error] [pid 36145:tid 36149] [client 20.104.227.76:4158] File does not exist: /usr/local/apache/htdocs/suspended-page/r.php
[Wed May 20 05:21:16.269737 2026] [:error] [pid 36145:tid 36167] [client 20.104.227.76:4158] File does not exist: /usr/local/apache/htdocs/suspended-page/ight.php
[Wed May 20 05:21:16.501567 2026] [:error] [pid 36145:tid 36158] [client 20.104.227.76:4158] File does not exist: /usr/local/apache/htdocs/suspended-page/wpns.php
[Wed May 20 05:21:16.724004 2026] [:error] [pid 36145:tid 36152] [client 20.104.227.76:4158] File does not exist: /usr/local/apache/htdocs/suspended-page/er.php
[Wed May 20 05:21:16.940406 2026] [:error] [pid 36145:tid 36160] [client 20.104.227.76:4158] File does not exist: /usr/local/apache/htdocs/suspended-page/sql.php
[Wed May 20 05:21:17.368427 2026] [:error] [pid 36145:tid 36170] [client 20.104.227.76:4158] File does not exist: /usr/local/apache/htdocs/suspended-page/getir.php
[Wed May 20 05:21:17.794906 2026] [:error] [pid 36145:tid 36168] [client 20.104.227.76:4158] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed May 20 05:21:18.008578 2026] [:error] [pid 36145:tid 36155] [client 20.104.227.76:4158] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Wed May 20 05:21:18.218000 2026] [:error] [pid 36145:tid 36164] [client 20.104.227.76:4158] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "agzUTqtS18KtvF2Vags6fQAAARA"]
[Wed May 20 05:21:18.643211 2026] [:error] [pid 36145:tid 36159] [client 20.104.227.76:64458] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "agzUTqtS18KtvF2Vags6fwAAAQs"]
[Wed May 20 05:21:19.061414 2026] [:error] [pid 36145:tid 36150] [client 20.104.227.76:14916] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "agzUT6tS18KtvF2Vags6gAAAAQI"]
[Wed May 20 05:21:19.487209 2026] [:error] [pid 36145:tid 36166] [client 20.104.227.76:4119] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/class.php"] [unique_id "agzUT6tS18KtvF2Vags6gQAAARI"]
[Wed May 20 05:21:19.933156 2026] [:error] [pid 59349:tid 59365] [client 20.104.227.76:14952] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "agzUTzvvxTUy-ppKSZWHIgAAAM4"]
[Wed May 20 05:21:20.355976 2026] [:error] [pid 59349:tid 59371] [client 20.104.227.76:4145] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "agzUUDvvxTUy-ppKSZWHIwAAANQ"]
[Wed May 20 05:21:20.798019 2026] [:error] [pid 59349:tid 59354] [client 20.104.227.76:4166] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "agzUUDvvxTUy-ppKSZWHJQAAAMM"]
[Wed May 20 05:21:21.223015 2026] [:error] [pid 59349:tid 59360] [client 20.104.227.76:14889] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/goods.php"] [unique_id "agzUUTvvxTUy-ppKSZWHJgAAAMk"]
[Wed May 20 05:21:21.646609 2026] [:error] [pid 57834:tid 57899] [client 20.104.227.76:64469] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "agzUUXTOfwZ09EhqoYD6PAAAAog"]
[Wed May 20 05:21:22.067792 2026] [:error] [pid 59244:tid 59260] [client 20.104.227.76:64511] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "agzUUrxU0SdQQE7pLs2xSwAAAAc"]
[Wed May 20 05:21:22.486054 2026] [:error] [pid 59349:tid 59357] [client 20.104.227.76:64488] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "agzUUjvvxTUy-ppKSZWHLQAAAMY"]
[Wed May 20 05:21:23.109569 2026] [:error] [pid 59349:tid 59355] [client 20.104.227.76:14849] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/info.php"] [unique_id "agzUUzvvxTUy-ppKSZWHLgAAAMQ"]
[Wed May 20 05:21:23.529122 2026] [:error] [pid 59349:tid 59351] [client 20.104.227.76:14928] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "agzUUzvvxTUy-ppKSZWHLwAAAMA"]
[Wed May 20 05:21:23.958901 2026] [:error] [pid 57835:tid 57938] [client 20.104.227.76:64499] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "agzUU2YoVRVVHvoOYbo9QAAAAtQ"]
[Wed May 20 05:21:24.384483 2026] [:error] [pid 57832:tid 57850] [client 20.104.227.76:4142] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "agzUVENip5HpFD8GxxX2SAAAAg0"]
[Wed May 20 05:21:24.825060 2026] [:error] [pid 59349:tid 59354] [client 20.104.227.76:64454] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "agzUVDvvxTUy-ppKSZWHMQAAAMM"]
[Wed May 20 05:21:25.339947 2026] [:error] [pid 57835:tid 57939] [client 20.104.227.76:4160] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aw.php"] [unique_id "agzUVWYoVRVVHvoOYbo9QQAAAtU"]
[Wed May 20 05:21:25.762011 2026] [:error] [pid 57835:tid 57918] [client 20.104.227.76:4146] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aw.php"] [unique_id "agzUVWYoVRVVHvoOYbo9QgAAAsA"]
[Wed May 20 05:21:26.207694 2026] [:error] [pid 57835:tid 57919] [client 20.104.227.76:14925] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aw.php"] [unique_id "agzUVmYoVRVVHvoOYbo9RAAAAsE"]
[Wed May 20 05:21:26.677334 2026] [:error] [pid 59349:tid 59360] [client 20.104.227.76:64498] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aw.php"] [unique_id "agzUVjvvxTUy-ppKSZWHMgAAAMk"]
[Wed May 20 05:21:27.158931 2026] [:error] [pid 59349:tid 59365] [client 20.104.227.76:4103] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bb.php"] [unique_id "agzUVzvvxTUy-ppKSZWHMwAAAM4"]
[Wed May 20 05:21:27.583173 2026] [:error] [pid 57742:tid 57751] [client 20.104.227.76:14862] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bb.php"] [unique_id "agzUV6Q_304u6rVT2w-idQAAAUc"]
[Wed May 20 05:21:28.435891 2026] [:error] [pid 59349:tid 59362] [client 20.104.227.76:64451] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bb.php"] [unique_id "agzUWDvvxTUy-ppKSZWHNgAAAMs"]
[Wed May 20 05:21:28.869993 2026] [:error] [pid 59349:tid 59367] [client 20.104.227.76:4113] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bb.php"] [unique_id "agzUWDvvxTUy-ppKSZWHOAAAANA"]
[Wed May 20 05:21:29.315972 2026] [:error] [pid 59349:tid 59358] [client 20.104.227.76:55874] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agzUWTvvxTUy-ppKSZWHOgAAAMc"]
[Wed May 20 05:21:29.744801 2026] [:error] [pid 57834:tid 57907] [client 20.104.227.76:14880] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agzUWXTOfwZ09EhqoYD6QAAAApA"]
[Wed May 20 05:21:30.204321 2026] [:error] [pid 36145:tid 36148] [client 20.104.227.76:14888] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agzUWqtS18KtvF2Vags6hwAAAQA"]
[Wed May 20 05:21:30.630548 2026] [:error] [pid 36145:tid 36155] [client 20.104.227.76:14920] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "agzUWqtS18KtvF2Vags6iAAAAQc"]
[Wed May 20 05:21:31.052139 2026] [:error] [pid 59349:tid 59364] [client 20.104.227.76:14879] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "agzUWzvvxTUy-ppKSZWHPQAAAM0"]
[Wed May 20 05:21:31.546713 2026] [:error] [pid 59349:tid 59352] [client 20.104.227.76:4194] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "agzUWzvvxTUy-ppKSZWHPwAAAME"]
[Wed May 20 05:21:31.968664 2026] [:error] [pid 57832:tid 57854] [client 20.104.227.76:4170] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "agzUW0Nip5HpFD8GxxX2SwAAAhE"]
[Wed May 20 05:21:32.384218 2026] [:error] [pid 57834:tid 57910] [client 20.104.227.76:4194] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/222.php"] [unique_id "agzUXHTOfwZ09EhqoYD6QQAAApM"]
[Wed May 20 05:21:32.825811 2026] [:error] [pid 57832:tid 57855] [client 20.104.227.76:14899] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "agzUXENip5HpFD8GxxX2TQAAAhI"]
[Wed May 20 05:21:33.302292 2026] [:error] [pid 57774:tid 57820] [client 20.104.227.76:4133] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "agzUXazH4LWfnGU0RXC2dAAAAdE"]
[Wed May 20 05:21:33.723420 2026] [:error] [pid 59349:tid 59373] [client 20.104.227.76:55872] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "agzUXTvvxTUy-ppKSZWHRAAAANY"]
[Wed May 20 05:21:34.146589 2026] [:error] [pid 57834:tid 57909] [client 20.104.227.76:4134] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "agzUXnTOfwZ09EhqoYD6QgAAApI"]
[Wed May 20 05:21:34.578317 2026] [:error] [pid 59349:tid 59368] [client 20.104.227.76:4192] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php"] [unique_id "agzUXjvvxTUy-ppKSZWHRgAAANE"]
[Wed May 20 05:21:35.004464 2026] [:error] [pid 59349:tid 59365] [client 20.104.227.76:4167] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php"] [unique_id "agzUXzvvxTUy-ppKSZWHSQAAAM4"]
[Wed May 20 05:21:35.425068 2026] [:error] [pid 57834:tid 57908] [client 20.104.227.76:14914] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php"] [unique_id "agzUX3TOfwZ09EhqoYD6QwAAApE"]
[Wed May 20 05:21:35.863426 2026] [:error] [pid 57832:tid 57858] [client 20.104.227.76:53447] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-mail.php"] [unique_id "agzUX0Nip5HpFD8GxxX2TwAAAhU"]
[Wed May 20 05:21:36.286882 2026] [:error] [pid 57833:tid 57870] [client 20.104.227.76:4106] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "agzUYLVqIe7Xlzcr5bagJAAAAkY"]
[Wed May 20 05:21:36.712951 2026] [:error] [pid 57834:tid 57912] [client 20.104.227.76:4165] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "agzUYHTOfwZ09EhqoYD6RAAAApU"]
[Wed May 20 05:21:37.138695 2026] [:error] [pid 57834:tid 57913] [client 20.104.227.76:64472] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "agzUYXTOfwZ09EhqoYD6RQAAApY"]
[Wed May 20 05:21:37.566391 2026] [:error] [pid 59245:tid 59292] [client 20.104.227.76:64464] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "agzUYaOutR70QIZRVkTTzAAAAEw"]
[Wed May 20 05:21:37.992670 2026] [:error] [pid 59349:tid 59352] [client 20.104.227.76:64480] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "agzUYTvvxTUy-ppKSZWHVAAAAME"]
[Wed May 20 05:21:38.415060 2026] [:error] [pid 59349:tid 59351] [client 20.104.227.76:64471] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "agzUYjvvxTUy-ppKSZWHVwAAAMA"]
[Wed May 20 05:21:38.838486 2026] [:error] [pid 59349:tid 59361] [client 20.104.227.76:14886] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "agzUYjvvxTUy-ppKSZWHWAAAAMo"]
[Wed May 20 05:21:39.270331 2026] [:error] [pid 59349:tid 59353] [client 20.104.227.76:14932] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/adminfuns.php"] [unique_id "agzUYzvvxTUy-ppKSZWHWgAAAMI"]
[Wed May 20 05:21:39.696010 2026] [:error] [pid 59349:tid 59373] [client 20.104.227.76:55911] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php8.php"] [unique_id "agzUYzvvxTUy-ppKSZWHWwAAANY"]
[Wed May 20 05:21:40.127475 2026] [:error] [pid 57832:tid 57838] [client 20.104.227.76:14894] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php8.php"] [unique_id "agzUZENip5HpFD8GxxX2UgAAAgE"]
[Wed May 20 05:21:40.570110 2026] [:error] [pid 57742:tid 57753] [client 20.104.227.76:4215] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php8.php"] [unique_id "agzUZKQ_304u6rVT2w-idwAAAUk"]
[Wed May 20 05:21:40.991186 2026] [:error] [pid 59245:tid 59289] [client 20.104.227.76:4214] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/php8.php"] [unique_id "agzUZKOutR70QIZRVkTTzQAAAEk"]
[Wed May 20 05:21:41.407432 2026] [:error] [pid 57742:tid 57756] [client 20.104.227.76:55873] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "agzUZaQ_304u6rVT2w-ieAAAAUw"]
[Wed May 20 05:21:41.823354 2026] [:error] [pid 59349:tid 59365] [client 20.104.227.76:14901] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "agzUZTvvxTUy-ppKSZWHXwAAAM4"]
[Wed May 20 05:21:42.251564 2026] [:error] [pid 57832:tid 57842] [client 20.104.227.76:55898] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "agzUZkNip5HpFD8GxxX2VAAAAgU"]
[Wed May 20 05:21:42.681200 2026] [:error] [pid 59349:tid 59362] [client 20.104.227.76:4130] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ioxi-o.php"] [unique_id "agzUZjvvxTUy-ppKSZWHYQAAAMs"]
[Wed May 20 05:21:43.109457 2026] [:error] [pid 59245:tid 59304] [client 20.104.227.76:4132] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "agzUZ6OutR70QIZRVkTTzgAAAFg"]
[Wed May 20 05:21:43.523214 2026] [:error] [pid 57835:tid 57922] [client 20.104.227.76:14883] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "agzUZ2YoVRVVHvoOYbo9RgAAAsQ"]
[Wed May 20 05:21:43.945444 2026] [:error] [pid 59349:tid 59372] [client 20.104.227.76:4153] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "agzUZzvvxTUy-ppKSZWHZgAAANU"]
[Wed May 20 05:21:44.374463 2026] [:error] [pid 59349:tid 59366] [client 20.104.227.76:4179] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "agzUaDvvxTUy-ppKSZWHaQAAAM8"]
[Wed May 20 05:21:44.801768 2026] [:error] [pid 57834:tid 57891] [client 20.104.227.76:4204] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "agzUaHTOfwZ09EhqoYD6RwAAAoA"]
[Wed May 20 05:21:45.237120 2026] [:error] [pid 59244:tid 59272] [client 20.104.227.76:14850] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "agzUabxU0SdQQE7pLs2xTQAAABM"]
[Wed May 20 05:21:45.662383 2026] [:error] [pid 59349:tid 59361] [client 20.104.227.76:14931] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "agzUaTvvxTUy-ppKSZWHbQAAAMo"]
[Wed May 20 05:21:46.082008 2026] [:error] [pid 59349:tid 59373] [client 20.104.227.76:64460] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sid3.php"] [unique_id "agzUajvvxTUy-ppKSZWHbwAAANY"]
[Wed May 20 05:21:46.511907 2026] [:error] [pid 59349:tid 59365] [client 20.104.227.76:14855] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/load.php"] [unique_id "agzUajvvxTUy-ppKSZWHcgAAAM4"]
[Wed May 20 05:21:46.942668 2026] [:error] [pid 57835:tid 57927] [client 20.104.227.76:4097] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/load.php"] [unique_id "agzUamYoVRVVHvoOYbo9SAAAAsk"]
[Wed May 20 05:21:47.362785 2026] [:error] [pid 57774:tid 57825] [client 20.104.227.76:64459] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/load.php"] [unique_id "agzUa6zH4LWfnGU0RXC2ewAAAdY"]
[Wed May 20 05:21:47.799105 2026] [:error] [pid 57833:tid 57878] [client 20.104.227.76:64463] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/load.php"] [unique_id "agzUa7VqIe7Xlzcr5bagKgAAAk4"]
[Wed May 20 05:21:48.219904 2026] [:error] [pid 57834:tid 57903] [client 20.104.227.76:14972] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "agzUbHTOfwZ09EhqoYD6UgAAAow"]
[Wed May 20 05:21:48.660413 2026] [:error] [pid 59245:tid 59291] [client 20.104.227.76:14851] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "agzUbKOutR70QIZRVkTT1QAAAEs"]
[Wed May 20 05:21:49.085052 2026] [:error] [pid 57774:tid 57806] [client 20.104.227.76:14910] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "agzUbazH4LWfnGU0RXC2fAAAAcM"]
[Wed May 20 05:21:49.510438 2026] [:error] [pid 57774:tid 57807] [client 20.104.227.76:64490] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/166.php"] [unique_id "agzUbazH4LWfnGU0RXC2fQAAAcQ"]
[Wed May 20 05:21:49.928731 2026] [:error] [pid 57742:tid 57759] [client 20.104.227.76:14900] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test.php"] [unique_id "agzUbaQ_304u6rVT2w-iewAAAU8"]
[Wed May 20 05:21:50.351222 2026] [:error] [pid 57742:tid 57766] [client 20.104.227.76:55876] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test.php"] [unique_id "agzUbqQ_304u6rVT2w-ifQAAAVY"]
[Wed May 20 05:21:50.779231 2026] [:error] [pid 59245:tid 59303] [client 20.104.227.76:4115] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test.php"] [unique_id "agzUbqOutR70QIZRVkTT3AAAAFc"]
[Wed May 20 05:21:51.196316 2026] [:error] [pid 59244:tid 59273] [client 20.104.227.76:4142] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test.php"] [unique_id "agzUb7xU0SdQQE7pLs2xTwAAABQ"]
[Wed May 20 05:21:51.610793 2026] [:error] [pid 59244:tid 59253] [client 20.104.227.76:55903] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo/info.php"] [unique_id "agzUb7xU0SdQQE7pLs2xUQAAAAA"]
[Wed May 20 05:21:52.033304 2026] [:error] [pid 36145:tid 36151] [client 20.104.227.76:4195] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo/info.php"] [unique_id "agzUcKtS18KtvF2Vags6jwAAAQM"]
[Wed May 20 05:21:52.448377 2026] [:error] [pid 57742:tid 57764] [client 20.104.227.76:64494] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo/info.php"] [unique_id "agzUcKQ_304u6rVT2w-igAAAAVQ"]
[Wed May 20 05:21:52.890534 2026] [:error] [pid 57833:tid 57883] [client 20.104.227.76:64483] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/phpinfo/info.php"] [unique_id "agzUcLVqIe7Xlzcr5bagLQAAAlM"]
[Wed May 20 05:21:53.360459 2026] [:error] [pid 57835:tid 57938] [client 20.104.227.76:64462] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "agzUcWYoVRVVHvoOYbo9UgAAAtQ"]
[Wed May 20 05:21:53.899044 2026] [:error] [pid 59349:tid 59353] [client 20.104.227.76:14860] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "agzUcTvvxTUy-ppKSZWHjwAAAMI"]
[Wed May 20 05:21:54.314563 2026] [:error] [pid 57833:tid 57884] [client 20.104.227.76:64495] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "agzUcrVqIe7Xlzcr5bagLwAAAlQ"]
[Wed May 20 05:21:54.762675 2026] [:error] [pid 57833:tid 57885] [client 20.104.227.76:64479] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "agzUcrVqIe7Xlzcr5bagMQAAAlU"]
[Wed May 20 05:21:55.180514 2026] [:error] [pid 57832:tid 57848] [client 20.104.227.76:4184] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "agzUc0Nip5HpFD8GxxX2XAAAAgs"]
[Wed May 20 05:21:55.600853 2026] [:error] [pid 59244:tid 59267] [client 20.104.227.76:54061] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "agzUc7xU0SdQQE7pLs2xVAAAAA4"]
[Wed May 20 05:21:56.028192 2026] [:error] [pid 59349:tid 59352] [client 20.104.227.76:14913] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "agzUdDvvxTUy-ppKSZWHkwAAAME"]
[Wed May 20 05:21:56.445497 2026] [:error] [pid 59244:tid 59271] [client 20.104.227.76:14891] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/CDX2.php"] [unique_id "agzUdLxU0SdQQE7pLs2xVgAAABI"]
[Wed May 20 05:21:56.858309 2026] [:error] [pid 59245:tid 59296] [client 20.104.227.76:14905] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/profile.php"] [unique_id "agzUdKOutR70QIZRVkTT3gAAAFA"]
[Wed May 20 05:21:57.276509 2026] [:error] [pid 59244:tid 59260] [client 20.104.227.76:51599] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/profile.php"] [unique_id "agzUdbxU0SdQQE7pLs2xWgAAAAc"]
[Wed May 20 05:21:57.694383 2026] [:error] [pid 57774:tid 57810] [client 20.104.227.76:14961] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/profile.php"] [unique_id "agzUdazH4LWfnGU0RXC2ggAAAcc"]
[Wed May 20 05:21:58.116437 2026] [:error] [pid 59244:tid 59261] [client 20.104.227.76:51699] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/profile.php"] [unique_id "agzUdrxU0SdQQE7pLs2xXAAAAAg"]
[Wed May 20 05:21:58.530777 2026] [:error] [pid 59244:tid 59262] [client 20.104.227.76:55926] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "agzUdrxU0SdQQE7pLs2xXgAAAAk"]
[Wed May 20 05:21:58.966232 2026] [:error] [pid 59244:tid 59276] [client 20.104.227.76:55901] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "agzUdrxU0SdQQE7pLs2xXwAAABc"]
[Wed May 20 05:21:59.393202 2026] [:error] [pid 36145:tid 36152] [client 20.104.227.76:64485] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "agzUd6tS18KtvF2Vags6kgAAAQQ"]
[Wed May 20 05:21:59.833458 2026] [:error] [pid 59349:tid 59373] [client 20.104.227.76:64476] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ws80.php"] [unique_id "agzUdzvvxTUy-ppKSZWHnAAAANY"]
[Wed May 20 05:22:00.262413 2026] [:error] [pid 36145:tid 36161] [client 20.104.227.76:4124] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "agzUeKtS18KtvF2Vags6lQAAAQ0"]
[Wed May 20 05:22:00.694747 2026] [:error] [pid 36145:tid 36148] [client 20.104.227.76:53490] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "agzUeKtS18KtvF2Vags6mAAAAQA"]
[Wed May 20 05:22:01.120417 2026] [:error] [pid 59349:tid 59356] [client 20.104.227.76:4150] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "agzUeTvvxTUy-ppKSZWHnwAAAMU"]
[Wed May 20 05:22:01.539790 2026] [:error] [pid 57834:tid 57905] [client 20.104.227.76:64468] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a4.php"] [unique_id "agzUeXTOfwZ09EhqoYD6YAAAAo4"]
[Wed May 20 05:22:01.971619 2026] [:error] [pid 36145:tid 36156] [client 20.104.227.76:14938] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/app.php"] [unique_id "agzUeatS18KtvF2Vags6mQAAAQg"]
[Wed May 20 05:22:02.392557 2026] [:error] [pid 59349:tid 59364] [client 20.104.227.76:4143] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/app.php"] [unique_id "agzUejvvxTUy-ppKSZWHpQAAAM0"]
[Wed May 20 05:22:02.839846 2026] [:error] [pid 59244:tid 59266] [client 20.104.227.76:4196] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/app.php"] [unique_id "agzUerxU0SdQQE7pLs2xYwAAAA0"]
[Wed May 20 05:22:03.272980 2026] [:error] [pid 59349:tid 59354] [client 20.104.227.76:4109] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/app.php"] [unique_id "agzUezvvxTUy-ppKSZWHpgAAAMM"]
[Wed May 20 05:22:03.710606 2026] [:error] [pid 59349:tid 59357] [client 20.104.227.76:4161] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/buy.php"] [unique_id "agzUezvvxTUy-ppKSZWHpwAAAMY"]
[Wed May 20 05:22:04.135112 2026] [:error] [pid 57832:tid 57851] [client 20.104.227.76:54049] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/buy.php"] [unique_id "agzUfENip5HpFD8GxxX2XwAAAg4"]
[Wed May 20 05:22:04.558007 2026] [:error] [pid 57832:tid 57854] [client 20.104.227.76:14927] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/buy.php"] [unique_id "agzUfENip5HpFD8GxxX2YAAAAhE"]
[Wed May 20 05:22:04.988634 2026] [:error] [pid 59244:tid 59263] [client 20.104.227.76:14904] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/buy.php"] [unique_id "agzUfLxU0SdQQE7pLs2xaQAAAAo"]
[Wed May 20 05:22:05.408495 2026] [:error] [pid 59349:tid 59353] [client 20.104.227.76:14939] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/core.php"] [unique_id "agzUfTvvxTUy-ppKSZWHqQAAAMI"]
[Wed May 20 05:22:05.826816 2026] [:error] [pid 59349:tid 59358] [client 20.104.227.76:14912] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/core.php"] [unique_id "agzUfTvvxTUy-ppKSZWHqgAAAMc"]
[Wed May 20 05:22:06.260562 2026] [:error] [pid 59244:tid 59270] [client 20.104.227.76:53495] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/core.php"] [unique_id "agzUfrxU0SdQQE7pLs2xbgAAABE"]
[Wed May 20 05:22:06.706158 2026] [:error] [pid 59244:tid 59262] [client 20.104.227.76:4180] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/core.php"] [unique_id "agzUfrxU0SdQQE7pLs2xcAAAAAk"]
[Wed May 20 05:22:07.138768 2026] [:error] [pid 59244:tid 59275] [client 20.104.227.76:4211] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "agzUf7xU0SdQQE7pLs2xcgAAABY"]
[Wed May 20 05:22:07.554859 2026] [:error] [pid 59244:tid 59257] [client 20.104.227.76:14933] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "agzUf7xU0SdQQE7pLs2xcwAAAAQ"]
[Wed May 20 05:22:07.970399 2026] [:error] [pid 59244:tid 59255] [client 20.104.227.76:53468] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "agzUf7xU0SdQQE7pLs2xdAAAAAI"]
[Wed May 20 05:22:08.391571 2026] [:error] [pid 59349:tid 59359] [client 20.104.227.76:4116] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/lock360.php"] [unique_id "agzUgDvvxTUy-ppKSZWHrQAAAMg"]
[Wed May 20 05:22:08.864898 2026] [:error] [pid 59244:tid 59269] [client 20.104.227.76:51682] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "agzUgLxU0SdQQE7pLs2xdgAAABA"]
[Wed May 20 05:22:09.282109 2026] [:error] [pid 57834:tid 57912] [client 20.104.227.76:14962] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "agzUgXTOfwZ09EhqoYD6ZAAAApU"]
[Wed May 20 05:22:09.702772 2026] [:error] [pid 57834:tid 57904] [client 20.104.227.76:4120] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "agzUgXTOfwZ09EhqoYD6ZgAAAo0"]
[Wed May 20 05:22:10.127726 2026] [:error] [pid 57834:tid 57914] [client 20.104.227.76:55881] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bc.php"] [unique_id "agzUgnTOfwZ09EhqoYD6ZwAAApc"]
[Wed May 20 05:22:10.542187 2026] [:error] [pid 57834:tid 57895] [client 20.104.227.76:14865] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "agzUgnTOfwZ09EhqoYD6agAAAoQ"]
[Wed May 20 05:22:10.976747 2026] [:error] [pid 59349:tid 59373] [client 20.104.227.76:55892] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "agzUgjvvxTUy-ppKSZWHrwAAANY"]
[Wed May 20 05:22:11.399287 2026] [:error] [pid 57835:tid 57918] [client 20.104.227.76:64493] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "agzUg2YoVRVVHvoOYbo9UwAAAsA"]
[Wed May 20 05:22:11.814667 2026] [:error] [pid 59349:tid 59369] [client 20.104.227.76:4111] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "agzUgzvvxTUy-ppKSZWHsAAAANI"]
[Wed May 20 05:22:12.293833 2026] [:error] [pid 57832:tid 57839] [client 20.104.227.76:4185] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "agzUhENip5HpFD8GxxX2ZQAAAgI"]
[Wed May 20 05:22:12.740758 2026] [:error] [pid 57833:tid 57888] [client 20.104.227.76:14953] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "agzUhLVqIe7Xlzcr5bagNwAAAlg"]
[Wed May 20 05:22:13.188617 2026] [:error] [pid 59245:tid 59302] [client 20.104.227.76:14970] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "agzUhaOutR70QIZRVkTT3wAAAFY"]
[Wed May 20 05:22:13.663215 2026] [:error] [pid 59244:tid 59263] [client 20.104.227.76:4200] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/casp1.php"] [unique_id "agzUhbxU0SdQQE7pLs2xeQAAAAo"]
[Wed May 20 05:22:14.128572 2026] [:error] [pid 36145:tid 36165] [client 20.104.227.76:4129] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "agzUhqtS18KtvF2Vags6ngAAARE"]
[Wed May 20 05:22:14.684042 2026] [:error] [pid 59244:tid 59258] [client 20.104.227.76:64491] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "agzUhrxU0SdQQE7pLs2xewAAAAU"]
[Wed May 20 05:22:15.199822 2026] [:error] [pid 57835:tid 57940] [client 20.104.227.76:4131] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "agzUh2YoVRVVHvoOYbo9VQAAAtY"]
[Wed May 20 05:22:15.724644 2026] [:error] [pid 57835:tid 57941] [client 20.104.227.76:55879] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file6.php"] [unique_id "agzUh2YoVRVVHvoOYbo9VgAAAtc"]
[Wed May 20 05:22:16.477270 2026] [:error] [pid 36145:tid 36158] [client 20.104.227.76:4099] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xs.php"] [unique_id "agzUiKtS18KtvF2Vags6ogAAAQo"]
[Wed May 20 05:22:17.158285 2026] [:error] [pid 59349:tid 59352] [client 20.104.227.76:4156] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xs.php"] [unique_id "agzUiTvvxTUy-ppKSZWHswAAAME"]
[Wed May 20 05:22:21.040690 2026] [:error] [pid 59349:tid 59374] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Wed May 20 05:22:21.260774 2026] [:error] [pid 59349:tid 59358] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/xxa.php
[Wed May 20 05:22:21.475064 2026] [:error] [pid 59349:tid 59355] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/index0.php
[Wed May 20 05:22:21.688552 2026] [:error] [pid 59349:tid 59351] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kz.php
[Wed May 20 05:22:21.914252 2026] [:error] [pid 59349:tid 59372] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/19.php
[Wed May 20 05:22:22.259361 2026] [:error] [pid 59349:tid 59359] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Wed May 20 05:22:22.576996 2026] [:error] [pid 59349:tid 59375] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Wed May 20 05:22:22.808504 2026] [:error] [pid 59349:tid 59370] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Wed May 20 05:22:23.019843 2026] [:error] [pid 59349:tid 59369] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Wed May 20 05:22:23.383797 2026] [:error] [pid 59349:tid 59368] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Wed May 20 05:22:23.596172 2026] [:error] [pid 59349:tid 59356] [client 20.104.227.76:55875] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Wed May 20 05:22:24.274317 2026] [:error] [pid 59349:tid 59352] [client 20.104.227.76:55875] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "agzUkDvvxTUy-ppKSZWHxgAAAME"]
[Wed May 20 05:22:25.478973 2026] [:error] [pid 59245:tid 59293] [client 20.104.227.76:64452] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "agzUkaOutR70QIZRVkTT5AAAAE0"]
[Wed May 20 05:22:26.191622 2026] [:error] [pid 59244:tid 59272] [client 20.104.227.76:4206] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "agzUkrxU0SdQQE7pLs2xggAAABM"]
[Wed May 20 05:22:26.957067 2026] [:error] [pid 59349:tid 59367] [client 20.104.227.76:4100] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "agzUkjvvxTUy-ppKSZWHyAAAANA"]
[Wed May 20 05:22:27.598587 2026] [:error] [pid 59244:tid 59273] [client 20.104.227.76:64465] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/d.php"] [unique_id "agzUk7xU0SdQQE7pLs2xgwAAABQ"]
[Wed May 20 05:22:28.065689 2026] [:error] [pid 57835:tid 57927] [client 20.104.227.76:4159] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/d.php"] [unique_id "agzUlGYoVRVVHvoOYbo9agAAAsk"]
[Wed May 20 05:22:28.521864 2026] [:error] [pid 59245:tid 59283] [client 20.104.227.76:4152] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/d.php"] [unique_id "agzUlKOutR70QIZRVkTT5QAAAEM"]
[Wed May 20 05:22:28.960991 2026] [:error] [pid 36145:tid 36159] [client 20.104.227.76:4139] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/d.php"] [unique_id "agzUlKtS18KtvF2Vags6qAAAAQs"]
[Wed May 20 05:22:29.380446 2026] [:error] [pid 59244:tid 59266] [client 20.104.227.76:4154] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "agzUlbxU0SdQQE7pLs2xhgAAAA0"]
[Wed May 20 05:22:29.804894 2026] [:error] [pid 59245:tid 59300] [client 20.104.227.76:14964] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "agzUlaOutR70QIZRVkTT5gAAAFQ"]
[Wed May 20 05:22:30.273660 2026] [:error] [pid 57835:tid 57932] [client 20.104.227.76:64470] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "agzUlmYoVRVVHvoOYbo9awAAAs4"]
[Wed May 20 05:22:30.717023 2026] [:error] [pid 59245:tid 59291] [client 20.104.227.76:55880] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xff.php"] [unique_id "agzUlqOutR70QIZRVkTT6AAAAEs"]
[Wed May 20 05:22:31.183658 2026] [:error] [pid 57835:tid 57928] [client 20.104.227.76:64486] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "agzUl2YoVRVVHvoOYbo9bAAAAso"]
[Wed May 20 05:22:31.788607 2026] [:error] [pid 57835:tid 57935] [client 20.104.227.76:53445] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "agzUl2YoVRVVHvoOYbo9bgAAAtE"]
[Wed May 20 05:22:32.209200 2026] [:error] [pid 57835:tid 57936] [client 20.104.227.76:14870] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "agzUmGYoVRVVHvoOYbo9cAAAAtI"]
[Wed May 20 05:22:32.655809 2026] [:error] [pid 57835:tid 57939] [client 20.104.227.76:14951] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "agzUmGYoVRVVHvoOYbo9cgAAAtU"]
[Wed May 20 05:22:33.138115 2026] [:error] [pid 59244:tid 59254] [client 20.104.227.76:14868] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "agzUmbxU0SdQQE7pLs2xigAAAAE"]
[Wed May 20 05:22:33.570396 2026] [:error] [pid 59244:tid 59258] [client 20.104.227.76:51632] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "agzUmbxU0SdQQE7pLs2xiwAAAAU"]
[Wed May 20 05:22:34.046489 2026] [:error] [pid 59349:tid 59361] [client 20.104.227.76:64466] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "agzUmjvvxTUy-ppKSZWHywAAAMo"]
[Wed May 20 05:22:34.493725 2026] [:error] [pid 57834:tid 57904] [client 20.104.227.76:4193] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xltt.php"] [unique_id "agzUmnTOfwZ09EhqoYD6cwAAAo0"]
[Wed May 20 05:22:34.964553 2026] [:error] [pid 57835:tid 57918] [client 20.104.227.76:64450] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/son.php"] [unique_id "agzUmmYoVRVVHvoOYbo9cwAAAsA"]
[Wed May 20 05:22:35.407954 2026] [:error] [pid 59349:tid 59365] [client 20.104.227.76:4140] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/son.php"] [unique_id "agzUmzvvxTUy-ppKSZWHzQAAAM4"]
[Wed May 20 05:22:35.892297 2026] [:error] [pid 57742:tid 57753] [client 20.104.227.76:4182] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/son.php"] [unique_id "agzUm6Q_304u6rVT2w-iigAAAUk"]
[Wed May 20 05:22:36.384657 2026] [:error] [pid 57835:tid 57941] [client 20.104.227.76:14967] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/son.php"] [unique_id "agzUnGYoVRVVHvoOYbo9dQAAAtc"]
[Wed May 20 05:22:36.966349 2026] [:error] [pid 59244:tid 59270] [client 20.104.227.76:4108] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/doc.php"] [unique_id "agzUnLxU0SdQQE7pLs2xjwAAABE"]
[Wed May 20 05:22:37.390097 2026] [:error] [pid 59244:tid 59262] [client 20.104.227.76:53443] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/doc.php"] [unique_id "agzUnbxU0SdQQE7pLs2xkQAAAAk"]
[Wed May 20 05:22:37.806387 2026] [:error] [pid 57742:tid 57757] [client 20.104.227.76:55882] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/doc.php"] [unique_id "agzUnaQ_304u6rVT2w-ijAAAAU0"]
[Wed May 20 05:22:38.289369 2026] [:error] [pid 36145:tid 36154] [client 20.104.227.76:53440] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/doc.php"] [unique_id "agzUnqtS18KtvF2Vags6qgAAAQY"]
[Wed May 20 05:22:38.795106 2026] [:error] [pid 36145:tid 36171] [client 20.104.227.76:55889] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zo.php"] [unique_id "agzUnqtS18KtvF2Vags6rQAAARc"]
[Wed May 20 05:22:39.219787 2026] [:error] [pid 57833:tid 57873] [client 20.104.227.76:64508] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zo.php"] [unique_id "agzUn7VqIe7Xlzcr5bagOgAAAkk"]
[Wed May 20 05:22:39.682154 2026] [:error] [pid 57742:tid 57760] [client 20.104.227.76:4199] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zo.php"] [unique_id "agzUn6Q_304u6rVT2w-ijwAAAVA"]
[Wed May 20 05:22:40.176922 2026] [:error] [pid 59245:tid 59298] [client 20.104.227.76:4121] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zo.php"] [unique_id "agzUoKOutR70QIZRVkTT6gAAAFI"]
[Wed May 20 05:22:40.755078 2026] [:error] [pid 59245:tid 59285] [client 20.104.227.76:4147] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "agzUoKOutR70QIZRVkTT6wAAAEU"]
[Wed May 20 05:22:41.824813 2026] [:error] [pid 59245:tid 59281] [client 20.104.227.76:55897] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "agzUoaOutR70QIZRVkTT7QAAAEE"]
[Wed May 20 05:22:42.442864 2026] [:error] [pid 57742:tid 57761] [client 20.104.227.76:14875] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "agzUoqQ_304u6rVT2w-ikwAAAVE"]
[Wed May 20 05:22:43.299463 2026] [:error] [pid 57835:tid 57920] [client 20.104.227.76:54030] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/xper1.php"] [unique_id "agzUo2YoVRVVHvoOYbo9dwAAAsI"]
[Wed May 20 05:22:44.510964 2026] [:error] [pid 57835:tid 57925] [client 20.104.227.76:4221] [client 20.104.227.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tiny.php"] [unique_id "agzUpGYoVRVVHvoOYbo9eQAAAsc"]
[Wed May 20 05:22:45.039335 2026] [:error] [pid 57835:tid 57923] [client 20.104.227.76:55910] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "agzUpWYoVRVVHvoOYbo9ewAAAsU"]
[Wed May 20 05:22:45.788977 2026] [:error] [pid 57832:tid 57858] [client 20.104.227.76:14887] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "agzUpUNip5HpFD8GxxX2cQAAAhU"]
[Wed May 20 05:22:46.215884 2026] [:error] [pid 36145:tid 36153] [client 20.104.227.76:14959] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "agzUpqtS18KtvF2Vags6sQAAAQU"]
[Wed May 20 05:22:46.659931 2026] [:error] [pid 59245:tid 59294] [client 20.104.227.76:64500] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/s1.php"] [unique_id "agzUpqOutR70QIZRVkTT7wAAAE4"]
[Wed May 20 05:22:47.168770 2026] [:error] [pid 59245:tid 59296] [client 20.104.227.76:4213] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "agzUp6OutR70QIZRVkTT8AAAAFA"]
[Wed May 20 05:22:47.992790 2026] [:error] [pid 57774:tid 57820] [client 20.104.227.76:51661] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "agzUp6zH4LWfnGU0RXC2hQAAAdE"]
[Wed May 20 05:22:48.807993 2026] [:error] [pid 57833:tid 57882] [client 20.104.227.76:53462] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "agzUqLVqIe7Xlzcr5bagQAAAAlI"]
[Wed May 20 05:22:49.660067 2026] [:error] [pid 57774:tid 57819] [client 20.104.227.76:14955] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/de.php"] [unique_id "agzUqazH4LWfnGU0RXC2hwAAAdA"]
[Wed May 20 05:22:50.685526 2026] [:error] [pid 57832:tid 57837] [client 20.104.227.76:4187] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1a.php"] [unique_id "agzUqkNip5HpFD8GxxX2fAAAAgA"]
[Wed May 20 05:22:51.169887 2026] [:error] [pid 57833:tid 57866] [client 20.104.227.76:4201] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1a.php"] [unique_id "agzUq7VqIe7Xlzcr5bagQgAAAkI"]
[Wed May 20 05:22:51.693103 2026] [:error] [pid 59244:tid 59272] [client 20.104.227.76:51595] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1a.php"] [unique_id "agzUq7xU0SdQQE7pLs2xkgAAABM"]
[Wed May 20 05:22:52.182983 2026] [:error] [pid 36145:tid 36162] [client 20.104.227.76:53452] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/1a.php"] [unique_id "agzUrKtS18KtvF2Vags6swAAAQ4"]
[Wed May 20 05:22:52.612193 2026] [:error] [pid 36145:tid 36163] [client 20.104.227.76:55877] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "agzUrKtS18KtvF2Vags6tAAAAQ8"]
[Wed May 20 05:22:53.128470 2026] [:error] [pid 36145:tid 36159] [client 20.104.227.76:4198] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "agzUratS18KtvF2Vags6tgAAAQs"]
[Wed May 20 05:22:53.557461 2026] [:error] [pid 59245:tid 59299] [client 20.104.227.76:14934] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "agzUraOutR70QIZRVkTT9AAAAFM"]
[Wed May 20 05:22:53.979048 2026] [:error] [pid 36145:tid 36166] [client 20.104.227.76:4107] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/2.php"] [unique_id "agzUratS18KtvF2Vags6uAAAARI"]
[Wed May 20 05:22:54.519088 2026] [:error] [pid 36145:tid 36172] [client 20.104.227.76:53469] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "agzUrqtS18KtvF2Vags6uQAAARg"]
[Wed May 20 05:22:54.958209 2026] [:error] [pid 59349:tid 59367] [client 20.104.227.76:51668] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "agzUrjvvxTUy-ppKSZWH2gAAANA"]
[Wed May 20 05:22:55.414327 2026] [:error] [pid 57833:tid 57888] [client 20.104.227.76:4176] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "agzUr7VqIe7Xlzcr5bagRAAAAlg"]
[Wed May 20 05:22:55.842709 2026] [:error] [pid 57833:tid 57867] [client 20.104.227.76:14937] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "agzUr7VqIe7Xlzcr5bagRQAAAkM"]
[Wed May 20 05:22:56.280017 2026] [:error] [pid 57833:tid 57870] [client 20.104.227.76:4174] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "agzUsLVqIe7Xlzcr5bagSAAAAkY"]
[Wed May 20 05:22:56.698484 2026] [:error] [pid 57774:tid 57806] [client 20.104.227.76:14940] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "agzUsKzH4LWfnGU0RXC2igAAAcM"]
[Wed May 20 05:22:57.230673 2026] [:error] [pid 57833:tid 57872] [client 20.104.227.76:51616] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "agzUsbVqIe7Xlzcr5bagSgAAAkg"]
[Wed May 20 05:22:57.668531 2026] [:error] [pid 57834:tid 57914] [client 20.104.227.76:55896] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sky.php"] [unique_id "agzUsXTOfwZ09EhqoYD6dAAAApc"]
[Wed May 20 05:22:58.159062 2026] [:error] [pid 57835:tid 57942] [client 20.104.227.76:55923] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "agzUsmYoVRVVHvoOYbo9hAAAAtg"]
[Wed May 20 05:22:58.590358 2026] [:error] [pid 57832:tid 57851] [client 20.104.227.76:64478] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "agzUskNip5HpFD8GxxX2fQAAAg4"]
[Wed May 20 05:22:59.031020 2026] [:error] [pid 57834:tid 57915] [client 20.104.227.76:64472] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "agzUs3TOfwZ09EhqoYD6dQAAApg"]
[Wed May 20 05:22:59.599019 2026] [:error] [pid 57834:tid 57911] [client 20.104.227.76:64477] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/man.php"] [unique_id "agzUs3TOfwZ09EhqoYD6dgAAApQ"]
[Wed May 20 05:23:00.048543 2026] [:error] [pid 57833:tid 57875] [client 20.104.227.76:54020] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "agzUtLVqIe7Xlzcr5bagSwAAAks"]
[Wed May 20 05:23:00.502934 2026] [:error] [pid 57833:tid 57876] [client 20.104.227.76:4207] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "agzUtLVqIe7Xlzcr5bagTAAAAkw"]
[Wed May 20 05:23:00.955372 2026] [:error] [pid 57834:tid 57910] [client 20.104.227.76:4163] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "agzUtHTOfwZ09EhqoYD6eAAAApM"]
[Wed May 20 05:23:01.390113 2026] [:error] [pid 57742:tid 57747] [client 20.104.227.76:14936] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ms-edit.php"] [unique_id "agzUtaQ_304u6rVT2w-ilAAAAUM"]
[Wed May 20 05:23:01.822859 2026] [:error] [pid 59244:tid 59256] [client 20.104.227.76:55920] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "agzUtbxU0SdQQE7pLs2xlwAAAAM"]
[Wed May 20 05:23:02.240266 2026] [:error] [pid 57834:tid 57893] [client 20.104.227.76:54079] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "agzUtnTOfwZ09EhqoYD6egAAAoI"]
[Wed May 20 05:23:02.702696 2026] [:error] [pid 59244:tid 59258] [client 20.104.227.76:4123] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "agzUtrxU0SdQQE7pLs2xmgAAAAU"]
[Wed May 20 05:23:03.118145 2026] [:error] [pid 59244:tid 59275] [client 20.104.227.76:14928] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/7.php"] [unique_id "agzUt7xU0SdQQE7pLs2xmwAAABY"]
[Wed May 20 05:23:03.535228 2026] [:error] [pid 57774:tid 57805] [client 20.104.227.76:4218] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pp.php"] [unique_id "agzUt6zH4LWfnGU0RXC2kAAAAcI"]
[Wed May 20 05:23:03.971852 2026] [:error] [pid 57742:tid 57749] [client 20.104.227.76:14866] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pp.php"] [unique_id "agzUt6Q_304u6rVT2w-ilgAAAUU"]
[Wed May 20 05:23:04.409928 2026] [:error] [pid 57834:tid 57902] [client 20.104.227.76:4138] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pp.php"] [unique_id "agzUuHTOfwZ09EhqoYD6fwAAAos"]
[Wed May 20 05:23:04.837468 2026] [:error] [pid 57834:tid 57909] [client 20.104.227.76:4125] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/pp.php"] [unique_id "agzUuHTOfwZ09EhqoYD6ggAAApI"]
[Wed May 20 05:23:05.266202 2026] [:error] [pid 57834:tid 57908] [client 20.104.227.76:55934] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mar.php"] [unique_id "agzUuXTOfwZ09EhqoYD6hAAAApE"]
[Wed May 20 05:23:05.692849 2026] [:error] [pid 57742:tid 57752] [client 20.104.227.76:4189] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mar.php"] [unique_id "agzUuaQ_304u6rVT2w-ilwAAAUg"]
[Wed May 20 05:23:06.118652 2026] [:error] [pid 36145:tid 36149] [client 20.104.227.76:14935] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mar.php"] [unique_id "agzUuqtS18KtvF2Vags6vAAAAQE"]
[Wed May 20 05:23:06.547091 2026] [:error] [pid 57834:tid 57910] [client 20.104.227.76:55932] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mar.php"] [unique_id "agzUunTOfwZ09EhqoYD6hgAAApM"]
[Wed May 20 05:23:06.962119 2026] [:error] [pid 57742:tid 57768] [client 20.104.227.76:4191] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "agzUuqQ_304u6rVT2w-imAAAAVg"]
[Wed May 20 05:23:07.402871 2026] [:error] [pid 59245:tid 59286] [client 20.104.227.76:55891] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "agzUu6OutR70QIZRVkTT-wAAAEY"]
[Wed May 20 05:23:07.826024 2026] [:error] [pid 57834:tid 57891] [client 20.104.227.76:54070] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "agzUu3TOfwZ09EhqoYD6iAAAAoA"]
[Wed May 20 05:23:08.244780 2026] [:error] [pid 36145:tid 36152] [client 20.104.227.76:51649] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "agzUvKtS18KtvF2Vags6wAAAAQQ"]
[Wed May 20 05:23:08.686719 2026] [:error] [pid 57832:tid 57852] [client 20.104.227.76:14884] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "agzUvENip5HpFD8GxxX2ggAAAg8"]
[Wed May 20 05:23:09.104108 2026] [:error] [pid 36145:tid 36161] [client 20.104.227.76:54045] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "agzUvatS18KtvF2Vags6wgAAAQ0"]
[Wed May 20 05:23:09.532895 2026] [:error] [pid 57835:tid 57920] [client 20.104.227.76:4220] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "agzUvWYoVRVVHvoOYbo9iAAAAsI"]
[Wed May 20 05:23:09.971369 2026] [:error] [pid 59244:tid 59264] [client 20.104.227.76:53489] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/acp.php"] [unique_id "agzUvbxU0SdQQE7pLs2xpAAAAAs"]
[Wed May 20 05:23:10.388192 2026] [:error] [pid 57832:tid 57838] [client 20.104.227.76:64509] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zdd.php"] [unique_id "agzUvkNip5HpFD8GxxX2hwAAAgE"]
[Wed May 20 05:23:10.858411 2026] [:error] [pid 57834:tid 57899] [client 20.104.227.76:4144] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zdd.php"] [unique_id "agzUvnTOfwZ09EhqoYD6igAAAog"]
[Wed May 20 05:23:11.280322 2026] [:error] [pid 57834:tid 57901] [client 20.104.227.76:54059] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zdd.php"] [unique_id "agzUv3TOfwZ09EhqoYD6iwAAAoo"]
[Wed May 20 05:23:11.746090 2026] [:error] [pid 57833:tid 57888] [client 20.104.227.76:4178] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/zdd.php"] [unique_id "agzUv7VqIe7Xlzcr5bagVAAAAlg"]
[Wed May 20 05:23:12.164626 2026] [:error] [pid 57832:tid 57842] [client 20.104.227.76:14876] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "agzUwENip5HpFD8GxxX2iQAAAgU"]
[Wed May 20 05:23:12.583890 2026] [:error] [pid 57835:tid 57926] [client 20.104.227.76:4135] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "agzUwGYoVRVVHvoOYbo9iQAAAsg"]
[Wed May 20 05:23:13.004729 2026] [:error] [pid 59349:tid 59374] [client 20.104.227.76:4186] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "agzUwTvvxTUy-ppKSZWH4gAAANc"]
[Wed May 20 05:23:13.422113 2026] [:error] [pid 57834:tid 57902] [client 20.104.227.76:4127] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/link.php"] [unique_id "agzUwXTOfwZ09EhqoYD6jQAAAos"]
[Wed May 20 05:23:13.865726 2026] [:error] [pid 57834:tid 57903] [client 20.104.227.76:14973] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sallu.php"] [unique_id "agzUwXTOfwZ09EhqoYD6jgAAAow"]
[Wed May 20 05:23:14.288802 2026] [:error] [pid 57834:tid 57905] [client 20.104.227.76:4148] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sallu.php"] [unique_id "agzUwnTOfwZ09EhqoYD6kQAAAo4"]
[Wed May 20 05:23:14.707464 2026] [:error] [pid 57834:tid 57909] [client 20.104.227.76:49362] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sallu.php"] [unique_id "agzUwnTOfwZ09EhqoYD6kgAAApI"]
[Wed May 20 05:23:15.140154 2026] [:error] [pid 59244:tid 59257] [client 20.104.227.76:53460] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sallu.php"] [unique_id "agzUw7xU0SdQQE7pLs2xpgAAAAQ"]
[Wed May 20 05:23:15.563682 2026] [:error] [pid 59244:tid 59253] [client 20.104.227.76:51666] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "agzUw7xU0SdQQE7pLs2xqAAAAAA"]
[Wed May 20 05:23:15.979727 2026] [:error] [pid 59244:tid 59259] [client 20.104.227.76:55906] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "agzUw7xU0SdQQE7pLs2xqQAAAAY"]
[Wed May 20 05:23:16.404427 2026] [:error] [pid 59245:tid 59294] [client 20.104.227.76:49850] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "agzUxKOutR70QIZRVkTT_QAAAE4"]
[Wed May 20 05:23:16.828720 2026] [:error] [pid 36145:tid 36168] [client 20.104.227.76:4122] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aboute.php"] [unique_id "agzUxKtS18KtvF2Vags6xgAAARQ"]
[Wed May 20 05:23:17.250059 2026] [:error] [pid 59244:tid 59256] [client 20.104.227.76:64492] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "agzUxbxU0SdQQE7pLs2xrAAAAAM"]
[Wed May 20 05:23:17.686275 2026] [:error] [pid 59244:tid 59258] [client 20.104.227.76:54041] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "agzUxbxU0SdQQE7pLs2xrgAAAAU"]
[Wed May 20 05:23:18.105862 2026] [:error] [pid 57833:tid 57872] [client 20.104.227.76:64487] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "agzUxrVqIe7Xlzcr5bagZAAAAkg"]
[Wed May 20 05:23:18.520932 2026] [:error] [pid 57835:tid 57929] [client 20.104.227.76:55899] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ayk.php"] [unique_id "agzUxmYoVRVVHvoOYbo9iwAAAss"]
[Wed May 20 05:23:18.974462 2026] [:error] [pid 57774:tid 57819] [client 20.104.227.76:14911] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "agzUxqzH4LWfnGU0RXC2lgAAAdA"]
[Wed May 20 05:23:19.403587 2026] [:error] [pid 59244:tid 59265] [client 20.104.227.76:53471] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "agzUx7xU0SdQQE7pLs2xsgAAAAw"]
[Wed May 20 05:23:19.856226 2026] [:error] [pid 36145:tid 36172] [client 20.104.227.76:54022] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "agzUx6tS18KtvF2Vags6yQAAARg"]
[Wed May 20 05:23:20.280808 2026] [:error] [pid 59349:tid 59372] [client 20.104.227.76:64484] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "agzUyDvvxTUy-ppKSZWH4wAAANU"]
[Wed May 20 05:23:20.710009 2026] [:error] [pid 59244:tid 59262] [client 20.104.227.76:55890] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "agzUyLxU0SdQQE7pLs2xtQAAAAk"]
[Wed May 20 05:23:21.133685 2026] [:error] [pid 59349:tid 59356] [client 20.104.227.76:64510] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "agzUyTvvxTUy-ppKSZWH6gAAAMU"]
[Wed May 20 05:23:21.552128 2026] [:error] [pid 36145:tid 36150] [client 20.104.227.76:4209] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "agzUyatS18KtvF2Vags6zQAAAQI"]
[Wed May 20 05:23:21.998794 2026] [:error] [pid 36145:tid 36151] [client 20.104.227.76:53446] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/tx79.php"] [unique_id "agzUyatS18KtvF2Vags60AAAAQM"]
[Wed May 20 05:23:22.445205 2026] [:error] [pid 59244:tid 59276] [client 20.104.227.76:14856] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "agzUyrxU0SdQQE7pLs2xtwAAABc"]
[Wed May 20 05:23:22.894321 2026] [:error] [pid 59244:tid 59255] [client 20.104.227.76:54050] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-class.php"] [unique_id "agzUyrxU0SdQQE7pLs2xugAAAAI"]
[Wed May 20 05:23:23.325603 2026] [:error] [pid 59349:tid 59363] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed May 20 05:23:23.537396 2026] [:error] [pid 59349:tid 59374] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Wed May 20 05:23:23.748046 2026] [:error] [pid 59349:tid 59366] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/options.php
[Wed May 20 05:23:23.958825 2026] [:error] [pid 59349:tid 59355] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php
[Wed May 20 05:23:24.168811 2026] [:error] [pid 59349:tid 59359] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Wed May 20 05:23:24.380143 2026] [:error] [pid 59349:tid 59372] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Wed May 20 05:23:24.591025 2026] [:error] [pid 59349:tid 59369] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/ggb.php
[Wed May 20 05:23:24.803192 2026] [:error] [pid 59349:tid 59373] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/amxloxxr.php
[Wed May 20 05:23:25.014187 2026] [:error] [pid 59349:tid 59368] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Wed May 20 05:23:25.239120 2026] [:error] [pid 59349:tid 59356] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Wed May 20 05:23:25.470481 2026] [:error] [pid 59349:tid 59352] [client 20.104.227.76:4162] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Wed May 20 05:23:25.678635 2026] [:error] [pid 59349:tid 59364] [client 20.104.227.76:4162] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/99.php"] [unique_id "agzUzTvvxTUy-ppKSZWH_QAAAM0"]
[Wed May 20 05:23:26.200784 2026] [:error] [pid 59245:tid 59304] [client 20.104.227.76:64467] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/99.php"] [unique_id "agzUzqOutR70QIZRVkTUAwAAAFg"]
[Wed May 20 05:23:26.701292 2026] [:error] [pid 57742:tid 57756] [client 20.104.227.76:14963] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/99.php"] [unique_id "agzUzqQ_304u6rVT2w-inAAAAUw"]
[Wed May 20 05:23:27.148556 2026] [:error] [pid 57774:tid 57807] [client 20.104.227.76:55907] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/99.php"] [unique_id "agzUz6zH4LWfnGU0RXC2mgAAAcQ"]
[Wed May 20 05:23:27.570715 2026] [:error] [pid 57774:tid 57808] [client 20.104.227.76:14890] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/layout.php"] [unique_id "agzUz6zH4LWfnGU0RXC2mwAAAcU"]
[Wed May 20 05:23:28.008305 2026] [:error] [pid 59349:tid 59356] [client 20.104.227.76:53481] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/layout.php"] [unique_id "agzU0DvvxTUy-ppKSZWIBwAAAMU"]
[Wed May 20 05:23:28.442003 2026] [:error] [pid 36145:tid 36171] [client 20.104.227.76:4126] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/layout.php"] [unique_id "agzU0KtS18KtvF2Vags61AAAARc"]
[Wed May 20 05:23:28.861216 2026] [:error] [pid 57835:tid 57942] [client 20.104.227.76:14852] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/layout.php"] [unique_id "agzU0GYoVRVVHvoOYbo9kwAAAtg"]
[Wed May 20 05:23:29.300284 2026] [:error] [pid 57835:tid 57941] [client 20.104.227.76:53500] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "agzU0WYoVRVVHvoOYbo9lAAAAtc"]
[Wed May 20 05:23:29.720646 2026] [:error] [pid 59244:tid 59268] [client 20.104.227.76:53466] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "agzU0bxU0SdQQE7pLs2xywAAAA8"]
[Wed May 20 05:23:30.156703 2026] [:error] [pid 59244:tid 59276] [client 20.104.227.76:64507] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "agzU0rxU0SdQQE7pLs2xzgAAABc"]
[Wed May 20 05:23:30.576624 2026] [:error] [pid 59349:tid 59371] [client 20.104.227.76:51692] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/12.php"] [unique_id "agzU0jvvxTUy-ppKSZWICAAAANQ"]
[Wed May 20 05:23:31.010900 2026] [:error] [pid 59349:tid 59375] [client 20.104.227.76:4112] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "agzU0zvvxTUy-ppKSZWICgAAANg"]
[Wed May 20 05:23:31.427708 2026] [:error] [pid 59244:tid 59273] [client 20.104.227.76:14869] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "agzU07xU0SdQQE7pLs2x0gAAABQ"]
[Wed May 20 05:23:31.845166 2026] [:error] [pid 57835:tid 57940] [client 20.104.227.76:51641] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "agzU02YoVRVVHvoOYbo9lQAAAtY"]
[Wed May 20 05:23:32.267315 2026] [:error] [pid 36145:tid 36154] [client 20.104.227.76:14882] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fs.php"] [unique_id "agzU1KtS18KtvF2Vags61gAAAQY"]
[Wed May 20 05:23:32.693348 2026] [:error] [pid 59349:tid 59366] [client 20.104.227.76:4190] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "agzU1DvvxTUy-ppKSZWIDgAAAM8"]
[Wed May 20 05:23:33.111653 2026] [:error] [pid 59349:tid 59355] [client 20.104.227.76:64489] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "agzU1TvvxTUy-ppKSZWIDwAAAMQ"]
[Wed May 20 05:23:33.545548 2026] [:error] [pid 59349:tid 59359] [client 20.104.227.76:64457] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "agzU1TvvxTUy-ppKSZWIEAAAAMg"]
[Wed May 20 05:23:33.973998 2026] [:error] [pid 36145:tid 36158] [client 20.104.227.76:55888] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/aaa.php"] [unique_id "agzU1atS18KtvF2Vags62AAAAQo"]
[Wed May 20 05:23:34.399358 2026] [:error] [pid 59244:tid 59253] [client 20.104.227.76:64453] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Ov-Simple1.php"] [unique_id "agzU1rxU0SdQQE7pLs2x1AAAAAA"]
[Wed May 20 05:23:34.818377 2026] [:error] [pid 59244:tid 59264] [client 20.104.227.76:51592] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Ov-Simple1.php"] [unique_id "agzU1rxU0SdQQE7pLs2x1QAAAAs"]
[Wed May 20 05:23:35.250307 2026] [:error] [pid 59244:tid 59266] [client 20.104.227.76:14917] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Ov-Simple1.php"] [unique_id "agzU17xU0SdQQE7pLs2x1gAAAA0"]
[Wed May 20 05:23:35.670438 2026] [:error] [pid 57835:tid 57932] [client 20.104.227.76:14924] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/Ov-Simple1.php"] [unique_id "agzU12YoVRVVHvoOYbo9lgAAAs4"]
[Wed May 20 05:23:36.104959 2026] [:error] [pid 36145:tid 36148] [client 20.104.227.76:14898] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "agzU2KtS18KtvF2Vags63QAAAQA"]
[Wed May 20 05:23:36.553069 2026] [:error] [pid 57835:tid 57921] [client 20.104.227.76:54066] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "agzU2GYoVRVVHvoOYbo9lwAAAsM"]
[Wed May 20 05:23:36.968511 2026] [:error] [pid 59244:tid 59275] [client 20.104.227.76:51655] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "agzU2LxU0SdQQE7pLs2x2gAAABY"]
[Wed May 20 05:23:37.385460 2026] [:error] [pid 59349:tid 59353] [client 20.104.227.76:54026] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a5.php"] [unique_id "agzU2TvvxTUy-ppKSZWIEQAAAMI"]
[Wed May 20 05:23:37.802598 2026] [:error] [pid 57742:tid 57761] [client 20.104.227.76:49843] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "agzU2aQ_304u6rVT2w-ipQAAAVE"]
[Wed May 20 05:23:38.240401 2026] [:error] [pid 36145:tid 36170] [client 20.104.227.76:4149] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "agzU2qtS18KtvF2Vags63gAAARY"]
[Wed May 20 05:23:38.661350 2026] [:error] [pid 59244:tid 59277] [client 20.104.227.76:49380] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "agzU2rxU0SdQQE7pLs2x3AAAABg"]
[Wed May 20 05:23:39.098678 2026] [:error] [pid 36145:tid 36162] [client 20.104.227.76:53464] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/hplfuns.php"] [unique_id "agzU26tS18KtvF2Vags63wAAAQ4"]
[Wed May 20 05:23:39.515967 2026] [:error] [pid 57835:tid 57920] [client 20.104.227.76:55915] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "agzU22YoVRVVHvoOYbo9mAAAAsI"]
[Wed May 20 05:23:39.933956 2026] [:error] [pid 59349:tid 59362] [client 20.104.227.76:4110] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "agzU2zvvxTUy-ppKSZWIEgAAAMs"]
[Wed May 20 05:23:40.411817 2026] [:error] [pid 57835:tid 57924] [client 20.104.227.76:64461] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "agzU3GYoVRVVHvoOYbo9mQAAAsY"]
[Wed May 20 05:23:40.830529 2026] [:error] [pid 57835:tid 57925] [client 20.104.227.76:4114] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/bolt.php"] [unique_id "agzU3GYoVRVVHvoOYbo9mgAAAsc"]
[Wed May 20 05:23:41.271184 2026] [:error] [pid 57835:tid 57926] [client 20.104.227.76:51691] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "agzU3WYoVRVVHvoOYbo9mwAAAsg"]
[Wed May 20 05:23:41.697383 2026] [:error] [pid 57835:tid 57923] [client 20.104.227.76:55893] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "agzU3WYoVRVVHvoOYbo9nQAAAsU"]
[Wed May 20 05:23:42.126440 2026] [:error] [pid 57774:tid 57803] [client 20.104.227.76:53477] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "agzU3qzH4LWfnGU0RXC2nQAAAcA"]
[Wed May 20 05:23:42.551696 2026] [:error] [pid 57833:tid 57876] [client 20.104.227.76:55904] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "agzU3rVqIe7Xlzcr5bagaAAAAkw"]
[Wed May 20 05:23:42.974834 2026] [:error] [pid 59349:tid 59352] [client 20.104.227.76:14897] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file2.php"] [unique_id "agzU3jvvxTUy-ppKSZWIFAAAAME"]
[Wed May 20 05:23:43.399509 2026] [:error] [pid 59349:tid 59371] [client 20.104.227.76:4164] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file2.php"] [unique_id "agzU3zvvxTUy-ppKSZWIFQAAANQ"]
[Wed May 20 05:23:43.816632 2026] [:error] [pid 59244:tid 59274] [client 20.104.227.76:55935] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file2.php"] [unique_id "agzU37xU0SdQQE7pLs2x4wAAABU"]
[Wed May 20 05:23:44.241678 2026] [:error] [pid 59349:tid 59375] [client 20.104.227.76:54038] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/file2.php"] [unique_id "agzU4DvvxTUy-ppKSZWIFgAAANg"]
[Wed May 20 05:23:44.660880 2026] [:error] [pid 59349:tid 59364] [client 20.104.227.76:54027] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index/function.php"] [unique_id "agzU4DvvxTUy-ppKSZWIFwAAAM0"]
[Wed May 20 05:23:45.080373 2026] [:error] [pid 59349:tid 59360] [client 20.104.227.76:51686] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index/function.php"] [unique_id "agzU4TvvxTUy-ppKSZWIGAAAAMk"]
[Wed May 20 05:23:45.502147 2026] [:error] [pid 36145:tid 36159] [client 20.104.227.76:53441] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index/function.php"] [unique_id "agzU4atS18KtvF2Vags64wAAAQs"]
[Wed May 20 05:23:45.922954 2026] [:error] [pid 36145:tid 36169] [client 20.104.227.76:14916] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/index/function.php"] [unique_id "agzU4atS18KtvF2Vags65QAAARU"]
[Wed May 20 05:23:46.344294 2026] [:error] [pid 57835:tid 57929] [client 20.104.227.76:54048] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wk/index.php"] [unique_id "agzU4mYoVRVVHvoOYbo9ngAAAss"]
[Wed May 20 05:23:46.773189 2026] [:error] [pid 57835:tid 57927] [client 20.104.227.76:54062] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wk/index.php"] [unique_id "agzU4mYoVRVVHvoOYbo9nwAAAsk"]
[Wed May 20 05:23:47.191550 2026] [:error] [pid 57834:tid 57903] [client 20.104.227.76:4102] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wk/index.php"] [unique_id "agzU43TOfwZ09EhqoYD6mwAAAow"]
[Wed May 20 05:23:47.619816 2026] [:error] [pid 36145:tid 36172] [client 20.104.227.76:54021] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wk/index.php"] [unique_id "agzU46tS18KtvF2Vags65wAAARg"]
[Wed May 20 05:23:48.040726 2026] [:error] [pid 36145:tid 36171] [client 20.104.227.76:14956] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "agzU5KtS18KtvF2Vags66AAAARc"]
[Wed May 20 05:23:48.470449 2026] [:error] [pid 36145:tid 36166] [client 20.104.227.76:4212] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "agzU5KtS18KtvF2Vags66QAAARI"]
[Wed May 20 05:23:48.917352 2026] [:error] [pid 59349:tid 59374] [client 20.104.227.76:51598] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "agzU5DvvxTUy-ppKSZWIGgAAANc"]
[Wed May 20 05:23:49.336283 2026] [:error] [pid 57742:tid 57752] [client 20.104.227.76:4171] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "agzU5aQ_304u6rVT2w-ipwAAAUg"]
[Wed May 20 05:23:49.772286 2026] [:error] [pid 57742:tid 57768] [client 20.104.227.76:51678] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-theme.php"] [unique_id "agzU5aQ_304u6rVT2w-iqAAAAVg"]
[Wed May 20 05:23:50.206283 2026] [:error] [pid 57742:tid 57750] [client 20.104.227.76:55931] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-theme.php"] [unique_id "agzU5qQ_304u6rVT2w-iqQAAAUY"]
[Wed May 20 05:23:50.623719 2026] [:error] [pid 36145:tid 36153] [client 20.104.227.76:54058] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-theme.php"] [unique_id "agzU5qtS18KtvF2Vags67QAAAQU"]
[Wed May 20 05:23:51.046199 2026] [:error] [pid 36145:tid 36152] [client 20.104.227.76:51622] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-theme.php"] [unique_id "agzU56tS18KtvF2Vags67gAAAQQ"]
[Wed May 20 05:23:51.472834 2026] [:error] [pid 57742:tid 57751] [client 20.104.227.76:53467] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-file.php"] [unique_id "agzU56Q_304u6rVT2w-iqgAAAUc"]
[Wed May 20 05:23:51.931122 2026] [:error] [pid 57835:tid 57935] [client 20.104.227.76:55919] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-file.php"] [unique_id "agzU52YoVRVVHvoOYbo9owAAAtE"]
[Wed May 20 05:23:52.349526 2026] [:error] [pid 57834:tid 57905] [client 20.104.227.76:4098] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-file.php"] [unique_id "agzU6HTOfwZ09EhqoYD6nQAAAo4"]
[Wed May 20 05:23:52.769618 2026] [:error] [pid 57742:tid 57754] [client 20.104.227.76:4197] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-file.php"] [unique_id "agzU6KQ_304u6rVT2w-iqwAAAUo"]
[Wed May 20 05:23:53.198184 2026] [:error] [pid 57834:tid 57909] [client 20.104.227.76:55900] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/default.php"] [unique_id "agzU6XTOfwZ09EhqoYD6nwAAApI"]
[Wed May 20 05:23:53.617553 2026] [:error] [pid 57774:tid 57805] [client 20.104.227.76:51648] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/default.php"] [unique_id "agzU6azH4LWfnGU0RXC2nwAAAcI"]
[Wed May 20 05:23:54.033766 2026] [:error] [pid 57774:tid 57812] [client 20.104.227.76:54072] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/default.php"] [unique_id "agzU6qzH4LWfnGU0RXC2oQAAAck"]
[Wed May 20 05:23:54.458086 2026] [:error] [pid 57834:tid 57906] [client 20.104.227.76:51656] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/default.php"] [unique_id "agzU6nTOfwZ09EhqoYD6oAAAAo8"]
[Wed May 20 05:23:54.886826 2026] [:error] [pid 57833:tid 57878] [client 20.104.227.76:54056] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mah.php"] [unique_id "agzU6rVqIe7Xlzcr5bagaQAAAk4"]
[Wed May 20 05:23:55.319534 2026] [:error] [pid 57832:tid 57858] [client 20.104.227.76:4203] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mah.php"] [unique_id "agzU60Nip5HpFD8GxxX2lQAAAhU"]
[Wed May 20 05:23:55.737118 2026] [:error] [pid 59245:tid 59295] [client 20.104.227.76:51596] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mah.php"] [unique_id "agzU66OutR70QIZRVkTUCwAAAE8"]
[Wed May 20 05:23:56.153093 2026] [:error] [pid 59349:tid 59366] [client 20.104.227.76:53496] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/mah.php"] [unique_id "agzU7DvvxTUy-ppKSZWIGwAAAM8"]
[Wed May 20 05:23:56.568971 2026] [:error] [pid 59245:tid 59288] [client 20.104.227.76:14954] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugins.php"] [unique_id "agzU7KOutR70QIZRVkTUDAAAAEg"]
[Wed May 20 05:23:56.989234 2026] [:error] [pid 59245:tid 59299] [client 20.104.227.76:51659] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugins.php"] [unique_id "agzU7KOutR70QIZRVkTUDQAAAFM"]
[Wed May 20 05:23:57.403384 2026] [:error] [pid 57742:tid 57753] [client 20.104.227.76:4183] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugins.php"] [unique_id "agzU7aQ_304u6rVT2w-irAAAAUk"]
[Wed May 20 05:23:57.842430 2026] [:error] [pid 57835:tid 57933] [client 20.104.227.76:55914] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/plugins.php"] [unique_id "agzU7WYoVRVVHvoOYbo9qQAAAs8"]
[Wed May 20 05:23:58.258129 2026] [:error] [pid 59245:tid 59289] [client 20.104.227.76:53482] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sf.php"] [unique_id "agzU7qOutR70QIZRVkTUDwAAAEk"]
[Wed May 20 05:23:58.705070 2026] [:error] [pid 57742:tid 57755] [client 20.104.227.76:49403] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sf.php"] [unique_id "agzU7qQ_304u6rVT2w-irgAAAUs"]
[Wed May 20 05:23:59.143839 2026] [:error] [pid 57833:tid 57881] [client 20.104.227.76:55929] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sf.php"] [unique_id "agzU77VqIe7Xlzcr5bagagAAAlE"]
[Wed May 20 05:23:59.576499 2026] [:error] [pid 57742:tid 57760] [client 20.104.227.76:54025] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/sf.php"] [unique_id "agzU76Q_304u6rVT2w-irwAAAVA"]
[Wed May 20 05:23:59.998519 2026] [:error] [pid 57833:tid 57880] [client 20.104.227.76:4188] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a.php"] [unique_id "agzU77VqIe7Xlzcr5bagawAAAlA"]
[Wed May 20 05:24:00.436818 2026] [:error] [pid 57835:tid 57919] [client 20.104.227.76:51707] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a.php"] [unique_id "agzU8GYoVRVVHvoOYbo9qgAAAsE"]
[Wed May 20 05:24:00.867428 2026] [:error] [pid 59349:tid 59355] [client 20.104.227.76:14942] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a.php"] [unique_id "agzU8DvvxTUy-ppKSZWIHgAAAMQ"]
[Wed May 20 05:24:01.292289 2026] [:error] [pid 59244:tid 59277] [client 20.104.227.76:14895] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/a.php"] [unique_id "agzU8bxU0SdQQE7pLs2x6QAAABg"]
[Wed May 20 05:24:01.712574 2026] [:error] [pid 57742:tid 57765] [client 20.104.227.76:55930] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "agzU8aQ_304u6rVT2w-isgAAAVU"]
[Wed May 20 05:24:02.145965 2026] [:error] [pid 57832:tid 57857] [client 20.104.227.76:14946] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "agzU8kNip5HpFD8GxxX2lgAAAhQ"]
[Wed May 20 05:24:02.560425 2026] [:error] [pid 59349:tid 59354] [client 20.104.227.76:64482] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "agzU8jvvxTUy-ppKSZWIHwAAAMM"]
[Wed May 20 05:24:02.982163 2026] [:error] [pid 57835:tid 57932] [client 20.104.227.76:51607] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/k.php"] [unique_id "agzU8mYoVRVVHvoOYbo9rAAAAs4"]
[Wed May 20 05:24:03.397980 2026] [:error] [pid 57835:tid 57920] [client 20.104.227.76:55905] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ini.php"] [unique_id "agzU82YoVRVVHvoOYbo9rQAAAsI"]
[Wed May 20 05:24:03.821343 2026] [:error] [pid 59244:tid 59268] [client 20.104.227.76:55913] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ini.php"] [unique_id "agzU87xU0SdQQE7pLs2x7QAAAA8"]
[Wed May 20 05:24:04.256852 2026] [:error] [pid 59349:tid 59359] [client 20.104.227.76:49820] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ini.php"] [unique_id "agzU9DvvxTUy-ppKSZWIIAAAAMg"]
[Wed May 20 05:24:04.683422 2026] [:error] [pid 57832:tid 57859] [client 20.104.227.76:64475] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ini.php"] [unique_id "agzU9ENip5HpFD8GxxX2lwAAAhY"]
[Wed May 20 05:24:05.156072 2026] [:error] [pid 57835:tid 57926] [client 20.104.227.76:64504] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ca4.php"] [unique_id "agzU9WYoVRVVHvoOYbo9sAAAAsg"]
[Wed May 20 05:24:05.596332 2026] [:error] [pid 57742:tid 57761] [client 20.104.227.76:14903] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ca4.php"] [unique_id "agzU9aQ_304u6rVT2w-itQAAAVE"]
[Wed May 20 05:24:06.046410 2026] [:error] [pid 57742:tid 57762] [client 20.104.227.76:4181] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ca4.php"] [unique_id "agzU9qQ_304u6rVT2w-itgAAAVI"]
[Wed May 20 05:24:06.501945 2026] [:error] [pid 59244:tid 59263] [client 20.104.227.76:54028] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/ca4.php"] [unique_id "agzU9rxU0SdQQE7pLs2x8gAAAAo"]
[Wed May 20 05:24:06.932876 2026] [:error] [pid 59349:tid 59353] [client 20.104.227.76:53456] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "agzU9jvvxTUy-ppKSZWIIwAAAMI"]
[Wed May 20 05:24:07.390010 2026] [:error] [pid 59244:tid 59274] [client 20.104.227.76:14918] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "agzU97xU0SdQQE7pLs2x9AAAABU"]
[Wed May 20 05:24:07.808804 2026] [:error] [pid 59244:tid 59253] [client 20.104.227.76:49356] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "agzU97xU0SdQQE7pLs2x9QAAAAA"]
[Wed May 20 05:24:08.243202 2026] [:error] [pid 59349:tid 59373] [client 20.104.227.76:51669] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-admin/includes/index.php"] [unique_id "agzU-DvvxTUy-ppKSZWIJAAAANY"]
[Wed May 20 05:24:08.694142 2026] [:error] [pid 59244:tid 59265] [client 20.104.227.76:51688] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-info.php"] [unique_id "agzU-LxU0SdQQE7pLs2x9wAAAAw"]
[Wed May 20 05:24:09.159974 2026] [:error] [pid 57835:tid 57927] [client 20.104.227.76:46813] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-info.php"] [unique_id "agzU-WYoVRVVHvoOYbo9sgAAAsk"]
[Wed May 20 05:24:09.652724 2026] [:error] [pid 59349:tid 59351] [client 20.104.227.76:55902] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-info.php"] [unique_id "agzU-TvvxTUy-ppKSZWIJQAAAMA"]
[Wed May 20 05:24:10.087442 2026] [:error] [pid 57833:tid 57886] [client 20.104.227.76:14945] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/wp-info.php"] [unique_id "agzU-rVqIe7Xlzcr5bagbAAAAlY"]
[Wed May 20 05:24:10.541533 2026] [:error] [pid 57833:tid 57885] [client 20.104.227.76:4177] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "agzU-rVqIe7Xlzcr5bagbQAAAlU"]
[Wed May 20 05:24:10.973713 2026] [:error] [pid 57742:tid 57746] [client 20.104.227.76:14871] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "agzU-qQ_304u6rVT2w-iuAAAAUI"]
[Wed May 20 05:24:11.491042 2026] [:error] [pid 59244:tid 59267] [client 20.104.227.76:47115] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "agzU-7xU0SdQQE7pLs2x-QAAAA4"]
[Wed May 20 05:24:11.921407 2026] [:error] [pid 57835:tid 57931] [client 20.104.227.76:14969] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/init.php"] [unique_id "agzU-2YoVRVVHvoOYbo9tAAAAs0"]
[Wed May 20 05:24:12.391889 2026] [:error] [pid 57835:tid 57934] [client 20.104.227.76:51685] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "agzU_GYoVRVVHvoOYbo9tQAAAtA"]
[Wed May 20 05:24:12.834558 2026] [:error] [pid 57835:tid 57935] [client 20.104.227.76:51693] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "agzU_GYoVRVVHvoOYbo9tgAAAtE"]
[Wed May 20 05:24:13.260508 2026] [:error] [pid 57742:tid 57749] [client 20.104.227.76:49367] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "agzU_aQ_304u6rVT2w-iuQAAAUU"]
[Wed May 20 05:24:13.682290 2026] [:error] [pid 57742:tid 57752] [client 20.104.227.76:4136] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "agzU_aQ_304u6rVT2w-iugAAAUg"]
[Wed May 20 05:24:14.103743 2026] [:error] [pid 57742:tid 57768] [client 20.104.227.76:14958] [client 20.104.227.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/fm.php"] [unique_id "agzU_qQ_304u6rVT2w-iuwAAAVg"]
[Wed May 20 05:24:14.550734 2026] [:error] [pid 59245:tid 59287] [client 20.104.227.76:14947] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/z.ph"] [unique_id "agzU_qOutR70QIZRVkTUEQAAAEc"]
[Wed May 20 05:24:14.989538 2026] [:error] [pid 59245:tid 59304] [client 20.104.227.76:51710] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/z.ph"] [unique_id "agzU_qOutR70QIZRVkTUEgAAAFg"]
[Wed May 20 05:24:15.466164 2026] [:error] [pid 59349:tid 59375] [client 20.104.227.76:54069] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/z.ph"] [unique_id "agzU_zvvxTUy-ppKSZWIKQAAANg"]
[Wed May 20 05:24:15.887201 2026] [:error] [pid 57833:tid 57883] [client 20.104.227.76:4175] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/z.ph"] [unique_id "agzU_7VqIe7Xlzcr5bagbgAAAlM"]
[Wed May 20 06:57:59.426231 2026] [:error] [pid 59349:tid 59365] [client 20.212.224.81:5640] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed May 20 06:57:59.622770 2026] [:error] [pid 59349:tid 59352] [client 20.212.224.81:5640] File does not exist: /usr/local/apache/htdocs/suspended-page/supyffqkrnyxagxcjucnCdefault.php
[Wed May 20 06:57:59.729979 2026] [:error] [pid 59349:tid 59372] [client 20.212.224.81:5640] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed May 20 06:57:59.822352 2026] [:error] [pid 59349:tid 59357] [client 20.212.224.81:5640] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed May 20 06:58:00.005563 2026] [:error] [pid 59349:tid 59368] [client 20.212.224.81:5640] File does not exist: /usr/local/apache/htdocs/suspended-page/php8.php
[Wed May 20 06:58:00.210713 2026] [:error] [pid 59349:tid 59367] [client 20.212.224.81:5640] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed May 20 06:58:00.318158 2026] [:error] [pid 59349:tid 59363] [client 20.212.224.81:5640] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed May 20 06:58:00.407684 2026] [:error] [pid 59349:tid 59364] [client 20.212.224.81:5640] [client 20.212.224.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "agzq-DvvxTUy-ppKSZWe-AAAAM0"]
[Wed May 20 06:58:00.816758 2026] [:error] [pid 57774:tid 57803] [client 20.212.224.81:3395] [client 20.212.224.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "agzq-KzH4LWfnGU0RXC62AAAAcA"]
[Wed May 20 06:58:01.182720 2026] [:error] [pid 57833:tid 57870] [client 20.212.224.81:3401] [client 20.212.224.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "agzq-bVqIe7Xlzcr5banbgAAAkY"]
[Wed May 20 06:58:01.594688 2026] [:error] [pid 57833:tid 57883] [client 20.212.224.81:1380] [client 20.212.224.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "agzq-bVqIe7Xlzcr5banbwAAAlM"]
[Wed May 20 10:00:37.459318 2026] [:error] [pid 44059:tid 44080] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed May 20 10:00:37.611724 2026] [:error] [pid 44059:tid 44068] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Wed May 20 10:00:37.800524 2026] [:error] [pid 44059:tid 44078] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Wed May 20 10:00:37.982384 2026] [:error] [pid 44059:tid 44076] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Wed May 20 10:00:38.154174 2026] [:error] [pid 44059:tid 44077] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Wed May 20 10:00:38.315467 2026] [:error] [pid 44059:tid 44071] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed May 20 10:00:38.466519 2026] [:error] [pid 44059:tid 44084] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed May 20 10:00:38.618206 2026] [:error] [pid 44059:tid 44082] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed May 20 10:00:38.769369 2026] [:error] [pid 44059:tid 44085] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed May 20 10:00:38.920687 2026] [:error] [pid 44059:tid 44074] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Wed May 20 10:00:39.081478 2026] [:error] [pid 44059:tid 44065] [client 104.46.224.224:6181] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed May 20 10:00:39.228664 2026] [:error] [pid 44059:tid 44064] [client 104.46.224.224:6181] [client 104.46.224.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ag0VxxfFs-oSOOcyjyxxTAAAAQM"]
[Wed May 20 10:00:39.744454 2026] [:error] [pid 41277:tid 41282] [client 104.46.224.224:13671] [client 104.46.224.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ag0Vx7TTCltJmboB5ufJ9wAAAAA"]
[Wed May 20 10:00:40.283609 2026] [:error] [pid 41277:tid 41298] [client 104.46.224.224:7889] [client 104.46.224.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ag0VyLTTCltJmboB5ufJ-AAAABA"]
[Wed May 20 10:00:40.860528 2026] [:error] [pid 41277:tid 41300] [client 104.46.224.224:16398] [client 104.46.224.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ag0VyLTTCltJmboB5ufJ-gAAABI"]
[Wed May 20 19:46:26.129464 2026] [:error] [pid 41277:tid 41295] [client 136.107.63.119:56876] [client 136.107.63.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.63.119, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "ag2fErTTCltJmboB5uf9WwAAAA0"]
[Wed May 20 19:46:26.132849 2026] [:error] [pid 41277:tid 41295] [client 136.107.63.119:56876] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed May 20 19:46:26.585915 2026] [:error] [pid 41277:tid 41294] [client 136.107.63.119:56876] [client 136.107.63.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "ag2fErTTCltJmboB5uf9XgAAAAw"]
[Wed May 20 19:46:27.136922 2026] [:error] [pid 41278:tid 41327] [client 136.107.63.119:51681] [client 136.107.63.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "ag2fE_WiNKASEfiGdwayKgAAAFI"]
[Wed May 20 19:46:27.581851 2026] [:error] [pid 41279:tid 41337] [client 136.107.63.119:56243] [client 136.107.63.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "ag2fE7EFyfaehGZbt4ySnwAAAME"]
[Wed May 20 19:46:28.124019 2026] [:error] [pid 7664:tid 7682] [client 136.107.63.119:58707] [client 136.107.63.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "ag2fFHZ8s7o3eiqT2kv5gQAAAU8"]
[Wed May 20 19:46:28.616871 2026] [:error] [pid 41278:tid 41326] [client 136.107.63.119:63921] [client 136.107.63.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "ag2fFPWiNKASEfiGdwayLAAAAFE"]
[Wed May 20 19:46:29.109597 2026] [:error] [pid 44059:tid 44061] [client 136.107.63.119:55294] [client 136.107.63.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "ag2fFRfFs-oSOOcyjywWkAAAAQA"]
[Wed May 20 19:46:29.553435 2026] [:error] [pid 7731:tid 7743] [client 136.107.63.119:52008] [client 136.107.63.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "ag2fFX9qQlHXbkl2nEsBmgAAAYo"]
[Wed May 20 20:18:50.664569 2026] [:error] [pid 41364:tid 41386] [client 195.178.110.105:46080] [client 195.178.110.105] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.windfc.windfarmcoolants.com.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ag2mqRKTmyvxtNXrN-jQbQAAAJQ"]
[Wed May 20 20:18:50.664686 2026] [:error] [pid 41364:tid 41386] [client 195.178.110.105:46080] [client 195.178.110.105] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.windfc.windfarmcoolants.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ag2mqRKTmyvxtNXrN-jQbQAAAJQ"]
[Wed May 20 20:32:56.089465 2026] [:error] [pid 44059:tid 44067] [client 195.178.110.155:63674] [client 195.178.110.155] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.windfc.windfarmcoolants.com.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ag2p9xfFs-oSOOcyjywh1wAAAQY"]
[Wed May 20 20:32:56.089538 2026] [:error] [pid 44059:tid 44067] [client 195.178.110.155:63674] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.windfc.windfarmcoolants.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ag2p9xfFs-oSOOcyjywh1wAAAQY"]
[Wed May 20 20:33:06.686383 2026] [:error] [pid 41278:tid 41322] [client 195.178.110.155:31382] [client 195.178.110.155] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.windfc.windfarmcoolants.com.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ag2qAvWiNKASEfiGdwa3WgAAAE0"]
[Wed May 20 20:33:06.686507 2026] [:error] [pid 41278:tid 41322] [client 195.178.110.155:31382] [client 195.178.110.155] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.windfc.windfarmcoolants.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ag2qAvWiNKASEfiGdwa3WgAAAE0"]
[Wed May 20 21:08:20.986619 2026] [:error] [pid 7664:tid 7678] [client 35.226.206.220:50123] [client 35.226.206.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.206.220, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "ag2yRHZ8s7o3eiqT2ksHUAAAAUs"]
[Wed May 20 21:08:20.989910 2026] [:error] [pid 7664:tid 7678] [client 35.226.206.220:50123] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed May 20 21:08:21.428200 2026] [:error] [pid 7664:tid 7681] [client 35.226.206.220:50123] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "ag2yRXZ8s7o3eiqT2ksHVQAAAU4"]
[Wed May 20 21:08:21.980450 2026] [:error] [pid 41364:tid 41373] [client 35.226.206.220:50212] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "ag2yRRKTmyvxtNXrN-jcPgAAAIc"]
[Wed May 20 21:08:22.608762 2026] [:error] [pid 7731:tid 7737] [client 35.226.206.220:58925] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "ag2yRn9qQlHXbkl2nEseJAAAAYQ"]
[Wed May 20 21:08:23.367374 2026] [:error] [pid 41279:tid 41345] [client 35.226.206.220:58528] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "ag2yR7EFyfaehGZbt4yeEQAAAMk"]
[Wed May 20 21:08:23.991724 2026] [:error] [pid 7731:tid 7739] [client 35.226.206.220:59924] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "ag2yR39qQlHXbkl2nEseKwAAAYY"]
[Wed May 20 21:08:24.632847 2026] [:error] [pid 41364:tid 41385] [client 35.226.206.220:54488] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "ag2ySBKTmyvxtNXrN-jcRAAAAJM"]
[Wed May 20 21:08:25.331365 2026] [:error] [pid 41364:tid 41377] [client 35.226.206.220:55423] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "ag2ySRKTmyvxtNXrN-jcRgAAAIs"]
[Wed May 20 21:08:25.947191 2026] [:error] [pid 41364:tid 41378] [client 35.226.206.220:50366] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "ag2ySRKTmyvxtNXrN-jcRwAAAIw"]
[Wed May 20 21:08:26.745860 2026] [:error] [pid 44059:tid 44077] [client 35.226.206.220:63353] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "ag2yShfFs-oSOOcyjywquAAAARA"]
[Wed May 20 21:08:27.542101 2026] [:error] [pid 7731:tid 7745] [client 35.226.206.220:57962] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "ag2yS39qQlHXbkl2nEseMAAAAYw"]
[Wed May 20 21:08:28.072723 2026] [:error] [pid 44059:tid 44082] [client 35.226.206.220:62224] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "ag2yTBfFs-oSOOcyjywqwAAAARU"]
[Wed May 20 21:08:28.608169 2026] [:error] [pid 44059:tid 44076] [client 35.226.206.220:58141] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "ag2yTBfFs-oSOOcyjywqwwAAAQ8"]
[Wed May 20 21:08:29.134048 2026] [:error] [pid 41278:tid 41314] [client 35.226.206.220:62578] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "ag2yTfWiNKASEfiGdwa63QAAAEU"]
[Wed May 20 21:08:29.789065 2026] [:error] [pid 44059:tid 44064] [client 35.226.206.220:59943] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "ag2yTRfFs-oSOOcyjywqxQAAAQM"]
[Wed May 20 21:08:30.300799 2026] [:error] [pid 41279:tid 41356] [client 35.226.206.220:59934] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "ag2yTrEFyfaehGZbt4yeGAAAANQ"]
[Wed May 20 21:08:30.855485 2026] [:error] [pid 41277:tid 41293] [client 35.226.206.220:60924] [client 35.226.206.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "ag2yTrTTCltJmboB5ucGDQAAAAs"]
[Wed May 20 23:13:38.180690 2026] [:error] [pid 7664:tid 7667] [client 142.248.80.70:43278] [client 142.248.80.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "ag3PonZ8s7o3eiqT2ksbigAAAUA"]
[Wed May 20 23:13:38.778826 2026] [:error] [pid 7664:tid 7670] [client 142.248.80.70:43328] [client 142.248.80.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env"] [unique_id "ag3PonZ8s7o3eiqT2ksbjQAAAUM"]
[Wed May 20 23:13:38.779031 2026] [:error] [pid 7664:tid 7673] [client 142.248.80.70:43342] [client 142.248.80.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/backend/.env"] [unique_id "ag3PonZ8s7o3eiqT2ksbjwAAAUY"]
[Wed May 20 23:13:38.779529 2026] [:error] [pid 41279:tid 41353] [client 142.248.80.70:43312] [client 142.248.80.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env"] [unique_id "ag3PorEFyfaehGZbt4ytwgAAANE"]
[Wed May 20 23:13:38.779681 2026] [:error] [pid 7664:tid 7670] [client 142.248.80.70:43310] [client 142.248.80.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "ag3PonZ8s7o3eiqT2ksbkAAAAUM"]
[Wed May 20 23:13:38.780177 2026] [:error] [pid 7664:tid 7673] [client 142.248.80.70:43294] [client 142.248.80.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "ag3PonZ8s7o3eiqT2ksbkQAAAUY"]
[Thu May 21 08:47:33.283446 2026] [:error] [pid 49982:tid 50007] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu May 21 08:47:33.408812 2026] [:error] [pid 49982:tid 49994] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu May 21 08:47:33.534278 2026] [:error] [pid 49982:tid 50003] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu May 21 08:47:33.660593 2026] [:error] [pid 49982:tid 50004] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu May 21 08:47:33.785633 2026] [:error] [pid 49982:tid 49984] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu May 21 08:47:33.909741 2026] [:error] [pid 49982:tid 50002] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu May 21 08:47:34.191178 2026] [:error] [pid 49982:tid 49998] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu May 21 08:47:34.314468 2026] [:error] [pid 49982:tid 50001] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Thu May 21 08:47:34.438627 2026] [:error] [pid 49982:tid 49995] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu May 21 08:47:34.573077 2026] [:error] [pid 49982:tid 49999] [client 20.63.209.8:4290] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu May 21 08:47:34.695196 2026] [:error] [pid 49982:tid 49988] [client 20.63.209.8:4290] [client 20.63.209.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "ag5WJmFwIDa5Tf8O4bZJPQAAAMQ"]
[Thu May 21 08:47:35.223225 2026] [:error] [pid 49982:tid 49997] [client 20.63.209.8:4695] [client 20.63.209.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "ag5WJ2FwIDa5Tf8O4bZJPgAAAM0"]
[Thu May 21 08:47:35.728813 2026] [:error] [pid 49982:tid 50005] [client 20.63.209.8:9992] [client 20.63.209.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "ag5WJ2FwIDa5Tf8O4bZJQAAAANU"]
[Thu May 21 08:47:36.249145 2026] [:error] [pid 49982:tid 49996] [client 20.63.209.8:5142] [client 20.63.209.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "ag5WKGFwIDa5Tf8O4bZJQgAAAMw"]
[Thu May 21 21:47:17.989932 2026] [:error] [pid 9188:tid 9213] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu May 21 21:47:18.243315 2026] [:error] [pid 9188:tid 9207] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/guojrlV.php
[Thu May 21 21:47:18.441170 2026] [:error] [pid 9188:tid 9215] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/as1.php
[Thu May 21 21:47:18.631733 2026] [:error] [pid 9188:tid 9208] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/aer.php
[Thu May 21 21:47:18.831957 2026] [:error] [pid 9188:tid 9198] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/201.php
[Thu May 21 21:47:19.033885 2026] [:error] [pid 9188:tid 9202] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/ops.php
[Thu May 21 21:47:19.224641 2026] [:error] [pid 9188:tid 9192] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/6ph78840.php
[Thu May 21 21:47:19.455369 2026] [:error] [pid 9188:tid 9196] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/zxz.php
[Thu May 21 21:47:19.651096 2026] [:error] [pid 9188:tid 9212] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/at.php
[Thu May 21 21:47:19.841812 2026] [:error] [pid 9188:tid 9203] [client 40.113.223.68:7926] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Thu May 21 21:47:20.029918 2026] [:error] [pid 9188:tid 9205] [client 40.113.223.68:7926] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ingfo.php"] [unique_id "ag8M6LGYm6q5dNSUvA_yvAAAAc0"]
[Thu May 21 21:47:20.896078 2026] [:error] [pid 49982:tid 49989] [client 40.113.223.68:4242] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ingfo.php"] [unique_id "ag8M6GFwIDa5Tf8O4bYOLwAAAMU"]
[Thu May 21 21:47:22.232043 2026] [:error] [pid 9188:tid 9200] [client 40.113.223.68:6754] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ingfo.php"] [unique_id "ag8M6rGYm6q5dNSUvA_yvQAAAcg"]
[Thu May 21 21:47:23.071974 2026] [:error] [pid 49884:tid 49959] [client 40.113.223.68:61691] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ingfo.php"] [unique_id "ag8M665MPpsTNNHWS6j-2wAAAIw"]
[Thu May 21 21:47:24.179433 2026] [:error] [pid 9114:tid 9135] [client 40.113.223.68:3167] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfs.php"] [unique_id "ag8M7G8FiJqDBEoTvqyE6gAAAVM"]
[Thu May 21 21:47:25.498341 2026] [:error] [pid 9114:tid 9130] [client 40.113.223.68:5491] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfs.php"] [unique_id "ag8M7W8FiJqDBEoTvqyE6wAAAU4"]
[Thu May 21 21:47:26.213623 2026] [:error] [pid 49877:tid 49910] [client 40.113.223.68:1555] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfs.php"] [unique_id "ag8M7hgN4MeSe4kIL9BCBQAAABY"]
[Thu May 21 21:47:27.541131 2026] [:error] [pid 9114:tid 9122] [client 40.113.223.68:1553] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfs.php"] [unique_id "ag8M728FiJqDBEoTvqyE7gAAAUY"]
[Thu May 21 21:47:29.463367 2026] [:error] [pid 9189:tid 9225] [client 40.113.223.68:61661] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/genco.php"] [unique_id "ag8M8ZvTDh1NbYizKVzFsgAAAgY"]
[Thu May 21 21:47:30.370104 2026] [:error] [pid 49982:tid 49989] [client 40.113.223.68:3146] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/genco.php"] [unique_id "ag8M8mFwIDa5Tf8O4bYOMwAAAMU"]
[Thu May 21 21:47:30.985580 2026] [:error] [pid 49879:tid 49926] [client 40.113.223.68:3391] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/genco.php"] [unique_id "ag8M8oVqYDjFSyG2gFpq_gAAAEY"]
[Thu May 21 21:47:31.517326 2026] [:error] [pid 9189:tid 9220] [client 40.113.223.68:1541] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/genco.php"] [unique_id "ag8M85vTDh1NbYizKVzFswAAAgE"]
[Thu May 21 21:47:32.368807 2026] [:error] [pid 9188:tid 9197] [client 40.113.223.68:7924] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pha.php"] [unique_id "ag8M9LGYm6q5dNSUvA_ywQAAAcU"]
[Thu May 21 21:47:34.184173 2026] [:error] [pid 51613:tid 51632] [client 40.113.223.68:8011] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pha.php"] [unique_id "ag8M9mbP0MDvqrVnweoKwAAAARE"]
[Thu May 21 21:47:34.951801 2026] [:error] [pid 9157:tid 9168] [client 40.113.223.68:1569] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pha.php"] [unique_id "ag8M9sGfHcLNqE8m88KaiAAAAYk"]
[Thu May 21 21:47:35.797374 2026] [:error] [pid 9188:tid 9196] [client 40.113.223.68:5492] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pha.php"] [unique_id "ag8M97GYm6q5dNSUvA_yyAAAAcQ"]
[Thu May 21 21:47:36.525888 2026] [:error] [pid 49879:tid 49938] [client 40.113.223.68:3356] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/c55cdler.php"] [unique_id "ag8M-IVqYDjFSyG2gFprAAAAAFI"]
[Thu May 21 21:47:37.081198 2026] [:error] [pid 9189:tid 9234] [client 40.113.223.68:8049] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/c55cdler.php"] [unique_id "ag8M-ZvTDh1NbYizKVzFtgAAAg8"]
[Thu May 21 21:47:38.518166 2026] [:error] [pid 9114:tid 9134] [client 40.113.223.68:8312] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/c55cdler.php"] [unique_id "ag8M-m8FiJqDBEoTvqyE8wAAAVI"]
[Thu May 21 21:47:39.526786 2026] [:error] [pid 49982:tid 50006] [client 40.113.223.68:1568] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/c55cdler.php"] [unique_id "ag8M-2FwIDa5Tf8O4bYONwAAANY"]
[Thu May 21 21:47:41.726856 2026] [:error] [pid 49879:tid 49920] [client 40.113.223.68:3361] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/guiler.php"] [unique_id "ag8M_YVqYDjFSyG2gFprAgAAAEA"]
[Thu May 21 21:47:44.352829 2026] [:error] [pid 49879:tid 49932] [client 40.113.223.68:59675] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/guiler.php"] [unique_id "ag8NAIVqYDjFSyG2gFprBQAAAEw"]
[Thu May 21 21:47:45.468502 2026] [:error] [pid 49879:tid 49922] [client 40.113.223.68:7904] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/guiler.php"] [unique_id "ag8NAYVqYDjFSyG2gFprCwAAAEI"]
[Thu May 21 21:47:46.843765 2026] [:error] [pid 9114:tid 9130] [client 40.113.223.68:7882] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/guiler.php"] [unique_id "ag8NAm8FiJqDBEoTvqyE9wAAAU4"]
[Thu May 21 21:47:48.273708 2026] [:error] [pid 49884:tid 49952] [client 40.113.223.68:3717] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/doko.php"] [unique_id "ag8NBK5MPpsTNNHWS6j-8QAAAIU"]
[Thu May 21 21:47:49.119881 2026] [:error] [pid 49884:tid 49961] [client 40.113.223.68:6764] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/doko.php"] [unique_id "ag8NBa5MPpsTNNHWS6j-9AAAAI4"]
[Thu May 21 21:47:50.066465 2026] [:error] [pid 49982:tid 49988] [client 40.113.223.68:1347] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/doko.php"] [unique_id "ag8NBmFwIDa5Tf8O4bYOOwAAAMQ"]
[Thu May 21 21:47:50.866669 2026] [:error] [pid 49982:tid 50008] [client 40.113.223.68:6752] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/doko.php"] [unique_id "ag8NBmFwIDa5Tf8O4bYOPQAAANg"]
[Thu May 21 21:47:53.425001 2026] [:error] [pid 9157:tid 9180] [client 40.113.223.68:5739] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "ag8NCcGfHcLNqE8m88KajQAAAZU"]
[Thu May 21 21:47:54.727367 2026] [:error] [pid 49884:tid 49967] [client 40.113.223.68:1395] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "ag8NCq5MPpsTNNHWS6j_AQAAAJQ"]
[Thu May 21 21:47:56.012144 2026] [:error] [pid 49877:tid 49903] [client 40.113.223.68:2084] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "ag8NDBgN4MeSe4kIL9BCDQAAAA8"]
[Thu May 21 21:47:57.208226 2026] [:error] [pid 49879:tid 49930] [client 40.113.223.68:59609] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/error_log.php"] [unique_id "ag8NDYVqYDjFSyG2gFprEAAAAEo"]
[Thu May 21 21:47:58.513240 2026] [:error] [pid 49982:tid 50004] [client 40.113.223.68:4869] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xenon1337.php"] [unique_id "ag8NDmFwIDa5Tf8O4bYOQgAAANQ"]
[Thu May 21 21:48:01.656139 2026] [:error] [pid 9114:tid 9119] [client 40.113.223.68:4133] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xenon1337.php"] [unique_id "ag8NEW8FiJqDBEoTvqyE_AAAAUM"]
[Thu May 21 21:48:02.683321 2026] [:error] [pid 49877:tid 49890] [client 40.113.223.68:58692] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xenon1337.php"] [unique_id "ag8NEhgN4MeSe4kIL9BCEQAAAAI"]
[Thu May 21 21:48:04.431157 2026] [:error] [pid 9189:tid 9222] [client 40.113.223.68:5911] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xenon1337.php"] [unique_id "ag8NFJvTDh1NbYizKVzFyAAAAgM"]
[Thu May 21 21:48:05.617924 2026] [:error] [pid 49884:tid 49960] [client 40.113.223.68:3435] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa403.php"] [unique_id "ag8NFa5MPpsTNNHWS6j_DgAAAI0"]
[Thu May 21 21:48:07.072330 2026] [:error] [pid 9188:tid 9207] [client 40.113.223.68:59018] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa403.php"] [unique_id "ag8NF7GYm6q5dNSUvA_y1AAAAc8"]
[Thu May 21 21:48:08.573885 2026] [:error] [pid 49884:tid 49947] [client 40.113.223.68:59452] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa403.php"] [unique_id "ag8NGK5MPpsTNNHWS6j_EQAAAIA"]
[Thu May 21 21:48:09.281785 2026] [:error] [pid 9188:tid 9205] [client 40.113.223.68:3486] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfa403.php"] [unique_id "ag8NGbGYm6q5dNSUvA_y2wAAAc0"]
[Thu May 21 21:48:10.154275 2026] [:error] [pid 49982:tid 49998] [client 40.113.223.68:3697] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yenifm.php"] [unique_id "ag8NGmFwIDa5Tf8O4bYORgAAAM4"]
[Thu May 21 21:48:10.910029 2026] [:error] [pid 49884:tid 49961] [client 40.113.223.68:3669] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yenifm.php"] [unique_id "ag8NGq5MPpsTNNHWS6j_FwAAAI4"]
[Thu May 21 21:48:12.024748 2026] [:error] [pid 9189:tid 9221] [client 40.113.223.68:4288] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yenifm.php"] [unique_id "ag8NHJvTDh1NbYizKVzFygAAAgI"]
[Thu May 21 21:48:12.632343 2026] [:error] [pid 49982:tid 50003] [client 40.113.223.68:1414] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/yenifm.php"] [unique_id "ag8NHGFwIDa5Tf8O4bYOSAAAANM"]
[Thu May 21 21:48:13.146606 2026] [:error] [pid 49982:tid 50004] [client 40.113.223.68:59135] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test11.php"] [unique_id "ag8NHWFwIDa5Tf8O4bYOSwAAANQ"]
[Thu May 21 21:48:15.144503 2026] [:error] [pid 49884:tid 49957] [client 40.113.223.68:1629] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test11.php"] [unique_id "ag8NH65MPpsTNNHWS6j_HgAAAIo"]
[Thu May 21 21:48:16.031290 2026] [:error] [pid 49884:tid 49965] [client 40.113.223.68:3065] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test11.php"] [unique_id "ag8NIK5MPpsTNNHWS6j_IAAAAJI"]
[Thu May 21 21:48:17.801482 2026] [:error] [pid 49982:tid 49987] [client 40.113.223.68:2484] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test11.php"] [unique_id "ag8NIWFwIDa5Tf8O4bYOUAAAAMM"]
[Thu May 21 21:48:18.738523 2026] [:error] [pid 9188:tid 9215] [client 40.113.223.68:1435] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-widget.php"] [unique_id "ag8NIrGYm6q5dNSUvA_y3QAAAdc"]
[Thu May 21 21:48:19.666969 2026] [:error] [pid 49982:tid 49999] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-widget.php
[Thu May 21 21:48:19.858150 2026] [:error] [pid 49982:tid 49998] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/25d653587fdfd1.php
[Thu May 21 21:48:20.051294 2026] [:error] [pid 49982:tid 49992] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/zero.php
[Thu May 21 21:48:20.242799 2026] [:error] [pid 49982:tid 49989] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/koala.php
[Thu May 21 21:48:20.434409 2026] [:error] [pid 49982:tid 50007] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/mac.php
[Thu May 21 21:48:20.776540 2026] [:error] [pid 49982:tid 49993] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/hayuk.php
[Thu May 21 21:48:20.970482 2026] [:error] [pid 49982:tid 49997] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/0d.php
[Thu May 21 21:48:21.177802 2026] [:error] [pid 49982:tid 49990] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Thu May 21 21:48:21.373030 2026] [:error] [pid 49982:tid 49987] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/casp3.php
[Thu May 21 21:48:21.568093 2026] [:error] [pid 49982:tid 49985] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/unvouc.php
[Thu May 21 21:48:21.760479 2026] [:error] [pid 49982:tid 50001] [client 40.113.223.68:59731] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Thu May 21 21:48:21.949536 2026] [:error] [pid 49982:tid 49996] [client 40.113.223.68:59731] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ag8NJWFwIDa5Tf8O4bYOXwAAAMw"]
[Thu May 21 21:48:23.116148 2026] [:error] [pid 49982:tid 49988] [client 40.113.223.68:1412] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ag8NJ2FwIDa5Tf8O4bYOYQAAAMQ"]
[Thu May 21 21:48:23.936756 2026] [:error] [pid 9157:tid 9159] [client 40.113.223.68:7532] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ag8NJ8GfHcLNqE8m88KanAAAAYA"]
[Thu May 21 21:48:24.557276 2026] [:error] [pid 49879:tid 49929] [client 40.113.223.68:1615] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ag8NKIVqYDjFSyG2gFprFQAAAEk"]
[Thu May 21 21:48:25.170776 2026] [:error] [pid 49884:tid 49948] [client 40.113.223.68:5599] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/"] [unique_id "ag8NKa5MPpsTNNHWS6j_JwAAAIE"]
[Thu May 21 21:48:26.973902 2026] [:error] [pid 9188:tid 9205] [client 40.113.223.68:1170] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/"] [unique_id "ag8NKrGYm6q5dNSUvA_y4wAAAc0"]
[Thu May 21 21:48:27.606710 2026] [:error] [pid 49884:tid 49963] [client 40.113.223.68:1199] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/"] [unique_id "ag8NK65MPpsTNNHWS6j_LAAAAJA"]
[Thu May 21 21:48:28.530945 2026] [:error] [pid 9157:tid 9167] [client 40.113.223.68:1738] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/"] [unique_id "ag8NLMGfHcLNqE8m88KanwAAAYg"]
[Thu May 21 21:48:29.448109 2026] [:error] [pid 49879:tid 49944] [client 40.113.223.68:1937] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links.php"] [unique_id "ag8NLYVqYDjFSyG2gFprFwAAAFg"]
[Thu May 21 21:48:31.724604 2026] [:error] [pid 49884:tid 49949] [client 40.113.223.68:3999] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links.php"] [unique_id "ag8NL65MPpsTNNHWS6j_LwAAAII"]
[Thu May 21 21:48:32.539192 2026] [:error] [pid 49884:tid 49957] [client 40.113.223.68:4342] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links.php"] [unique_id "ag8NMK5MPpsTNNHWS6j_MQAAAIo"]
[Thu May 21 21:48:33.141648 2026] [:error] [pid 49884:tid 49959] [client 40.113.223.68:1971] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-links.php"] [unique_id "ag8NMa5MPpsTNNHWS6j_NQAAAIw"]
[Thu May 21 21:48:34.447999 2026] [:error] [pid 49884:tid 49970] [client 40.113.223.68:1844] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/upload/wp-info.php"] [unique_id "ag8NMq5MPpsTNNHWS6j_OAAAAJc"]
[Thu May 21 21:48:34.943822 2026] [:error] [pid 49879:tid 49932] [client 40.113.223.68:4324] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/upload/wp-info.php"] [unique_id "ag8NMoVqYDjFSyG2gFprGAAAAEw"]
[Thu May 21 21:48:35.836461 2026] [:error] [pid 49879:tid 49935] [client 40.113.223.68:1822] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/upload/wp-info.php"] [unique_id "ag8NM4VqYDjFSyG2gFprGQAAAE8"]
[Thu May 21 21:48:37.492947 2026] [:error] [pid 9157:tid 9160] [client 40.113.223.68:4513] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/upload/wp-info.php"] [unique_id "ag8NNcGfHcLNqE8m88KaoQAAAYE"]
[Thu May 21 21:48:39.259433 2026] [:error] [pid 49884:tid 49952] [client 40.113.223.68:1948] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colour.php"] [unique_id "ag8NN65MPpsTNNHWS6j_SQAAAIU"]
[Thu May 21 21:48:39.923903 2026] [:error] [pid 49884:tid 49957] [client 40.113.223.68:1156] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colour.php"] [unique_id "ag8NN65MPpsTNNHWS6j_TAAAAIo"]
[Thu May 21 21:48:40.957967 2026] [:error] [pid 49982:tid 49996] [client 40.113.223.68:8179] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colour.php"] [unique_id "ag8NOGFwIDa5Tf8O4bYOaAAAAMw"]
[Thu May 21 21:48:41.716326 2026] [:error] [pid 49884:tid 49947] [client 40.113.223.68:4651] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/colour.php"] [unique_id "ag8NOa5MPpsTNNHWS6j_UAAAAIA"]
[Thu May 21 21:48:42.370950 2026] [:error] [pid 49879:tid 49941] [client 40.113.223.68:1208] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/half.php"] [unique_id "ag8NOoVqYDjFSyG2gFprGwAAAFU"]
[Thu May 21 21:48:43.216108 2026] [:error] [pid 9157:tid 9172] [client 40.113.223.68:1756] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/half.php"] [unique_id "ag8NO8GfHcLNqE8m88KaqAAAAY0"]
[Thu May 21 21:48:44.114097 2026] [:error] [pid 49879:tid 49921] [client 40.113.223.68:3305] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/half.php"] [unique_id "ag8NPIVqYDjFSyG2gFprHAAAAEE"]
[Thu May 21 21:48:44.874404 2026] [:error] [pid 49877:tid 49902] [client 40.113.223.68:1775] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/half.php"] [unique_id "ag8NPBgN4MeSe4kIL9BCHAAAAA4"]
[Thu May 21 21:48:45.877889 2026] [:error] [pid 9188:tid 9207] [client 40.113.223.68:4005] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2P.php"] [unique_id "ag8NPbGYm6q5dNSUvA_y6wAAAc8"]
[Thu May 21 21:48:46.599669 2026] [:error] [pid 49879:tid 49943] [client 40.113.223.68:4336] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2P.php"] [unique_id "ag8NPoVqYDjFSyG2gFprIAAAAFc"]
[Thu May 21 21:48:48.128842 2026] [:error] [pid 9157:tid 9178] [client 40.113.223.68:5827] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2P.php"] [unique_id "ag8NQMGfHcLNqE8m88KaqQAAAZM"]
[Thu May 21 21:48:49.216063 2026] [:error] [pid 9157:tid 9173] [client 40.113.223.68:4295] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2P.php"] [unique_id "ag8NQcGfHcLNqE8m88KaqwAAAY4"]
[Thu May 21 21:48:50.148404 2026] [:error] [pid 49879:tid 49931] [client 40.113.223.68:7851] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "ag8NQoVqYDjFSyG2gFprJQAAAEs"]
[Thu May 21 21:48:51.058431 2026] [:error] [pid 49982:tid 49985] [client 40.113.223.68:7049] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "ag8NQ2FwIDa5Tf8O4bYOcgAAAME"]
[Thu May 21 21:48:51.486801 2026] [:error] [pid 51613:tid 51624] [client 40.113.223.68:7043] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "ag8NQ2bP0MDvqrVnweoK4gAAAQk"]
[Thu May 21 21:48:52.178069 2026] [:error] [pid 9188:tid 9214] [client 40.113.223.68:7871] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tires.php"] [unique_id "ag8NRLGYm6q5dNSUvA_y7wAAAdY"]
[Thu May 21 21:48:53.011002 2026] [:error] [pid 51613:tid 51637] [client 40.113.223.68:3588] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aevly.php"] [unique_id "ag8NRWbP0MDvqrVnweoK5gAAARY"]
[Thu May 21 21:48:53.580120 2026] [:error] [pid 49982:tid 49995] [client 40.113.223.68:1152] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aevly.php"] [unique_id "ag8NRWFwIDa5Tf8O4bYOdgAAAMs"]
[Thu May 21 21:48:54.050473 2026] [:error] [pid 49982:tid 49998] [client 40.113.223.68:1791] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aevly.php"] [unique_id "ag8NRmFwIDa5Tf8O4bYOeAAAAM4"]
[Thu May 21 21:48:55.232170 2026] [:error] [pid 9188:tid 9197] [client 40.113.223.68:59536] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aevly.php"] [unique_id "ag8NR7GYm6q5dNSUvA_y8wAAAcU"]
[Thu May 21 21:48:56.115105 2026] [:error] [pid 9189:tid 9225] [client 40.113.223.68:1766] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ag8NSJvTDh1NbYizKVzF2wAAAgY"]
[Thu May 21 21:48:57.183800 2026] [:error] [pid 49879:tid 49925] [client 40.113.223.68:7053] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ag8NSYVqYDjFSyG2gFprLAAAAEU"]
[Thu May 21 21:48:58.467314 2026] [:error] [pid 9189:tid 9223] [client 40.113.223.68:59575] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ag8NSpvTDh1NbYizKVzF_wAAAgQ"]
[Thu May 21 21:48:59.609845 2026] [:error] [pid 9188:tid 9195] [client 40.113.223.68:4438] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ag8NS7GYm6q5dNSUvA_zCQAAAcM"]
[Thu May 21 21:49:00.522022 2026] [:error] [pid 49982:tid 49989] [client 40.113.223.68:59163] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "ag8NTGFwIDa5Tf8O4bYOfwAAAMU"]
[Thu May 21 21:49:01.527632 2026] [:error] [pid 49982:tid 49990] [client 40.113.223.68:5014] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "ag8NTWFwIDa5Tf8O4bYOhQAAAMY"]
[Thu May 21 21:49:02.727056 2026] [:error] [pid 9114:tid 9133] [client 40.113.223.68:59535] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "ag8NTm8FiJqDBEoTvqyFFwAAAVE"]
[Thu May 21 21:49:03.577938 2026] [:error] [pid 49879:tid 49931] [client 40.113.223.68:6988] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-block.php"] [unique_id "ag8NT4VqYDjFSyG2gFprLwAAAEs"]
[Thu May 21 21:49:04.139559 2026] [:error] [pid 9114:tid 9132] [client 40.113.223.68:4464] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/like.php"] [unique_id "ag8NUG8FiJqDBEoTvqyFHAAAAVA"]
[Thu May 21 21:49:04.737763 2026] [:error] [pid 9114:tid 9117] [client 40.113.223.68:4437] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/like.php"] [unique_id "ag8NUG8FiJqDBEoTvqyFHgAAAUE"]
[Thu May 21 21:49:05.651148 2026] [:error] [pid 49884:tid 49959] [client 40.113.223.68:4070] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/like.php"] [unique_id "ag8NUa5MPpsTNNHWS6j_VwAAAIw"]
[Thu May 21 21:49:06.436439 2026] [:error] [pid 51613:tid 51633] [client 40.113.223.68:4620] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/like.php"] [unique_id "ag8NUmbP0MDvqrVnweoK6QAAARI"]
[Thu May 21 21:49:07.466583 2026] [:error] [pid 9157:tid 9180] [client 40.113.223.68:5013] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "ag8NU8GfHcLNqE8m88KasAAAAZU"]
[Thu May 21 21:49:08.426437 2026] [:error] [pid 49877:tid 49897] [client 40.113.223.68:4086] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "ag8NVBgN4MeSe4kIL9BCIAAAAAk"]
[Thu May 21 21:49:09.761724 2026] [:error] [pid 9189:tid 9238] [client 40.113.223.68:1954] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "ag8NVZvTDh1NbYizKVzGKAAAAhM"]
[Thu May 21 21:49:10.259516 2026] [:error] [pid 9114:tid 9139] [client 40.113.223.68:3645] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kj.php"] [unique_id "ag8NVm8FiJqDBEoTvqyFRAAAAVc"]
[Thu May 21 21:49:11.971811 2026] [:error] [pid 9114:tid 9132] [client 40.113.223.68:4995] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/about.php"] [unique_id "ag8NV28FiJqDBEoTvqyFRQAAAVA"]
[Thu May 21 21:49:12.541879 2026] [:error] [pid 9157:tid 9183] [client 40.113.223.68:5043] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/about.php"] [unique_id "ag8NWMGfHcLNqE8m88KatQAAAZg"]
[Thu May 21 21:49:13.115072 2026] [:error] [pid 9188:tid 9202] [client 40.113.223.68:3597] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/about.php"] [unique_id "ag8NWbGYm6q5dNSUvA_zHQAAAco"]
[Thu May 21 21:49:14.767263 2026] [:error] [pid 49884:tid 49956] [client 40.113.223.68:7285] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.well-known/about.php"] [unique_id "ag8NWq5MPpsTNNHWS6j_WQAAAIk"]
[Thu May 21 21:49:15.990659 2026] [:error] [pid 9157:tid 9182] [client 40.113.223.68:6964] [client 40.113.223.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ag8NW8GfHcLNqE8m88KauAAAAZc"]
[Thu May 21 21:49:16.640880 2026] [:error] [pid 9157:tid 9159] [client 40.113.223.68:4614] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpxml.php"] [unique_id "ag8NXMGfHcLNqE8m88KaugAAAYA"]
[Thu May 21 21:49:17.287993 2026] [:error] [pid 9114:tid 9137] [client 40.113.223.68:1958] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpxml.php"] [unique_id "ag8NXW8FiJqDBEoTvqyFSAAAAVU"]
[Thu May 21 21:49:18.061979 2026] [:error] [pid 9157:tid 9161] [client 40.113.223.68:7748] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wpxml.php"] [unique_id "ag8NXsGfHcLNqE8m88KavAAAAYI"]
[Thu May 21 21:49:18.699941 2026] [:error] [pid 49877:tid 49896] [client 40.113.223.68:59530] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bob.php"] [unique_id "ag8NXhgN4MeSe4kIL9BCJAAAAAg"]
[Thu May 21 21:49:19.999905 2026] [:error] [pid 51613:tid 51634] [client 40.113.223.68:8167] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bob.php"] [unique_id "ag8NX2bP0MDvqrVnweoK7gAAARM"]
[Thu May 21 21:49:20.942989 2026] [:error] [pid 49884:tid 49951] [client 40.113.223.68:1932] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bob.php"] [unique_id "ag8NYK5MPpsTNNHWS6j_XQAAAIQ"]
[Thu May 21 21:49:21.942233 2026] [:error] [pid 9189:tid 9222] [client 40.113.223.68:7248] File does not exist: /usr/local/apache/htdocs/suspended-page/bob.php
[Thu May 21 21:49:22.137519 2026] [:error] [pid 9189:tid 9224] [client 40.113.223.68:7248] File does not exist: /usr/local/apache/htdocs/suspended-page/spawns.php
[Thu May 21 21:49:22.329869 2026] [:error] [pid 9189:tid 9239] [client 40.113.223.68:7248] File does not exist: /usr/local/apache/htdocs/suspended-page/t3s.php
[Thu May 21 21:49:23.660932 2026] [:error] [pid 9189:tid 9228] [client 40.113.223.68:7248] File does not exist: /usr/local/apache/htdocs/suspended-page/uwu.php
[Thu May 21 21:49:23.852207 2026] [:error] [pid 9189:tid 9235] [client 40.113.223.68:7248] File does not exist: /usr/local/apache/htdocs/suspended-page/uwa.php
[Thu May 21 21:49:24.043275 2026] [:error] [pid 9189:tid 9226] [client 40.113.223.68:7248] File does not exist: /usr/local/apache/htdocs/suspended-page/crgio.php
[Thu May 21 21:49:24.233953 2026] [:error] [pid 9189:tid 9241] [client 40.113.223.68:7248] File does not exist: /usr/local/apache/htdocs/suspended-page/geforce.php
[Thu May 21 21:49:24.422403 2026] [:error] [pid 9189:tid 9231] [client 40.113.223.68:7248] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ag8NZJvTDh1NbYizKVzGQAAAAgw"]
[Thu May 21 21:49:25.240041 2026] [:error] [pid 49884:tid 49950] [client 40.113.223.68:8160] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ag8NZa5MPpsTNNHWS6j_YgAAAIM"]
[Thu May 21 21:49:26.580702 2026] [:error] [pid 9189:tid 9222] [client 40.113.223.68:4653] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ag8NZpvTDh1NbYizKVzGQQAAAgM"]
[Thu May 21 21:49:27.078161 2026] [:error] [pid 49879:tid 49925] [client 40.113.223.68:7286] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ag8NZ4VqYDjFSyG2gFprTQAAAEU"]
[Thu May 21 21:49:27.743009 2026] [:error] [pid 49877:tid 49900] [client 40.113.223.68:7287] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3PJcpMFsD8B.php"] [unique_id "ag8NZxgN4MeSe4kIL9BCJgAAAAw"]
[Thu May 21 21:49:28.274621 2026] [:error] [pid 9189:tid 9221] [client 40.113.223.68:7768] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3PJcpMFsD8B.php"] [unique_id "ag8NaJvTDh1NbYizKVzGRAAAAgI"]
[Thu May 21 21:49:29.015630 2026] [:error] [pid 9157:tid 9159] [client 40.113.223.68:4066] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3PJcpMFsD8B.php"] [unique_id "ag8NacGfHcLNqE8m88KawQAAAYA"]
[Thu May 21 21:49:30.164225 2026] [:error] [pid 49884:tid 49969] [client 40.113.223.68:1979] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/3PJcpMFsD8B.php"] [unique_id "ag8Naq5MPpsTNNHWS6j_aAAAAJY"]
[Thu May 21 21:49:31.036776 2026] [:error] [pid 49884:tid 49951] [client 40.113.223.68:59562] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/UsbXax.php"] [unique_id "ag8Na65MPpsTNNHWS6j_awAAAIQ"]
[Thu May 21 21:49:31.742466 2026] [:error] [pid 49884:tid 49967] [client 40.113.223.68:1962] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/UsbXax.php"] [unique_id "ag8Na65MPpsTNNHWS6j_bAAAAJQ"]
[Thu May 21 21:49:32.261654 2026] [:error] [pid 9114:tid 9127] [client 40.113.223.68:59551] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/UsbXax.php"] [unique_id "ag8NbG8FiJqDBEoTvqyFTQAAAUs"]
[Thu May 21 21:49:32.799689 2026] [:error] [pid 9114:tid 9125] [client 40.113.223.68:7747] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/UsbXax.php"] [unique_id "ag8NbG8FiJqDBEoTvqyFTgAAAUk"]
[Thu May 21 21:49:33.868805 2026] [:error] [pid 9189:tid 9240] [client 40.113.223.68:59574] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoko.php"] [unique_id "ag8NbZvTDh1NbYizKVzGRgAAAhU"]
[Thu May 21 21:49:34.394662 2026] [:error] [pid 49877:tid 49894] [client 40.113.223.68:5052] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoko.php"] [unique_id "ag8NbhgN4MeSe4kIL9BCKgAAAAY"]
[Thu May 21 21:49:35.476437 2026] [:error] [pid 49877:tid 49892] [client 40.113.223.68:1981] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoko.php"] [unique_id "ag8NbxgN4MeSe4kIL9BCLAAAAAQ"]
[Thu May 21 21:49:35.969564 2026] [:error] [pid 49879:tid 49931] [client 40.113.223.68:1941] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/zoko.php"] [unique_id "ag8Nb4VqYDjFSyG2gFprTgAAAEs"]
[Thu May 21 21:49:36.633773 2026] [:error] [pid 9189:tid 9239] [client 40.113.223.68:3603] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pucci.php"] [unique_id "ag8NcJvTDh1NbYizKVzGSgAAAhQ"]
[Thu May 21 21:49:37.446977 2026] [:error] [pid 49884:tid 49965] [client 40.113.223.68:1924] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pucci.php"] [unique_id "ag8Nca5MPpsTNNHWS6j_dQAAAJI"]
[Thu May 21 21:49:38.077019 2026] [:error] [pid 9189:tid 9232] [client 40.113.223.68:1967] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pucci.php"] [unique_id "ag8NcpvTDh1NbYizKVzGSwAAAg0"]
[Thu May 21 21:49:39.065400 2026] [:error] [pid 49877:tid 49910] [client 40.113.223.68:59260] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/pucci.php"] [unique_id "ag8NcxgN4MeSe4kIL9BCNAAAABY"]
[Thu May 21 21:49:39.975734 2026] [:error] [pid 49877:tid 49909] [client 40.113.223.68:7277] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ag8NcxgN4MeSe4kIL9BCNQAAABU"]
[Thu May 21 21:49:40.612553 2026] [:error] [pid 49877:tid 49897] [client 40.113.223.68:59561] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ag8NdBgN4MeSe4kIL9BCNgAAAAk"]
[Thu May 21 21:49:41.171797 2026] [:error] [pid 49877:tid 49891] [client 40.113.223.68:59573] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ag8NdRgN4MeSe4kIL9BCOAAAAAM"]
[Thu May 21 21:49:41.857070 2026] [:error] [pid 9189:tid 9228] [client 40.113.223.68:7256] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ag8NdZvTDh1NbYizKVzGTwAAAgk"]
[Thu May 21 21:49:42.509862 2026] [:error] [pid 51613:tid 51618] [client 40.113.223.68:6857] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ag8NdmbP0MDvqrVnweoK9QAAAQM"]
[Thu May 21 21:49:43.329386 2026] [:error] [pid 9189:tid 9235] [client 40.113.223.68:6864] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ag8Nd5vTDh1NbYizKVzGUAAAAhA"]
[Thu May 21 21:49:44.251507 2026] [:error] [pid 9157:tid 9179] [client 40.113.223.68:59141] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ag8NeMGfHcLNqE8m88KaxwAAAZQ"]
[Thu May 21 21:49:44.751950 2026] [:error] [pid 51613:tid 51626] [client 40.113.223.68:4468] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.dj/index.php"] [unique_id "ag8NeGbP0MDvqrVnweoK-AAAAQs"]
[Thu May 21 21:49:45.356600 2026] [:error] [pid 49879:tid 49928] [client 40.113.223.68:6362] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ag8NeYVqYDjFSyG2gFprTwAAAEg"]
[Thu May 21 21:49:46.180555 2026] [:error] [pid 49879:tid 49940] [client 40.113.223.68:1673] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ag8NeoVqYDjFSyG2gFprUQAAAFQ"]
[Thu May 21 21:49:46.983562 2026] [:error] [pid 49884:tid 49949] [client 40.113.223.68:1338] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ag8Neq5MPpsTNNHWS6j_egAAAII"]
[Thu May 21 21:49:47.668046 2026] [:error] [pid 49982:tid 50000] [client 40.113.223.68:2732] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ag8Ne2FwIDa5Tf8O4bYOjwAAANA"]
[Thu May 21 21:49:48.490796 2026] [:error] [pid 49884:tid 49960] [client 40.113.223.68:1325] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ag8NfK5MPpsTNNHWS6j_fgAAAI0"]
[Thu May 21 21:49:49.352406 2026] [:error] [pid 9189:tid 9225] [client 40.113.223.68:6860] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ag8NfZvTDh1NbYizKVzGUwAAAgY"]
[Thu May 21 21:49:50.085575 2026] [:error] [pid 9189:tid 9222] [client 40.113.223.68:1720] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ag8NfpvTDh1NbYizKVzGVAAAAgM"]
[Thu May 21 21:49:50.848940 2026] [:error] [pid 9189:tid 9224] [client 40.113.223.68:1342] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.tmb/"] [unique_id "ag8NfpvTDh1NbYizKVzGVQAAAgU"]
[Thu May 21 21:49:51.909738 2026] [:error] [pid 49982:tid 49999] [client 40.113.223.68:1059] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "ag8Nf2FwIDa5Tf8O4bYOkAAAAM8"]
[Thu May 21 21:49:52.834304 2026] [:error] [pid 9157:tid 9176] [client 40.113.223.68:2691] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "ag8NgMGfHcLNqE8m88KazQAAAZE"]
[Thu May 21 21:49:53.765979 2026] [:error] [pid 49982:tid 49984] [client 40.113.223.68:6190] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "ag8NgWFwIDa5Tf8O4bYOkwAAAMA"]
[Thu May 21 21:49:54.636553 2026] [:error] [pid 49884:tid 49951] [client 40.113.223.68:7598] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/one.php"] [unique_id "ag8Ngq5MPpsTNNHWS6j_hQAAAIQ"]
[Thu May 21 21:49:55.522602 2026] [:error] [pid 9188:tid 9194] [client 40.113.223.68:4198] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sl.php"] [unique_id "ag8Ng7GYm6q5dNSUvA_zJAAAAcI"]
[Thu May 21 21:49:56.150977 2026] [:error] [pid 49884:tid 49955] [client 40.113.223.68:1504] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sl.php"] [unique_id "ag8NhK5MPpsTNNHWS6j_iwAAAIg"]
[Thu May 21 21:49:56.991778 2026] [:error] [pid 9189:tid 9220] [client 40.113.223.68:1026] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sl.php"] [unique_id "ag8NhJvTDh1NbYizKVzGWQAAAgE"]
[Thu May 21 21:49:57.934734 2026] [:error] [pid 9188:tid 9211] [client 40.113.223.68:7593] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sl.php"] [unique_id "ag8NhbGYm6q5dNSUvA_zJQAAAdM"]
[Thu May 21 21:49:58.672454 2026] [:error] [pid 9157:tid 9179] [client 40.113.223.68:4180] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "ag8NhsGfHcLNqE8m88Ka0AAAAZQ"]
[Thu May 21 21:49:59.240294 2026] [:error] [pid 49982:tid 49992] [client 40.113.223.68:1336] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "ag8Nh2FwIDa5Tf8O4bYOlgAAAMg"]
[Thu May 21 21:49:59.772033 2026] [:error] [pid 49982:tid 50007] [client 40.113.223.68:4186] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "ag8Nh2FwIDa5Tf8O4bYOlwAAANc"]
[Thu May 21 21:50:00.471301 2026] [:error] [pid 9157:tid 9182] [client 40.113.223.68:2693] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-temp.php"] [unique_id "ag8NiMGfHcLNqE8m88Ka0gAAAZc"]
[Thu May 21 21:50:00.990136 2026] [:error] [pid 9189:tid 9230] [client 40.113.223.68:1052] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ag8NiJvTDh1NbYizKVzGXgAAAgs"]
[Thu May 21 21:50:01.804202 2026] [:error] [pid 9157:tid 9180] [client 40.113.223.68:5444] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ag8NicGfHcLNqE8m88Ka0wAAAZU"]
[Thu May 21 21:50:02.564413 2026] [:error] [pid 9188:tid 9200] [client 40.113.223.68:1037] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ag8NirGYm6q5dNSUvA_zKQAAAcg"]
[Thu May 21 21:50:03.589936 2026] [:error] [pid 9157:tid 9175] [client 40.113.223.68:6555] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ag8Ni8GfHcLNqE8m88Ka1QAAAZA"]
[Thu May 21 21:50:04.505411 2026] [:error] [pid 49879:tid 49933] [client 40.113.223.68:1317] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "ag8NjIVqYDjFSyG2gFprYQAAAE0"]
[Thu May 21 21:50:05.258937 2026] [:error] [pid 9157:tid 9159] [client 40.113.223.68:1084] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "ag8NjcGfHcLNqE8m88Ka1gAAAYA"]
[Thu May 21 21:50:06.070081 2026] [:error] [pid 49982:tid 50001] [client 40.113.223.68:1290] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "ag8NjmFwIDa5Tf8O4bYOnQAAANE"]
[Thu May 21 21:50:06.674847 2026] [:error] [pid 51613:tid 51629] [client 40.113.223.68:59163] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmu.php"] [unique_id "ag8NjmbP0MDvqrVnweoK_QAAAQ4"]
[Thu May 21 21:50:07.663011 2026] [:error] [pid 9188:tid 9195] [client 40.113.223.68:7160] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "ag8Nj7GYm6q5dNSUvA_zLAAAAcM"]
[Thu May 21 21:50:08.332615 2026] [:error] [pid 9189:tid 9243] [client 40.113.223.68:1093] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "ag8NkJvTDh1NbYizKVzGYwAAAhg"]
[Thu May 21 21:50:08.950921 2026] [:error] [pid 9189:tid 9236] [client 40.113.223.68:7575] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "ag8NkJvTDh1NbYizKVzGZAAAAhE"]
[Thu May 21 21:50:09.789114 2026] [:error] [pid 9188:tid 9194] [client 40.113.223.68:7562] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/mode.php"] [unique_id "ag8NkbGYm6q5dNSUvA_zMAAAAcI"]
[Thu May 21 21:50:10.326202 2026] [:error] [pid 51613:tid 51624] [client 40.113.223.68:6206] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ag8NkmbP0MDvqrVnweoLAAAAAQk"]
[Thu May 21 21:50:11.201069 2026] [:error] [pid 9188:tid 9212] [client 40.113.223.68:7111] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ag8Nk7GYm6q5dNSUvA_zMwAAAdQ"]
[Thu May 21 21:50:11.757099 2026] [:error] [pid 49982:tid 49997] [client 40.113.223.68:7166] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ag8Nk2FwIDa5Tf8O4bYOpQAAAM0"]
[Thu May 21 21:50:13.148077 2026] [:error] [pid 49982:tid 49995] [client 40.113.223.68:1140] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ag8NlWFwIDa5Tf8O4bYOqQAAAMs"]
[Thu May 21 21:50:13.727631 2026] [:error] [pid 9188:tid 9201] [client 40.113.223.68:5174] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ag8NlbGYm6q5dNSUvA_zNgAAAck"]
[Thu May 21 21:50:15.058530 2026] [:error] [pid 9188:tid 9204] [client 40.113.223.68:7571] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ag8Nl7GYm6q5dNSUvA_zOQAAAcw"]
[Thu May 21 21:50:15.903774 2026] [:error] [pid 9188:tid 9208] [client 40.113.223.68:4185] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ag8Nl7GYm6q5dNSUvA_zOgAAAdA"]
[Thu May 21 21:50:16.838216 2026] [:error] [pid 9188:tid 9211] [client 40.113.223.68:3783] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ag8NmLGYm6q5dNSUvA_zOwAAAdM"]
[Thu May 21 21:50:17.478130 2026] [:error] [pid 9157:tid 9166] [client 40.113.223.68:59512] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/puc.php"] [unique_id "ag8NmcGfHcLNqE8m88Ka4gAAAYc"]
[Thu May 21 21:50:18.221782 2026] [:error] [pid 9188:tid 9198] [client 40.113.223.68:4191] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/puc.php"] [unique_id "ag8NmrGYm6q5dNSUvA_zPQAAAcY"]
[Thu May 21 21:50:18.802050 2026] [:error] [pid 49877:tid 49902] [client 40.113.223.68:1129] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/puc.php"] [unique_id "ag8NmhgN4MeSe4kIL9BCQAAAAA4"]
[Thu May 21 21:50:19.527633 2026] [:error] [pid 49877:tid 49908] [client 40.113.223.68:1094] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/puc.php"] [unique_id "ag8NmxgN4MeSe4kIL9BCQQAAABQ"]
[Thu May 21 21:50:20.451388 2026] [:error] [pid 9189:tid 9242] [client 40.113.223.68:5065] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "ag8NnJvTDh1NbYizKVzGagAAAhc"]
[Thu May 21 21:50:21.208981 2026] [:error] [pid 9157:tid 9165] [client 40.113.223.68:7572] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "ag8NncGfHcLNqE8m88Ka5QAAAYY"]
[Thu May 21 21:50:21.823524 2026] [:error] [pid 9188:tid 9214] [client 40.113.223.68:2181] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "ag8NnbGYm6q5dNSUvA_zPwAAAdY"]
[Thu May 21 21:50:22.353526 2026] [:error] [pid 9157:tid 9180] [client 40.113.223.68:7732] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/themes.php"] [unique_id "ag8NnsGfHcLNqE8m88Ka5gAAAZU"]
[Thu May 21 21:50:23.030019 2026] [:error] [pid 9189:tid 9226] [client 40.113.223.68:5070] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ag8Nn5vTDh1NbYizKVzGbQAAAgc"]
[Thu May 21 21:50:23.566565 2026] [:error] [pid 9157:tid 9172] [client 40.113.223.68:1092] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dx.php"] [unique_id "ag8Nn8GfHcLNqE8m88Ka5wAAAY0"]
[Thu May 21 21:50:24.152410 2026] [:error] [pid 49982:tid 50006] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Thu May 21 21:50:24.359751 2026] [:error] [pid 49982:tid 50005] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/awa.php
[Thu May 21 21:50:24.555171 2026] [:error] [pid 49982:tid 49987] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Thu May 21 21:50:24.755521 2026] [:error] [pid 49982:tid 50007] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Thu May 21 21:50:25.142825 2026] [:error] [pid 49982:tid 49995] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Thu May 21 21:50:25.335139 2026] [:error] [pid 49982:tid 49991] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Thu May 21 21:50:25.537619 2026] [:error] [pid 49982:tid 49988] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Thu May 21 21:50:25.728669 2026] [:error] [pid 49982:tid 49999] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Thu May 21 21:50:25.930793 2026] [:error] [pid 49982:tid 49994] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu May 21 21:50:26.121758 2026] [:error] [pid 49982:tid 49984] [client 40.113.223.68:2931] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu May 21 21:50:26.314943 2026] [:error] [pid 49982:tid 50000] [client 40.113.223.68:2931] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "ag8NomFwIDa5Tf8O4bYOuQAAANA"]
[Thu May 21 21:50:27.033066 2026] [:error] [pid 9157:tid 9161] [client 40.113.223.68:5168] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "ag8No8GfHcLNqE8m88Ka6wAAAYI"]
[Thu May 21 21:50:27.881140 2026] [:error] [pid 9157:tid 9173] [client 40.113.223.68:3658] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "ag8No8GfHcLNqE8m88Ka7QAAAY4"]
[Thu May 21 21:50:28.550535 2026] [:error] [pid 9114:tid 9132] [client 40.113.223.68:7373] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/100.php"] [unique_id "ag8NpG8FiJqDBEoTvqyFYQAAAVA"]
[Thu May 21 21:50:29.284300 2026] [:error] [pid 9189:tid 9237] [client 40.113.223.68:7697] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "ag8NpZvTDh1NbYizKVzGcAAAAhI"]
[Thu May 21 21:50:29.877569 2026] [:error] [pid 9114:tid 9137] [client 40.113.223.68:5208] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "ag8NpW8FiJqDBEoTvqyFYgAAAVU"]
[Thu May 21 21:50:30.619452 2026] [:error] [pid 51613:tid 51632] [client 40.113.223.68:1054] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "ag8NpmbP0MDvqrVnweoLBgAAARE"]
[Thu May 21 21:50:31.400911 2026] [:error] [pid 49884:tid 49953] [client 40.113.223.68:5169] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/2026w.php"] [unique_id "ag8Np65MPpsTNNHWS6j_ogAAAIY"]
[Thu May 21 21:50:32.541299 2026] [:error] [pid 9157:tid 9182] [client 40.113.223.68:6166] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ag8NqMGfHcLNqE8m88Ka8QAAAZc"]
[Thu May 21 21:50:33.114488 2026] [:error] [pid 9189:tid 9232] [client 40.113.223.68:7147] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ag8NqZvTDh1NbYizKVzGcQAAAg0"]
[Thu May 21 21:50:33.875124 2026] [:error] [pid 49982:tid 49996] [client 40.113.223.68:6181] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ag8NqWFwIDa5Tf8O4bYOvAAAAMw"]
[Thu May 21 21:50:34.509663 2026] [:error] [pid 49982:tid 49992] [client 40.113.223.68:7129] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ag8NqmFwIDa5Tf8O4bYOvQAAAMg"]
[Thu May 21 21:50:36.153641 2026] [:error] [pid 49884:tid 49971] [client 40.113.223.68:1071] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "ag8NrK5MPpsTNNHWS6j_pQAAAJg"]
[Thu May 21 21:50:37.342005 2026] [:error] [pid 49884:tid 49947] [client 40.113.223.68:4166] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "ag8Nra5MPpsTNNHWS6j_pwAAAIA"]
[Thu May 21 21:50:38.161070 2026] [:error] [pid 49884:tid 49958] [client 40.113.223.68:1119] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "ag8Nrq5MPpsTNNHWS6j_qQAAAIs"]
[Thu May 21 21:50:38.757967 2026] [:error] [pid 49877:tid 49912] [client 40.113.223.68:5090] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xa.php"] [unique_id "ag8NrhgN4MeSe4kIL9BCRAAAABg"]
[Thu May 21 21:50:39.361769 2026] [:error] [pid 49879:tid 49921] [client 40.113.223.68:1050] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ag8Nr4VqYDjFSyG2gFprawAAAEE"]
[Thu May 21 21:50:41.322997 2026] [:error] [pid 9189:tid 9222] [client 40.113.223.68:6018] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ag8NsZvTDh1NbYizKVzGegAAAgM"]
[Thu May 21 21:50:42.623566 2026] [:error] [pid 49879:tid 49937] [client 40.113.223.68:1095] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ag8NsoVqYDjFSyG2gFprbQAAAFE"]
[Thu May 21 21:50:43.072076 2026] [:error] [pid 9188:tid 9213] [client 40.113.223.68:3509] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ag8Ns7GYm6q5dNSUvA_zSwAAAdU"]
[Thu May 21 21:50:43.651754 2026] [:error] [pid 9188:tid 9197] [client 40.113.223.68:59030] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "ag8Ns7GYm6q5dNSUvA_zTQAAAcU"]
[Thu May 21 21:50:44.333934 2026] [:error] [pid 9189:tid 9220] [client 40.113.223.68:5907] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "ag8NtJvTDh1NbYizKVzGfQAAAgE"]
[Thu May 21 21:50:45.499034 2026] [:error] [pid 9188:tid 9206] [client 40.113.223.68:6253] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "ag8NtbGYm6q5dNSUvA_zUQAAAc4"]
[Thu May 21 21:50:46.369204 2026] [:error] [pid 9188:tid 9201] [client 40.113.223.68:7137] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/w2025.php"] [unique_id "ag8NtrGYm6q5dNSUvA_zUwAAAck"]
[Thu May 21 21:50:47.144335 2026] [:error] [pid 9188:tid 9193] [client 40.113.223.68:59482] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "ag8Nt7GYm6q5dNSUvA_zVwAAAcE"]
[Thu May 21 21:50:47.809146 2026] [:error] [pid 49879:tid 49936] [client 40.113.223.68:5104] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "ag8Nt4VqYDjFSyG2gFprcgAAAFA"]
[Thu May 21 21:50:48.890955 2026] [:error] [pid 9188:tid 9197] [client 40.113.223.68:58970] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "ag8NuLGYm6q5dNSUvA_zWgAAAcU"]
[Thu May 21 21:50:49.498812 2026] [:error] [pid 49877:tid 49911] [client 40.113.223.68:6183] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fvvff.php"] [unique_id "ag8NuRgN4MeSe4kIL9BCSQAAABc"]
[Thu May 21 21:50:50.218347 2026] [:error] [pid 49879:tid 49920] [client 40.113.223.68:5810] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ag8NuoVqYDjFSyG2gFprdAAAAEA"]
[Thu May 21 21:50:51.029522 2026] [:error] [pid 9114:tid 9135] [client 40.113.223.68:1871] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ag8Nu28FiJqDBEoTvqyFagAAAVM"]
[Thu May 21 21:50:52.273593 2026] [:error] [pid 9188:tid 9209] [client 40.113.223.68:7106] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ag8NvLGYm6q5dNSUvA_zXgAAAdE"]
[Thu May 21 21:50:52.891530 2026] [:error] [pid 9114:tid 9130] [client 40.113.223.68:1865] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ag8NvG8FiJqDBEoTvqyFbAAAAU4"]
[Thu May 21 21:50:53.973438 2026] [:error] [pid 49879:tid 49934] [client 40.113.223.68:5235] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ag8NvYVqYDjFSyG2gFpreAAAAE4"]
[Thu May 21 21:50:54.537209 2026] [:error] [pid 49879:tid 49925] [client 40.113.223.68:1874] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ag8NvoVqYDjFSyG2gFpregAAAEU"]
[Thu May 21 21:50:55.381927 2026] [:error] [pid 49879:tid 49933] [client 40.113.223.68:1862] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ag8Nv4VqYDjFSyG2gFprewAAAE0"]
[Thu May 21 21:50:56.273973 2026] [:error] [pid 9188:tid 9192] [client 40.113.223.68:4955] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin.php"] [unique_id "ag8NwLGYm6q5dNSUvA_zYwAAAcA"]
[Thu May 21 21:50:57.385612 2026] [:error] [pid 49982:tid 49995] [client 40.113.223.68:2017] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "ag8NwWFwIDa5Tf8O4bYOwwAAAMs"]
[Thu May 21 21:50:58.340180 2026] [:error] [pid 49982:tid 49991] [client 40.113.223.68:6187] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "ag8NwmFwIDa5Tf8O4bYOxQAAAMc"]
[Thu May 21 21:50:59.353607 2026] [:error] [pid 9189:tid 9225] [client 40.113.223.68:1239] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "ag8Nw5vTDh1NbYizKVzGgAAAAgY"]
[Thu May 21 21:51:00.291106 2026] [:error] [pid 51613:tid 51623] [client 40.113.223.68:5142] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/admin.php"] [unique_id "ag8NxGbP0MDvqrVnweoLEgAAAQg"]
[Thu May 21 21:51:01.030357 2026] [:error] [pid 9188:tid 9215] [client 40.113.223.68:6151] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "ag8NxbGYm6q5dNSUvA_zaQAAAdc"]
[Thu May 21 21:51:02.289126 2026] [:error] [pid 51613:tid 51615] [client 40.113.223.68:8021] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "ag8NxmbP0MDvqrVnweoLFAAAAQA"]
[Thu May 21 21:51:03.389418 2026] [:error] [pid 9188:tid 9193] [client 40.113.223.68:6150] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "ag8Nx7GYm6q5dNSUvA_zbQAAAcE"]
[Thu May 21 21:51:04.340396 2026] [:error] [pid 49884:tid 49964] [client 40.113.223.68:2908] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f6.php"] [unique_id "ag8NyK5MPpsTNNHWS6j_rwAAAJE"]
[Thu May 21 21:51:05.118703 2026] [:error] [pid 9189:tid 9239] [client 40.113.223.68:1120] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "ag8NyZvTDh1NbYizKVzGhAAAAhQ"]
[Thu May 21 21:51:06.207314 2026] [:error] [pid 9188:tid 9207] [client 40.113.223.68:5798] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "ag8NyrGYm6q5dNSUvA_zcAAAAc8"]
[Thu May 21 21:51:07.163208 2026] [:error] [pid 9157:tid 9172] [client 40.113.223.68:5128] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "ag8Ny8GfHcLNqE8m88Ka-AAAAY0"]
[Thu May 21 21:51:07.894220 2026] [:error] [pid 9189:tid 9233] [client 40.113.223.68:4723] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/inputs.php"] [unique_id "ag8Ny5vTDh1NbYizKVzGhQAAAg4"]
[Thu May 21 21:51:08.443841 2026] [:error] [pid 9189:tid 9236] [client 40.113.223.68:1062] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ag8NzJvTDh1NbYizKVzGhgAAAhE"]
[Thu May 21 21:51:09.676538 2026] [:error] [pid 9189:tid 9235] [client 40.113.223.68:1233] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ag8NzZvTDh1NbYizKVzGiAAAAhA"]
[Thu May 21 21:51:10.924996 2026] [:error] [pid 9157:tid 9174] [client 40.113.223.68:1098] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ag8NzsGfHcLNqE8m88Ka-gAAAY8"]
[Thu May 21 21:51:12.038788 2026] [:error] [pid 49879:tid 49923] [client 40.113.223.68:1136] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ag8N0IVqYDjFSyG2gFprhQAAAEM"]
[Thu May 21 21:51:12.914086 2026] [:error] [pid 9157:tid 9161] [client 40.113.223.68:7469] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ag8N0MGfHcLNqE8m88Ka_AAAAYI"]
[Thu May 21 21:51:14.789558 2026] [:error] [pid 51613:tid 51633] [client 40.113.223.68:58947] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ag8N0mbP0MDvqrVnweoLGAAAARI"]
[Thu May 21 21:51:15.560582 2026] [:error] [pid 9157:tid 9181] [client 40.113.223.68:59508] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ag8N08GfHcLNqE8m88Ka_gAAAZY"]
[Thu May 21 21:51:16.502642 2026] [:error] [pid 9189:tid 9238] [client 40.113.223.68:7431] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "ag8N1JvTDh1NbYizKVzGkgAAAhM"]
[Thu May 21 21:51:17.643825 2026] [:error] [pid 9188:tid 9203] [client 40.113.223.68:1061] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "ag8N1bGYm6q5dNSUvA_zegAAAcs"]
[Thu May 21 21:51:18.236565 2026] [:error] [pid 9157:tid 9179] [client 40.113.223.68:7114] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "ag8N1sGfHcLNqE8m88KbAAAAAZQ"]
[Thu May 21 21:51:19.229114 2026] [:error] [pid 49884:tid 49969] [client 40.113.223.68:1102] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "ag8N165MPpsTNNHWS6j_uwAAAJY"]
[Thu May 21 21:51:20.231876 2026] [:error] [pid 9114:tid 9137] [client 40.113.223.68:8077] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-act.php"] [unique_id "ag8N2G8FiJqDBEoTvqyFdAAAAVU"]
[Thu May 21 21:51:21.023724 2026] [:error] [pid 49884:tid 49960] [client 40.113.223.68:1131] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ag8N2a5MPpsTNNHWS6j_vgAAAI0"]
[Thu May 21 21:51:21.711751 2026] [:error] [pid 49877:tid 49908] [client 40.113.223.68:4672] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ag8N2RgN4MeSe4kIL9BCVgAAABQ"]
[Thu May 21 21:51:22.770277 2026] [:error] [pid 49982:tid 50007] [client 40.113.223.68:2224] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ag8N2mFwIDa5Tf8O4bYOzAAAANc"]
[Thu May 21 21:51:23.346857 2026] [:error] [pid 49884:tid 49958] [client 40.113.223.68:1106] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/classwithtostring.php"] [unique_id "ag8N265MPpsTNNHWS6j_wwAAAIs"]
[Thu May 21 21:51:24.197804 2026] [:error] [pid 51613:tid 51629] [client 40.113.223.68:5772] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ag8N3GbP0MDvqrVnweoLHQAAAQ4"]
[Thu May 21 21:51:24.744219 2026] [:error] [pid 49884:tid 49962] [client 40.113.223.68:5181] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ag8N3K5MPpsTNNHWS6j_yAAAAI8"]
[Thu May 21 21:51:25.402663 2026] [:error] [pid 9157:tid 9178] [client 40.113.223.68:7348] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ag8N3cGfHcLNqE8m88KbBgAAAZM"]
[Thu May 21 21:51:26.642122 2026] [:error] [pid 49982:tid 50000] [client 40.113.223.68:7130] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu May 21 21:51:27.292913 2026] [:error] [pid 49982:tid 49992] [client 40.113.223.68:7130] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu May 21 21:51:27.553294 2026] [:error] [pid 49982:tid 49990] [client 40.113.223.68:7130] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu May 21 21:51:27.745727 2026] [:error] [pid 49982:tid 50002] [client 40.113.223.68:7130] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Thu May 21 21:51:27.959785 2026] [:error] [pid 49982:tid 49997] [client 40.113.223.68:7130] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Thu May 21 21:51:28.631547 2026] [:error] [pid 49982:tid 49987] [client 40.113.223.68:7130] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Thu May 21 21:51:28.820529 2026] [:error] [pid 49982:tid 50007] [client 40.113.223.68:7130] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ag8N4GFwIDa5Tf8O4bYO2gAAANc"]
[Thu May 21 21:51:29.703015 2026] [:error] [pid 9189:tid 9221] [client 40.113.223.68:7684] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ag8N4ZvTDh1NbYizKVzGmAAAAgI"]
[Thu May 21 21:51:30.606756 2026] [:error] [pid 49982:tid 50001] [client 40.113.223.68:1025] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ag8N4mFwIDa5Tf8O4bYO2wAAANE"]
[Thu May 21 21:51:31.090750 2026] [:error] [pid 9189:tid 9224] [client 40.113.223.68:5798] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/l10n/"] [unique_id "ag8N45vTDh1NbYizKVzGmQAAAgU"]
[Thu May 21 21:51:31.990672 2026] [:error] [pid 9188:tid 9200] [client 40.113.223.68:1039] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/"] [unique_id "ag8N47GYm6q5dNSUvA_zfAAAAcg"]
[Thu May 21 21:51:32.867892 2026] [:error] [pid 9157:tid 9182] [client 40.113.223.68:5255] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/"] [unique_id "ag8N5MGfHcLNqE8m88KbCQAAAZc"]
[Thu May 21 21:51:33.540306 2026] [:error] [pid 9157:tid 9172] [client 40.113.223.68:6097] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/"] [unique_id "ag8N5cGfHcLNqE8m88KbCgAAAY0"]
[Thu May 21 21:51:34.351944 2026] [:error] [pid 9157:tid 9159] [client 40.113.223.68:5304] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/"] [unique_id "ag8N5sGfHcLNqE8m88KbDAAAAYA"]
[Thu May 21 21:51:35.387106 2026] [:error] [pid 51613:tid 51619] [client 40.113.223.68:7572] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "ag8N52bP0MDvqrVnweoLIAAAAQQ"]
[Thu May 21 21:51:35.959669 2026] [:error] [pid 51613:tid 51621] [client 40.113.223.68:3816] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "ag8N52bP0MDvqrVnweoLIQAAAQY"]
[Thu May 21 21:51:36.587426 2026] [:error] [pid 51613:tid 51628] [client 40.113.223.68:5185] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "ag8N6GbP0MDvqrVnweoLIwAAAQ0"]
[Thu May 21 21:51:37.309783 2026] [:error] [pid 9114:tid 9130] [client 40.113.223.68:6169] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp.php"] [unique_id "ag8N6W8FiJqDBEoTvqyFewAAAU4"]
[Thu May 21 21:51:37.888666 2026] [:error] [pid 49877:tid 49903] [client 40.113.223.68:7138] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ag8N6RgN4MeSe4kIL9BCXQAAAA8"]
[Thu May 21 21:51:38.580884 2026] [:error] [pid 49877:tid 49909] [client 40.113.223.68:1579] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ag8N6hgN4MeSe4kIL9BCXwAAABU"]
[Thu May 21 21:51:39.186143 2026] [:error] [pid 51613:tid 51626] [client 40.113.223.68:5259] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ag8N62bP0MDvqrVnweoLJwAAAQs"]
[Thu May 21 21:51:39.819603 2026] [:error] [pid 49982:tid 49991] [client 40.113.223.68:5166] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ag8N62FwIDa5Tf8O4bYO3QAAAMc"]
[Thu May 21 21:51:41.332125 2026] [:error] [pid 9114:tid 9118] [client 40.113.223.68:7135] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ag8N7W8FiJqDBEoTvqyFfQAAAUI"]
[Thu May 21 21:51:42.092458 2026] [:error] [pid 49884:tid 49949] [client 40.113.223.68:2499] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ag8N7q5MPpsTNNHWS6j_0gAAAII"]
[Thu May 21 21:51:43.089847 2026] [:error] [pid 49982:tid 49994] [client 40.113.223.68:7027] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ag8N72FwIDa5Tf8O4bYO4AAAAMo"]
[Thu May 21 21:51:43.697400 2026] [:error] [pid 49877:tid 49912] [client 40.113.223.68:3776] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/av.php"] [unique_id "ag8N7xgN4MeSe4kIL9BCYgAAABg"]
[Thu May 21 21:51:44.565990 2026] [:error] [pid 49982:tid 49984] [client 40.113.223.68:6178] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "ag8N8GFwIDa5Tf8O4bYO4QAAAMA"]
[Thu May 21 21:51:45.403215 2026] [:error] [pid 49877:tid 49891] [client 40.113.223.68:58950] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "ag8N8RgN4MeSe4kIL9BCYwAAAAM"]
[Thu May 21 21:51:46.239546 2026] [:error] [pid 49982:tid 50002] [client 40.113.223.68:7322] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "ag8N8mFwIDa5Tf8O4bYO4gAAANI"]
[Thu May 21 21:51:47.163758 2026] [:error] [pid 49877:tid 49892] [client 40.113.223.68:7680] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/abcd.php"] [unique_id "ag8N8xgN4MeSe4kIL9BCZgAAAAQ"]
[Thu May 21 21:51:48.125476 2026] [:error] [pid 49982:tid 49987] [client 40.113.223.68:2975] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "ag8N9GFwIDa5Tf8O4bYO5QAAAMM"]
[Thu May 21 21:51:48.836874 2026] [:error] [pid 9189:tid 9219] [client 40.113.223.68:2651] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "ag8N9JvTDh1NbYizKVzGpQAAAgA"]
[Thu May 21 21:51:49.818674 2026] [:error] [pid 49884:tid 49969] [client 40.113.223.68:7320] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "ag8N9a5MPpsTNNHWS6j_2AAAAJY"]
[Thu May 21 21:51:50.814665 2026] [:error] [pid 9157:tid 9159] [client 40.113.223.68:1105] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/a1.php"] [unique_id "ag8N9sGfHcLNqE8m88KbEQAAAYA"]
[Thu May 21 21:51:51.433919 2026] [:error] [pid 9189:tid 9224] [client 40.113.223.68:5153] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "ag8N95vTDh1NbYizKVzGrQAAAgU"]
[Thu May 21 21:51:52.179009 2026] [:error] [pid 9189:tid 9235] [client 40.113.223.68:1148] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "ag8N-JvTDh1NbYizKVzGtAAAAhA"]
[Thu May 21 21:51:52.877332 2026] [:error] [pid 49982:tid 49999] [client 40.113.223.68:2969] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "ag8N-GFwIDa5Tf8O4bYO6wAAAM8"]
[Thu May 21 21:51:53.611388 2026] [:error] [pid 49884:tid 49956] [client 40.113.223.68:6706] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/update/f35.php"] [unique_id "ag8N-a5MPpsTNNHWS6j_2wAAAIk"]
[Thu May 21 21:51:54.476345 2026] [:error] [pid 49982:tid 49992] [client 40.113.223.68:5102] [client 40.113.223.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ag8N-mFwIDa5Tf8O4bYO7gAAAMg"]
[Thu May 21 21:51:56.092541 2026] [:error] [pid 49982:tid 50001] [client 40.113.223.68:6147] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "ag8N_GFwIDa5Tf8O4bYO8QAAANE"]
[Thu May 21 21:51:56.717190 2026] [:error] [pid 49879:tid 49930] [client 40.113.223.68:6676] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "ag8N_IVqYDjFSyG2gFprjwAAAEo"]
[Thu May 21 21:51:57.303754 2026] [:error] [pid 9157:tid 9175] [client 40.113.223.68:6657] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/f35.php"] [unique_id "ag8N_cGfHcLNqE8m88KbEgAAAZA"]
[Thu May 21 21:51:58.198158 2026] [:error] [pid 49884:tid 49948] [client 40.113.223.68:1145] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ag8N_q5MPpsTNNHWS6j_3wAAAIE"]
[Thu May 21 21:51:58.840712 2026] [:error] [pid 49884:tid 49955] [client 40.113.223.68:6705] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ag8N_q5MPpsTNNHWS6j_4QAAAIg"]
[Thu May 21 21:51:59.593280 2026] [:error] [pid 9188:tid 9196] [client 40.113.223.68:7917] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ag8N_7GYm6q5dNSUvA_zgQAAAcQ"]
[Thu May 21 21:52:00.152797 2026] [:error] [pid 9189:tid 9237] [client 40.113.223.68:59650] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ag8OAJvTDh1NbYizKVzGwAAAAhI"]
[Thu May 21 21:52:00.723828 2026] [:error] [pid 49982:tid 50003] [client 40.113.223.68:61648] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ag8OAGFwIDa5Tf8O4bYO9AAAANM"]
[Thu May 21 21:52:01.472383 2026] [:error] [pid 9189:tid 9231] [client 40.113.223.68:2536] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ag8OAZvTDh1NbYizKVzGwQAAAgw"]
[Thu May 21 21:52:02.460038 2026] [:error] [pid 49982:tid 49993] [client 40.113.223.68:2102] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ag8OAmFwIDa5Tf8O4bYO_AAAAMk"]
[Thu May 21 21:52:02.932188 2026] [:error] [pid 9189:tid 9226] [client 40.113.223.68:61684] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/bal.php"] [unique_id "ag8OApvTDh1NbYizKVzGwgAAAgc"]
[Thu May 21 21:52:03.426895 2026] [:error] [pid 9188:tid 9210] [client 40.113.223.68:61685] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ag8OA7GYm6q5dNSUvA_zhAAAAdI"]
[Thu May 21 21:52:04.158734 2026] [:error] [pid 49982:tid 49988] [client 40.113.223.68:61681] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ag8OBGFwIDa5Tf8O4bYO_wAAAMQ"]
[Thu May 21 21:52:04.781407 2026] [:error] [pid 49884:tid 49971] [client 40.113.223.68:59657] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ag8OBK5MPpsTNNHWS6j_8QAAAJg"]
[Thu May 21 21:52:05.730433 2026] [:error] [pid 49884:tid 49956] [client 40.113.223.68:7929] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cgi-bin/admin.php"] [unique_id "ag8OBa5MPpsTNNHWS6j_-QAAAIk"]
[Thu May 21 21:52:06.625021 2026] [:error] [pid 49879:tid 49940] [client 40.113.223.68:6774] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ag8OBoVqYDjFSyG2gFprlwAAAFQ"]
[Thu May 21 21:52:07.353704 2026] [:error] [pid 49884:tid 49968] [client 40.113.223.68:3727] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ag8OB65MPpsTNNHWS6j__QAAAJU"]
[Thu May 21 21:52:08.149453 2026] [:error] [pid 49982:tid 50005] [client 40.113.223.68:61636] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ag8OCGFwIDa5Tf8O4bYPBQAAANU"]
[Thu May 21 21:52:08.842440 2026] [:error] [pid 9188:tid 9194] [client 40.113.223.68:5748] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ag8OCLGYm6q5dNSUvA_zigAAAcI"]
[Thu May 21 21:52:09.572019 2026] [:error] [pid 9189:tid 9219] [client 40.113.223.68:4272] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ag8OCZvTDh1NbYizKVzG0gAAAgA"]
[Thu May 21 21:52:10.392867 2026] [:error] [pid 49884:tid 49953] [client 40.113.223.68:59689] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ag8OCq5MPpsTNNHWS6gAAwAAAIY"]
[Thu May 21 21:52:11.063187 2026] [:error] [pid 49982:tid 49989] [client 40.113.223.68:8314] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ag8OC2FwIDa5Tf8O4bYPCQAAAMU"]
[Thu May 21 21:52:11.815651 2026] [:error] [pid 49879:tid 49922] [client 40.113.223.68:2247] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/gettest.php"] [unique_id "ag8OC4VqYDjFSyG2gFprmwAAAEI"]
[Thu May 21 21:52:12.926956 2026] [:error] [pid 49884:tid 49965] [client 40.113.223.68:4278] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/BypassBest.php"] [unique_id "ag8ODK5MPpsTNNHWS6gACgAAAJI"]
[Thu May 21 21:52:13.542374 2026] [:error] [pid 9189:tid 9233] [client 40.113.223.68:8304] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/BypassBest.php"] [unique_id "ag8ODZvTDh1NbYizKVzG2AAAAg4"]
[Thu May 21 21:52:14.270862 2026] [:error] [pid 49884:tid 49954] [client 40.113.223.68:3165] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/BypassBest.php"] [unique_id "ag8ODq5MPpsTNNHWS6gADgAAAIc"]
[Thu May 21 21:52:15.195731 2026] [:error] [pid 49884:tid 49955] [client 40.113.223.68:3723] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/BypassBest.php"] [unique_id "ag8OD65MPpsTNNHWS6gADwAAAIg"]
[Thu May 21 21:52:15.885893 2026] [:error] [pid 49884:tid 49962] [client 40.113.223.68:6665] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "ag8OD65MPpsTNNHWS6gAEgAAAI8"]
[Thu May 21 21:52:16.780688 2026] [:error] [pid 49884:tid 49961] [client 40.113.223.68:6185] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "ag8OEK5MPpsTNNHWS6gAFAAAAI4"]
[Thu May 21 21:52:17.293352 2026] [:error] [pid 49884:tid 49959] [client 40.113.223.68:2896] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "ag8OEa5MPpsTNNHWS6gAFwAAAIw"]
[Thu May 21 21:52:18.321081 2026] [:error] [pid 9189:tid 9228] [client 40.113.223.68:3148] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-content/"] [unique_id "ag8OEpvTDh1NbYizKVzG3wAAAgk"]
[Thu May 21 21:52:19.194401 2026] [:error] [pid 9189:tid 9222] [client 40.113.223.68:6683] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "ag8OE5vTDh1NbYizKVzG4AAAAgM"]
[Thu May 21 21:52:19.843969 2026] [:error] [pid 49884:tid 49962] [client 40.113.223.68:7349] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "ag8OE65MPpsTNNHWS6gAGQAAAI8"]
[Thu May 21 21:52:21.002534 2026] [:error] [pid 9188:tid 9202] [client 40.113.223.68:5236] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "ag8OFbGYm6q5dNSUvA_zkQAAAco"]
[Thu May 21 21:52:21.681501 2026] [:error] [pid 49884:tid 49953] [client 40.113.223.68:7167] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/simple.php"] [unique_id "ag8OFa5MPpsTNNHWS6gAHwAAAIY"]
[Thu May 21 21:52:22.342497 2026] [:error] [pid 49884:tid 49971] [client 40.113.223.68:8298] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buy.php"] [unique_id "ag8OFq5MPpsTNNHWS6gAIwAAAJg"]
[Thu May 21 21:52:23.104606 2026] [:error] [pid 49982:tid 49993] [client 40.113.223.68:7299] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buy.php"] [unique_id "ag8OF2FwIDa5Tf8O4bYPDQAAAMk"]
[Thu May 21 21:52:24.009201 2026] [:error] [pid 49982:tid 49995] [client 40.113.223.68:6553] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buy.php"] [unique_id "ag8OGGFwIDa5Tf8O4bYPEgAAAMs"]
[Thu May 21 21:52:24.626361 2026] [:error] [pid 49884:tid 49963] [client 40.113.223.68:59516] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/buy.php"] [unique_id "ag8OGK5MPpsTNNHWS6gAJwAAAJA"]
[Thu May 21 21:52:25.287453 2026] [:error] [pid 49884:tid 49950] [client 40.113.223.68:2827] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "ag8OGa5MPpsTNNHWS6gAKwAAAIM"]
[Thu May 21 21:52:25.756657 2026] [:error] [pid 49884:tid 49952] [client 40.113.223.68:6794] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "ag8OGa5MPpsTNNHWS6gALAAAAIU"]
[Thu May 21 21:52:26.253874 2026] [:error] [pid 49982:tid 49986] [client 40.113.223.68:4967] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "ag8OGmFwIDa5Tf8O4bYPFwAAAMI"]
[Thu May 21 21:52:26.902095 2026] [:error] [pid 49982:tid 49993] [client 40.113.223.68:5568] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xxx.php"] [unique_id "ag8OGmFwIDa5Tf8O4bYPGwAAAMk"]
[Thu May 21 21:52:27.665695 2026] [:error] [pid 49982:tid 49991] [client 40.113.223.68:59492] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/hypo.php"] [unique_id "ag8OG2FwIDa5Tf8O4bYPHQAAAMc"]
[Thu May 21 21:52:28.499829 2026] [:error] [pid 49982:tid 50003] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/hypo.php
[Thu May 21 21:52:28.967204 2026] [:error] [pid 49982:tid 50001] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu May 21 21:52:29.440893 2026] [:error] [pid 49982:tid 49990] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/00.php
[Thu May 21 21:52:29.633915 2026] [:error] [pid 49982:tid 50006] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/als.php
[Thu May 21 21:52:29.826575 2026] [:error] [pid 49982:tid 50007] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/pol.php
[Thu May 21 21:52:30.019329 2026] [:error] [pid 49982:tid 50000] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-amdin.php
[Thu May 21 21:52:30.210840 2026] [:error] [pid 49982:tid 49995] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Thu May 21 21:52:30.404928 2026] [:error] [pid 49982:tid 49994] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu May 21 21:52:30.714552 2026] [:error] [pid 49982:tid 50008] [client 40.113.223.68:6534] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Thu May 21 21:52:30.961005 2026] [:error] [pid 49982:tid 49989] [client 40.113.223.68:6534] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4PJcpMFsD8B.php"] [unique_id "ag8OHmFwIDa5Tf8O4bYPLgAAAMU"]
[Thu May 21 21:52:31.446527 2026] [:error] [pid 51613:tid 51636] [client 40.113.223.68:7950] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4PJcpMFsD8B.php"] [unique_id "ag8OH2bP0MDvqrVnweoLOAAAARU"]
[Thu May 21 21:52:31.986959 2026] [:error] [pid 49879:tid 49941] [client 40.113.223.68:2573] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4PJcpMFsD8B.php"] [unique_id "ag8OH4VqYDjFSyG2gFprnQAAAFU"]
[Thu May 21 21:52:32.775216 2026] [:error] [pid 51613:tid 51622] [client 40.113.223.68:2341] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/4PJcpMFsD8B.php"] [unique_id "ag8OIGbP0MDvqrVnweoLOwAAAQc"]
[Thu May 21 21:52:33.843439 2026] [:error] [pid 51613:tid 51630] [client 40.113.223.68:59392] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "ag8OIWbP0MDvqrVnweoLPgAAAQ8"]
[Thu May 21 21:52:34.545332 2026] [:error] [pid 9188:tid 9207] [client 40.113.223.68:7148] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "ag8OIrGYm6q5dNSUvA_zlQAAAc8"]
[Thu May 21 21:52:35.436907 2026] [:error] [pid 49884:tid 49960] [client 40.113.223.68:1652] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "ag8OI65MPpsTNNHWS6gAMwAAAI0"]
[Thu May 21 21:52:35.939664 2026] [:error] [pid 51613:tid 51635] [client 40.113.223.68:4958] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file.php"] [unique_id "ag8OI2bP0MDvqrVnweoLQQAAARQ"]
[Thu May 21 21:52:36.711429 2026] [:error] [pid 49884:tid 49951] [client 40.113.223.68:2917] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cfile.php"] [unique_id "ag8OJK5MPpsTNNHWS6gANQAAAIQ"]
[Thu May 21 21:52:37.328789 2026] [:error] [pid 49884:tid 49950] [client 40.113.223.68:7525] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cfile.php"] [unique_id "ag8OJa5MPpsTNNHWS6gAOAAAAIM"]
[Thu May 21 21:52:38.055112 2026] [:error] [pid 51613:tid 51618] [client 40.113.223.68:5685] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cfile.php"] [unique_id "ag8OJmbP0MDvqrVnweoLRQAAAQM"]
[Thu May 21 21:52:38.877010 2026] [:error] [pid 51613:tid 51624] [client 40.113.223.68:1448] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cfile.php"] [unique_id "ag8OJmbP0MDvqrVnweoLRwAAAQk"]
[Thu May 21 21:52:39.936509 2026] [:error] [pid 49879:tid 49932] [client 40.113.223.68:59118] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp.php"] [unique_id "ag8OJ4VqYDjFSyG2gFprowAAAEw"]
[Thu May 21 21:52:40.614057 2026] [:error] [pid 9189:tid 9243] [client 40.113.223.68:1419] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp.php"] [unique_id "ag8OKJvTDh1NbYizKVzG5wAAAhg"]
[Thu May 21 21:52:41.302805 2026] [:error] [pid 9188:tid 9216] [client 40.113.223.68:59083] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp.php"] [unique_id "ag8OKbGYm6q5dNSUvA_zmQAAAdg"]
[Thu May 21 21:52:42.193212 2026] [:error] [pid 9188:tid 9192] [client 40.113.223.68:7337] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/class-wp.php"] [unique_id "ag8OKrGYm6q5dNSUvA_zmgAAAcA"]
[Thu May 21 21:52:42.974384 2026] [:error] [pid 49982:tid 50001] [client 40.113.223.68:59134] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "ag8OKmFwIDa5Tf8O4bYPMwAAANE"]
[Thu May 21 21:52:43.692420 2026] [:error] [pid 49884:tid 49965] [client 40.113.223.68:5148] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "ag8OK65MPpsTNNHWS6gAQAAAAJI"]
[Thu May 21 21:52:44.213310 2026] [:error] [pid 49982:tid 49990] [client 40.113.223.68:58798] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "ag8OLGFwIDa5Tf8O4bYPNAAAAMY"]
[Thu May 21 21:52:45.033909 2026] [:error] [pid 49884:tid 49953] [client 40.113.223.68:1421] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ahax.php"] [unique_id "ag8OLa5MPpsTNNHWS6gAQQAAAIY"]
[Thu May 21 21:52:45.633500 2026] [:error] [pid 49884:tid 49948] [client 40.113.223.68:2674] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa2.php"] [unique_id "ag8OLa5MPpsTNNHWS6gAQgAAAIE"]
[Thu May 21 21:52:46.298632 2026] [:error] [pid 9189:tid 9239] [client 40.113.223.68:5165] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa2.php"] [unique_id "ag8OLpvTDh1NbYizKVzG7gAAAhQ"]
[Thu May 21 21:52:46.917027 2026] [:error] [pid 9189:tid 9236] [client 40.113.223.68:58973] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa2.php"] [unique_id "ag8OLpvTDh1NbYizKVzG7wAAAhE"]
[Thu May 21 21:52:48.052369 2026] [:error] [pid 49884:tid 49970] [client 40.113.223.68:5863] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aa2.php"] [unique_id "ag8OMK5MPpsTNNHWS6gARwAAAJc"]
[Thu May 21 21:52:48.817525 2026] [:error] [pid 9114:tid 9124] [client 40.113.223.68:59497] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccou.php"] [unique_id "ag8OMG8FiJqDBEoTvqyFhwAAAUg"]
[Thu May 21 21:52:49.292936 2026] [:error] [pid 9157:tid 9182] [client 40.113.223.68:2636] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccou.php"] [unique_id "ag8OMcGfHcLNqE8m88KbIQAAAZc"]
[Thu May 21 21:52:49.802441 2026] [:error] [pid 49879:tid 49930] [client 40.113.223.68:3660] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccou.php"] [unique_id "ag8OMYVqYDjFSyG2gFprpAAAAEo"]
[Thu May 21 21:52:50.576444 2026] [:error] [pid 49884:tid 49956] [client 40.113.223.68:2259] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ccou.php"] [unique_id "ag8OMq5MPpsTNNHWS6gASgAAAIk"]
[Thu May 21 21:52:51.663889 2026] [:error] [pid 49884:tid 49953] [client 40.113.223.68:3025] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/login8.php"] [unique_id "ag8OM65MPpsTNNHWS6gATwAAAIY"]
[Thu May 21 21:52:52.390944 2026] [:error] [pid 9157:tid 9175] [client 40.113.223.68:7394] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/login8.php"] [unique_id "ag8ONMGfHcLNqE8m88KbJAAAAZA"]
[Thu May 21 21:52:53.069458 2026] [:error] [pid 49879:tid 49940] [client 40.113.223.68:4511] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/login8.php"] [unique_id "ag8ONYVqYDjFSyG2gFprsgAAAFQ"]
[Thu May 21 21:52:53.594383 2026] [:error] [pid 51613:tid 51620] [client 40.113.223.68:4507] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/login8.php"] [unique_id "ag8ONWbP0MDvqrVnweoLSgAAAQU"]
[Thu May 21 21:52:54.332749 2026] [:error] [pid 9188:tid 9201] [client 40.113.223.68:7393] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/oiqcXuO.php"] [unique_id "ag8ONrGYm6q5dNSUvA_zowAAAck"]
[Thu May 21 21:52:55.071688 2026] [:error] [pid 49877:tid 49895] [client 40.113.223.68:3059] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/oiqcXuO.php"] [unique_id "ag8ONxgN4MeSe4kIL9BCdQAAAAc"]
[Thu May 21 21:52:55.923267 2026] [:error] [pid 49982:tid 49993] [client 40.113.223.68:5779] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/oiqcXuO.php"] [unique_id "ag8ON2FwIDa5Tf8O4bYPNwAAAMk"]
[Thu May 21 21:52:57.132161 2026] [:error] [pid 9157:tid 9176] [client 40.113.223.68:7375] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/oiqcXuO.php"] [unique_id "ag8OOcGfHcLNqE8m88KbLQAAAZE"]
[Thu May 21 21:52:57.898588 2026] [:error] [pid 9114:tid 9131] [client 40.113.223.68:3888] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nx.php"] [unique_id "ag8OOW8FiJqDBEoTvqyFiwAAAU8"]
[Thu May 21 21:52:59.133991 2026] [:error] [pid 49877:tid 49907] [client 40.113.223.68:7372] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nx.php"] [unique_id "ag8OOxgN4MeSe4kIL9BCeAAAABM"]
[Thu May 21 21:53:00.078740 2026] [:error] [pid 9114:tid 9135] [client 40.113.223.68:4526] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nx.php"] [unique_id "ag8OPG8FiJqDBEoTvqyFjAAAAVM"]
[Thu May 21 21:53:00.923181 2026] [:error] [pid 9157:tid 9180] [client 40.113.223.68:3849] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/nx.php"] [unique_id "ag8OPMGfHcLNqE8m88KbMQAAAZU"]
[Thu May 21 21:53:01.439150 2026] [:error] [pid 9189:tid 9226] [client 40.113.223.68:8233] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dr.php"] [unique_id "ag8OPZvTDh1NbYizKVzG9wAAAgc"]
[Thu May 21 21:53:02.026443 2026] [:error] [pid 9188:tid 9196] [client 40.113.223.68:4730] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dr.php"] [unique_id "ag8OPrGYm6q5dNSUvA_zqwAAAcQ"]
[Thu May 21 21:53:03.018774 2026] [:error] [pid 51613:tid 51637] [client 40.113.223.68:7726] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dr.php"] [unique_id "ag8OP2bP0MDvqrVnweoLTwAAARY"]
[Thu May 21 21:53:03.668146 2026] [:error] [pid 49884:tid 49962] [client 40.113.223.68:2631] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/dr.php"] [unique_id "ag8OP65MPpsTNNHWS6gAWwAAAI8"]
[Thu May 21 21:53:04.870358 2026] [:error] [pid 49982:tid 49987] [client 40.113.223.68:59502] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xamp.php"] [unique_id "ag8OQGFwIDa5Tf8O4bYPPwAAAMM"]
[Thu May 21 21:53:06.029185 2026] [:error] [pid 9189:tid 9228] [client 40.113.223.68:2639] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xamp.php"] [unique_id "ag8OQpvTDh1NbYizKVzG_wAAAgk"]
[Thu May 21 21:53:07.371645 2026] [:error] [pid 49982:tid 49995] [client 40.113.223.68:7815] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xamp.php"] [unique_id "ag8OQ2FwIDa5Tf8O4bYPQgAAAMs"]
[Thu May 21 21:53:08.221018 2026] [:error] [pid 9114:tid 9137] [client 40.113.223.68:7983] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xamp.php"] [unique_id "ag8ORG8FiJqDBEoTvqyFjwAAAVU"]
[Thu May 21 21:53:08.909115 2026] [:error] [pid 51613:tid 51635] [client 40.113.223.68:6920] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cA3bHIkVhgP.php"] [unique_id "ag8ORGbP0MDvqrVnweoLUwAAARQ"]
[Thu May 21 21:53:09.455163 2026] [:error] [pid 9188:tid 9211] [client 40.113.223.68:58957] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cA3bHIkVhgP.php"] [unique_id "ag8ORbGYm6q5dNSUvA_zsQAAAdM"]
[Thu May 21 21:53:10.565584 2026] [:error] [pid 9157:tid 9176] [client 40.113.223.68:7855] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cA3bHIkVhgP.php"] [unique_id "ag8ORsGfHcLNqE8m88KbOQAAAZE"]
[Thu May 21 21:53:11.133894 2026] [:error] [pid 9157:tid 9169] [client 40.113.223.68:6934] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cA3bHIkVhgP.php"] [unique_id "ag8OR8GfHcLNqE8m88KbOwAAAYo"]
[Thu May 21 21:53:11.949488 2026] [:error] [pid 49982:tid 49999] [client 40.113.223.68:1789] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clas11.php"] [unique_id "ag8OR2FwIDa5Tf8O4bYPRQAAAM8"]
[Thu May 21 21:53:12.794128 2026] [:error] [pid 51613:tid 51620] [client 40.113.223.68:6024] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clas11.php"] [unique_id "ag8OSGbP0MDvqrVnweoLVQAAAQU"]
[Thu May 21 21:53:13.743284 2026] [:error] [pid 51613:tid 51618] [client 40.113.223.68:1769] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clas11.php"] [unique_id "ag8OSWbP0MDvqrVnweoLVgAAAQM"]
[Thu May 21 21:53:14.639851 2026] [:error] [pid 9188:tid 9215] [client 40.113.223.68:6932] [client 40.113.223.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/clas11.php"] [unique_id "ag8OSrGYm6q5dNSUvA_ztQAAAdc"]
[Fri May 22 00:31:46.047075 2026] [:error] [pid 9157:tid 9180] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri May 22 00:31:46.172691 2026] [:error] [pid 9157:tid 9175] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Fri May 22 00:31:46.298418 2026] [:error] [pid 9157:tid 9162] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri May 22 00:31:46.426036 2026] [:error] [pid 9157:tid 9183] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri May 22 00:31:46.552038 2026] [:error] [pid 9157:tid 9177] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri May 22 00:31:46.702262 2026] [:error] [pid 9157:tid 9179] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri May 22 00:31:46.827950 2026] [:error] [pid 9157:tid 9172] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri May 22 00:31:46.953580 2026] [:error] [pid 9157:tid 9181] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri May 22 00:31:47.079436 2026] [:error] [pid 9157:tid 9166] [client 20.205.110.7:17260] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri May 22 00:31:47.327786 2026] [:error] [pid 9157:tid 9164] [client 20.205.110.7:17260] [client 20.205.110.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "ag8zc8GfHcLNqE8m88KpEgAAAYU"]
[Fri May 22 00:31:47.838144 2026] [:error] [pid 51613:tid 51627] [client 20.205.110.7:6039] [client 20.205.110.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "ag8zc2bP0MDvqrVnweoaIwAAAQw"]
[Fri May 22 00:31:48.480647 2026] [:error] [pid 9157:tid 9169] [client 20.205.110.7:6044] [client 20.205.110.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "ag8zdMGfHcLNqE8m88KpEwAAAYo"]
[Fri May 22 00:31:49.202525 2026] [:error] [pid 9157:tid 9171] [client 20.205.110.7:14721] [client 20.205.110.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "ag8zdcGfHcLNqE8m88KpFAAAAYw"]
[Fri May 22 06:12:52.951010 2026] [:error] [pid 58782:tid 58797] [client 20.78.148.25:3736] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ag-DZIxsdTFafgO8vhSsKwAAAQ0"]
[Fri May 22 06:12:53.460998 2026] [:error] [pid 15583:tid 15605] [client 20.78.148.25:3549] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ag-DZXnaOncRcIm17YV4JgAAABE"]
[Fri May 22 06:12:53.943832 2026] [:error] [pid 58813:tid 58822] [client 20.78.148.25:3556] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ag-DZZ6yyKWDKULhxJ37gQAAAUY"]
[Fri May 22 06:12:54.437980 2026] [:error] [pid 58813:tid 58831] [client 20.78.148.25:3553] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ag-DZp6yyKWDKULhxJ37gwAAAU8"]
[Fri May 22 10:34:55.810994 2026] [:error] [pid 15585:tid 15662] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri May 22 10:34:56.181432 2026] [:error] [pid 15585:tid 15656] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri May 22 10:34:56.607478 2026] [:error] [pid 15585:tid 15648] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri May 22 10:34:56.965960 2026] [:error] [pid 15585:tid 15650] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri May 22 10:34:57.277662 2026] [:error] [pid 15585:tid 15663] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri May 22 10:34:57.590402 2026] [:error] [pid 15585:tid 15660] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri May 22 10:34:57.913394 2026] [:error] [pid 15585:tid 15668] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri May 22 10:34:58.737980 2026] [:error] [pid 15585:tid 15661] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Fri May 22 10:34:59.165550 2026] [:error] [pid 15585:tid 15664] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Fri May 22 10:34:59.483688 2026] [:error] [pid 15585:tid 15670] [client 191.234.188.166:10306] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Fri May 22 10:34:59.793059 2026] [:error] [pid 15585:tid 15656] [client 191.234.188.166:10306] [client 191.234.188.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ag_A0yKb-vB41AF-LC2zlgAAAIk"]
[Fri May 22 10:35:06.657382 2026] [:error] [pid 15584:tid 15644] [client 191.234.188.166:10310] [client 191.234.188.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ag_A2t9Z_TVLbNEx52i3mQAAAFg"]
[Fri May 22 10:35:10.457750 2026] [:error] [pid 15584:tid 15621] [client 191.234.188.166:33395] [client 191.234.188.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ag_A3t9Z_TVLbNEx52i3ogAAAEE"]
[Fri May 22 10:35:13.013291 2026] [:error] [pid 15583:tid 15606] [client 191.234.188.166:11237] [client 191.234.188.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ag_A4XnaOncRcIm17YWsXgAAABI"]
[Fri May 22 10:49:59.148339 2026] [:error] [pid 15679:tid 15684] [client 167.71.169.11:58187] [client 167.71.169.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.169.11, incrementing brute counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-login.php"] [unique_id "ag_EVyh8tgGc38WJ-GzDyQAAAMM"]
[Fri May 22 10:49:59.152410 2026] [:error] [pid 15679:tid 15684] [client 167.71.169.11:58187] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri May 22 16:02:01.535617 2026] [:error] [pid 15584:tid 15628] [client 20.200.218.70:17033] [client 20.200.218.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ahANed9Z_TVLbNEx52j91gAAAEg"]
[Fri May 22 16:02:02.178075 2026] [:error] [pid 15584:tid 15637] [client 20.200.218.70:3643] [client 20.200.218.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ahANet9Z_TVLbNEx52j91wAAAFE"]
[Fri May 22 16:02:02.872847 2026] [:error] [pid 58813:tid 58832] [client 20.200.218.70:3634] [client 20.200.218.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ahANep6yyKWDKULhxJ1gRQAAAVA"]
[Fri May 22 16:02:03.472334 2026] [:error] [pid 15584:tid 15621] [client 20.200.218.70:17066] [client 20.200.218.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/test1.php"] [unique_id "ahANe99Z_TVLbNEx52j92gAAAEE"]
[Fri May 22 19:09:49.259348 2026] [:error] [pid 15585:tid 15662] [client 195.170.172.102:37356] [client 195.170.172.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ahA5fSKb-vB41AF-LC1sOgAAAI8"]
[Fri May 22 19:09:49.449657 2026] [:error] [pid 15585:tid 15650] [client 195.170.172.102:37376] [client 195.170.172.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "ahA5fSKb-vB41AF-LC1sPAAAAIM"]
[Sat May 23 00:10:35.258192 2026] [:error] [pid 15679:tid 15700] [client 35.175.113.28:54444] [client 35.175.113.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ahB_-yh8tgGc38WJ-GyTnAAAANM"]
[Sat May 23 00:10:36.450101 2026] [:error] [pid 15585:tid 15660] [client 35.175.113.28:54546] [client 35.175.113.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "ahB__CKb-vB41AF-LC25BQAAAI0"]
[Sat May 23 00:10:37.430697 2026] [:error] [pid 15585:tid 15648] [client 35.175.113.28:54594] [client 35.175.113.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "ahB__SKb-vB41AF-LC25CQAAAIE"]
[Sat May 23 00:10:38.396504 2026] [:error] [pid 58782:tid 58804] [client 35.175.113.28:54640] [client 35.175.113.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "ahB__oxsdTFafgO8vhRCxQAAARQ"]
[Sat May 23 00:10:39.318907 2026] [:error] [pid 58782:tid 58803] [client 35.175.113.28:54704] [client 35.175.113.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "ahB__4xsdTFafgO8vhRCzgAAARM"]
[Sat May 23 00:10:40.219172 2026] [:error] [pid 15679:tid 15683] [client 35.175.113.28:54768] [client 35.175.113.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "ahCAACh8tgGc38WJ-GyTqAAAAMI"]
[Sat May 23 00:10:41.146162 2026] [:error] [pid 15583:tid 15594] [client 35.175.113.28:54826] [client 35.175.113.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "ahCAAXnaOncRcIm17YVRXAAAAAY"]
[Sat May 23 00:10:42.114146 2026] [:error] [pid 15583:tid 15590] [client 35.175.113.28:54884] [client 35.175.113.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.remote"] [unique_id "ahCAAnnaOncRcIm17YVRaQAAAAI"]
[Sat May 23 01:07:25.062797 2026] [:error] [pid 58782:tid 58807] [client 3.138.195.162:52556] [client 3.138.195.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ahCNTYxsdTFafgO8vhRLRQAAARc"]
[Sat May 23 01:07:26.111900 2026] [:error] [pid 15584:tid 15624] [client 3.138.195.162:42506] [client 3.138.195.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "ahCNTt9Z_TVLbNEx52hg1AAAAEQ"]
[Sat May 23 01:07:26.946092 2026] [:error] [pid 15585:tid 15649] [client 3.138.195.162:42558] [client 3.138.195.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "ahCNTiKb-vB41AF-LC3FtAAAAII"]
[Sat May 23 01:07:27.780510 2026] [:error] [pid 15679:tid 15705] [client 3.138.195.162:42598] [client 3.138.195.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "ahCNTyh8tgGc38WJ-GykFgAAANg"]
[Sat May 23 01:07:28.613151 2026] [:error] [pid 58782:tid 58784] [client 3.138.195.162:42654] [client 3.138.195.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.staging"] [unique_id "ahCNUIxsdTFafgO8vhRLTAAAAQA"]
[Sat May 23 01:07:29.444950 2026] [:error] [pid 15583:tid 15605] [client 3.138.195.162:42714] [client 3.138.195.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.development"] [unique_id "ahCNUXnaOncRcIm17YVoFgAAABE"]
[Sat May 23 01:07:30.268691 2026] [:error] [pid 15583:tid 15601] [client 3.138.195.162:42784] [client 3.138.195.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.test"] [unique_id "ahCNUnnaOncRcIm17YVoHAAAAA0"]
[Sat May 23 11:00:31.520064 2026] [:error] [pid 31039:tid 31047] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat May 23 11:00:31.643546 2026] [:error] [pid 31039:tid 31051] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat May 23 11:00:31.766781 2026] [:error] [pid 31039:tid 31065] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat May 23 11:00:31.890183 2026] [:error] [pid 31039:tid 31048] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat May 23 11:00:32.038169 2026] [:error] [pid 31039:tid 31063] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat May 23 11:00:32.161683 2026] [:error] [pid 31039:tid 31054] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sat May 23 11:00:32.415146 2026] [:error] [pid 31039:tid 31053] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat May 23 11:00:32.538622 2026] [:error] [pid 31039:tid 31046] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sat May 23 11:00:32.662159 2026] [:error] [pid 31039:tid 31056] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat May 23 11:00:32.784825 2026] [:error] [pid 31039:tid 31042] [client 20.210.129.142:7760] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat May 23 11:00:32.913729 2026] [:error] [pid 31039:tid 31061] [client 20.210.129.142:7760] [client 20.210.129.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "ahEYUKIYDYo8WvA5zLKyLQAAANQ"]
[Sat May 23 11:00:33.395091 2026] [:error] [pid 30940:tid 30971] [client 20.210.129.142:7997] [client 20.210.129.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "ahEYUZqUP2XZmzp7RDqsdAAAABY"]
[Sat May 23 11:00:33.881221 2026] [:error] [pid 30940:tid 30965] [client 20.210.129.142:7748] [client 20.210.129.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "ahEYUZqUP2XZmzp7RDqsdgAAABA"]
[Sat May 23 11:00:34.362888 2026] [:error] [pid 30940:tid 30964] [client 20.210.129.142:7755] [client 20.210.129.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/alfa.php"] [unique_id "ahEYUpqUP2XZmzp7RDqsdwAAAA8"]
[Sun May 24 11:05:52.854153 2026] [:error] [pid 49744:tid 49767] [client 18.144.169.7:60302] [client 18.144.169.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ahJrEDsE5kPdFpUbbHGA5AAAANU"]
[Sun May 24 11:05:53.715674 2026] [:error] [pid 49689:tid 49737] [client 18.144.169.7:50622] [client 18.144.169.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.git/credentials"] [unique_id "ahJrEQaxiY3NxLUD97Uv8gAAAJM"]
[Sun May 24 11:05:54.959344 2026] [:error] [pid 23497:tid 23523] [client 18.144.169.7:50690] [client 18.144.169.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "ahJrEiPlV47QcYwd2v9QywAAAVc"]
[Sun May 24 11:05:55.803082 2026] [:error] [pid 23497:tid 23524] [client 18.144.169.7:50738] [client 18.144.169.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "ahJrEyPlV47QcYwd2v9Q1AAAAVg"]
[Sun May 24 11:05:56.562831 2026] [:error] [pid 2639:tid 2664] [client 18.144.169.7:50796] [client 18.144.169.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "ahJrFEzQncQTd0Z0Oe_69QAAARc"]
[Sun May 24 11:35:30.525718 2026] [:error] [pid 49688:tid 49713] [client 88.151.33.24:41356] [client 88.151.33.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ahJyAmYoQ9V6a_4pBsh6QwAAAFY"]
[Sun May 24 11:35:30.527883 2026] [:error] [pid 23497:tid 23501] [client 88.151.33.24:41374] [client 88.151.33.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "ahJyAiPlV47QcYwd2v9iHQAAAUE"]
[Sun May 24 12:57:45.794031 2026] [:error] [pid 2639:tid 2656] [client 206.189.91.190:50800] [client 206.189.91.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "ahKFSUzQncQTd0Z0Oe8f6gAAAQ8"]
[Sun May 24 12:57:47.813407 2026] [:error] [pid 49688:tid 49700] [client 206.189.91.190:50848] [client 206.189.91.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/_profiler/open"] [unique_id "ahKFS2YoQ9V6a_4pBsiGvwAAAEk"]
[Sun May 24 14:13:30.950635 2026] [:error] [pid 49775:tid 49797] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/revealability.php
[Sun May 24 14:13:31.200037 2026] [:error] [pid 49775:tid 49783] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sun May 24 14:13:31.448326 2026] [:error] [pid 49775:tid 49789] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/tires.php
[Sun May 24 14:13:31.716488 2026] [:error] [pid 49775:tid 49788] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/amxloxxr.php
[Sun May 24 14:13:31.971495 2026] [:error] [pid 49775:tid 49779] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Sun May 24 14:13:32.220715 2026] [:error] [pid 49775:tid 49778] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/wehrman.php
[Sun May 24 14:13:32.469277 2026] [:error] [pid 49775:tid 49791] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-thi.php
[Sun May 24 14:13:32.717886 2026] [:error] [pid 49775:tid 49796] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sun May 24 14:13:32.981838 2026] [:error] [pid 49775:tid 49799] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun May 24 14:13:33.240294 2026] [:error] [pid 49775:tid 49780] [client 20.63.100.211:60074] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sun May 24 14:13:33.525057 2026] [:error] [pid 49775:tid 49792] [client 20.63.100.211:60074] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ahKXDYvZb8G6T8WpI1hvZQAAAA8"]
[Sun May 24 14:13:35.691330 2026] [:error] [pid 49689:tid 49727] [client 20.63.100.211:40964] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ahKXDwaxiY3NxLUD97VUawAAAIk"]
[Sun May 24 14:13:36.858097 2026] [:error] [pid 2639:tid 2641] [client 20.63.100.211:41682] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ahKXEEzQncQTd0Z0Oe82ogAAAQA"]
[Sun May 24 14:13:38.812807 2026] [:error] [pid 23497:tid 23513] [client 20.63.100.211:60052] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/edit.php"] [unique_id "ahKXEiPlV47QcYwd2v-gUwAAAU0"]
[Sun May 24 14:13:41.198447 2026] [:error] [pid 49775:tid 49792] [client 20.63.100.211:7431] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ahKXFYvZb8G6T8WpI1hvaQAAAA8"]
[Sun May 24 14:13:47.048461 2026] [:error] [pid 49775:tid 49790] [client 20.63.100.211:36571] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ahKXG4vZb8G6T8WpI1hvawAAAA0"]
[Sun May 24 14:13:48.223463 2026] [:error] [pid 49688:tid 49699] [client 20.63.100.211:40996] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ahKXHGYoQ9V6a_4pBsiS3wAAAEg"]
[Sun May 24 14:13:51.625266 2026] [:error] [pid 49689:tid 49741] [client 20.63.100.211:55442] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-load.php"] [unique_id "ahKXHwaxiY3NxLUD97VUcQAAAJc"]
[Sun May 24 14:13:54.375619 2026] [:error] [pid 49688:tid 49715] [client 20.63.100.211:43864] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "ahKXImYoQ9V6a_4pBsiS5gAAAFg"]
[Sun May 24 14:14:00.040885 2026] [:error] [pid 49744:tid 49769] [client 20.63.100.211:25651] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "ahKXKDsE5kPdFpUbbHGpxAAAANc"]
[Sun May 24 14:14:00.915969 2026] [:error] [pid 49744:tid 49767] [client 20.63.100.211:40364] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "ahKXKDsE5kPdFpUbbHGpxQAAANU"]
[Sun May 24 14:14:02.737962 2026] [:error] [pid 49744:tid 49756] [client 20.63.100.211:25613] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/atomlib.php"] [unique_id "ahKXKjsE5kPdFpUbbHGpyQAAAMo"]
[Sun May 24 14:14:03.531043 2026] [:error] [pid 49775:tid 49786] [client 20.63.100.211:25659] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-der.php"] [unique_id "ahKXK4vZb8G6T8WpI1hvgQAAAAk"]
[Sun May 24 14:14:04.734451 2026] [:error] [pid 49744:tid 49758] [client 20.63.100.211:21807] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-der.php"] [unique_id "ahKXLDsE5kPdFpUbbHGpzAAAAMw"]
[Sun May 24 14:14:05.963641 2026] [:error] [pid 49744:tid 49765] [client 20.63.100.211:35316] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-der.php"] [unique_id "ahKXLTsE5kPdFpUbbHGp0QAAANM"]
[Sun May 24 14:14:08.512580 2026] [:error] [pid 49688:tid 49713] [client 20.63.100.211:21774] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-der.php"] [unique_id "ahKXMGYoQ9V6a_4pBsiS7gAAAFY"]
[Sun May 24 14:14:09.508933 2026] [:error] [pid 23497:tid 23500] [client 20.63.100.211:35278] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "ahKXMSPlV47QcYwd2v-gngAAAUA"]
[Sun May 24 14:14:11.201443 2026] [:error] [pid 49688:tid 49701] [client 20.63.100.211:39165] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "ahKXM2YoQ9V6a_4pBsiS8AAAAEo"]
[Sun May 24 14:14:12.699412 2026] [:error] [pid 23497:tid 23522] [client 20.63.100.211:25627] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "ahKXNCPlV47QcYwd2v-gpwAAAVY"]
[Sun May 24 14:14:14.749539 2026] [:error] [pid 23497:tid 23508] [client 20.63.100.211:56903] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ftde.php"] [unique_id "ahKXNiPlV47QcYwd2v-gqwAAAUg"]
[Sun May 24 14:14:16.465760 2026] [:error] [pid 49744:tid 49767] [client 20.63.100.211:56910] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "ahKXODsE5kPdFpUbbHGp2gAAANU"]
[Sun May 24 14:14:19.537222 2026] [:error] [pid 49744:tid 49763] [client 20.63.100.211:43849] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "ahKXOzsE5kPdFpUbbHGp4wAAANE"]
[Sun May 24 14:14:21.423939 2026] [:error] [pid 49744:tid 49759] [client 20.63.100.211:22253] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "ahKXPTsE5kPdFpUbbHGp6QAAAM0"]
[Sun May 24 14:14:22.659143 2026] [:error] [pid 49744:tid 49754] [client 20.63.100.211:28992] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asasx.php"] [unique_id "ahKXPjsE5kPdFpUbbHGp7gAAAMg"]
[Sun May 24 14:14:26.632330 2026] [:error] [pid 23497:tid 23514] [client 20.63.100.211:60913] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "ahKXQiPlV47QcYwd2v-gvAAAAU4"]
[Sun May 24 14:14:31.718493 2026] [:error] [pid 23497:tid 23520] [client 20.63.100.211:22208] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-good.php"] [unique_id "ahKXRyPlV47QcYwd2v-gxgAAAVQ"]
[Sun May 24 14:14:33.153777 2026] [:error] [pid 2639:tid 2647] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun May 24 14:14:33.383494 2026] [:error] [pid 2639:tid 2646] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php
[Sun May 24 14:14:34.298061 2026] [:error] [pid 2639:tid 2641] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/wuasr.php
[Sun May 24 14:14:34.528097 2026] [:error] [pid 2639:tid 2656] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Sun May 24 14:14:34.765541 2026] [:error] [pid 2639:tid 2660] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Sun May 24 14:14:34.982982 2026] [:error] [pid 2639:tid 2655] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Sun May 24 14:14:35.200215 2026] [:error] [pid 2639:tid 2657] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/file30.php
[Sun May 24 14:14:36.402892 2026] [:error] [pid 2639:tid 2649] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Sun May 24 14:14:37.038199 2026] [:error] [pid 2639:tid 2646] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun May 24 14:14:37.262623 2026] [:error] [pid 2639:tid 2664] [client 20.63.100.211:21798] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Sun May 24 14:14:37.497710 2026] [:error] [pid 2639:tid 2645] [client 20.63.100.211:21798] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "ahKXTUzQncQTd0Z0Oe83AAAAAQQ"]
[Sun May 24 14:14:40.481879 2026] [:error] [pid 49688:tid 49699] [client 20.63.100.211:8051] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "ahKXUGYoQ9V6a_4pBsiS-gAAAEg"]
[Sun May 24 14:14:49.476979 2026] [:error] [pid 49744:tid 49768] [client 20.63.100.211:29001] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "ahKXWTsE5kPdFpUbbHGqCwAAANY"]
[Sun May 24 14:14:51.686062 2026] [:error] [pid 49689:tid 49720] [client 20.63.100.211:55461] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-access.php"] [unique_id "ahKXWwaxiY3NxLUD97VUpAAAAII"]
[Sun May 24 14:14:54.176720 2026] [:error] [pid 49775:tid 49781] [client 20.63.100.211:38508] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aevly.php"] [unique_id "ahKXXovZb8G6T8WpI1hvoAAAAAQ"]
[Sun May 24 14:14:56.976673 2026] [:error] [pid 49775:tid 49792] [client 20.63.100.211:60912] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aevly.php"] [unique_id "ahKXYIvZb8G6T8WpI1hvogAAAA8"]
[Sun May 24 14:14:58.383188 2026] [:error] [pid 2639:tid 2660] [client 20.63.100.211:55443] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aevly.php"] [unique_id "ahKXYkzQncQTd0Z0Oe83EAAAARM"]
[Sun May 24 14:15:00.424915 2026] [:error] [pid 49744:tid 49768] [client 20.63.100.211:21781] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/aevly.php"] [unique_id "ahKXZDsE5kPdFpUbbHGqEQAAANY"]
[Sun May 24 14:15:01.015053 2026] [:error] [pid 49744:tid 49750] [client 20.63.100.211:56295] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "ahKXZTsE5kPdFpUbbHGqEgAAAMQ"]
[Sun May 24 14:15:02.838471 2026] [:error] [pid 49775:tid 49793] [client 20.63.100.211:8019] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "ahKXZovZb8G6T8WpI1hvpwAAABA"]
[Sun May 24 14:15:04.418239 2026] [:error] [pid 49775:tid 49791] [client 20.63.100.211:20659] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "ahKXaIvZb8G6T8WpI1hvqwAAAA4"]
[Sun May 24 14:15:05.522316 2026] [:error] [pid 49688:tid 49694] [client 20.63.100.211:8002] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vx.php"] [unique_id "ahKXaWYoQ9V6a_4pBsiTGQAAAEM"]
[Sun May 24 14:15:06.375173 2026] [:error] [pid 2639:tid 2664] [client 20.63.100.211:51448] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-wz.php"] [unique_id "ahKXakzQncQTd0Z0Oe83GgAAARc"]
[Sun May 24 14:15:07.189382 2026] [:error] [pid 49689:tid 49734] [client 20.63.100.211:21883] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-wz.php"] [unique_id "ahKXawaxiY3NxLUD97VUswAAAJA"]
[Sun May 24 14:15:08.119035 2026] [:error] [pid 2639:tid 2648] [client 20.63.100.211:58794] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-wz.php"] [unique_id "ahKXbEzQncQTd0Z0Oe83HgAAAQc"]
[Sun May 24 14:15:15.806184 2026] [:error] [pid 49775:tid 49778] [client 20.63.100.211:20662] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-wz.php"] [unique_id "ahKXc4vZb8G6T8WpI1hvtAAAAAE"]
[Sun May 24 14:15:21.229797 2026] [:error] [pid 49775:tid 49781] [client 20.63.100.211:20996] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/crgio.php"] [unique_id "ahKXeYvZb8G6T8WpI1hvwwAAAAQ"]
[Sun May 24 14:15:23.959037 2026] [:error] [pid 49775:tid 49794] [client 20.63.100.211:56835] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/crgio.php"] [unique_id "ahKXe4vZb8G6T8WpI1hvxwAAABE"]
[Sun May 24 14:15:34.553802 2026] [:error] [pid 49775:tid 49798] [client 20.63.100.211:28012] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "ahKXhovZb8G6T8WpI1hv1gAAABU"]
[Sun May 24 14:15:36.230598 2026] [:error] [pid 49689:tid 49724] [client 20.63.100.211:24123] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/new.php"] [unique_id "ahKXiAaxiY3NxLUD97VUvwAAAIY"]
[Sun May 24 14:15:37.156860 2026] [:error] [pid 49775:tid 49795] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun May 24 14:15:37.396199 2026] [:error] [pid 49775:tid 49789] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun May 24 14:15:38.753970 2026] [:error] [pid 49775:tid 49789] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Sun May 24 14:15:38.971715 2026] [:error] [pid 49775:tid 49783] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun May 24 14:15:39.200355 2026] [:error] [pid 49775:tid 49791] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sun May 24 14:15:39.417965 2026] [:error] [pid 49775:tid 49780] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/yellow.php
[Sun May 24 14:15:39.652925 2026] [:error] [pid 49775:tid 49799] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/mifta.php
[Sun May 24 14:15:39.872264 2026] [:error] [pid 49775:tid 49792] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-firewall.php
[Sun May 24 14:15:40.110475 2026] [:error] [pid 49775:tid 49781] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/fun.php
[Sun May 24 14:15:40.362180 2026] [:error] [pid 49775:tid 49787] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Sun May 24 14:15:40.579385 2026] [:error] [pid 49775:tid 49790] [client 20.63.100.211:7567] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Sun May 24 14:15:40.799623 2026] [:error] [pid 49775:tid 49788] [client 20.63.100.211:7567] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1index.php"] [unique_id "ahKXjIvZb8G6T8WpI1hv6AAAAAs"]
[Sun May 24 14:15:44.077093 2026] [:error] [pid 23497:tid 23514] [client 20.63.100.211:43240] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1index.php"] [unique_id "ahKXkCPlV47QcYwd2v-hPgAAAU4"]
[Sun May 24 14:15:45.384410 2026] [:error] [pid 49689:tid 49734] [client 20.63.100.211:33283] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1index.php"] [unique_id "ahKXkQaxiY3NxLUD97VUxAAAAJA"]
[Sun May 24 14:15:46.259362 2026] [:error] [pid 2639:tid 2657] [client 20.63.100.211:62060] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/1index.php"] [unique_id "ahKXkkzQncQTd0Z0Oe83SAAAARA"]
[Sun May 24 14:15:48.273493 2026] [:error] [pid 23497:tid 23514] [client 20.63.100.211:59400] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell20211028.php"] [unique_id "ahKXlCPlV47QcYwd2v-hRgAAAU4"]
[Sun May 24 14:15:48.972102 2026] [:error] [pid 49689:tid 49727] [client 20.63.100.211:43222] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell20211028.php"] [unique_id "ahKXlAaxiY3NxLUD97VUxwAAAIk"]
[Sun May 24 14:15:51.037300 2026] [:error] [pid 49689:tid 49723] [client 20.63.100.211:59426] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell20211028.php"] [unique_id "ahKXlwaxiY3NxLUD97VUygAAAIU"]
[Sun May 24 14:15:52.543510 2026] [:error] [pid 49689:tid 49731] [client 20.63.100.211:27968] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/shell20211028.php"] [unique_id "ahKXmAaxiY3NxLUD97VUywAAAI0"]
[Sun May 24 14:15:55.291463 2026] [:error] [pid 49744:tid 49768] [client 20.63.100.211:7737] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-ver.php"] [unique_id "ahKXmzsE5kPdFpUbbHGqOwAAANY"]
[Sun May 24 14:15:58.212969 2026] [:error] [pid 23497:tid 23511] [client 20.63.100.211:33321] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-ver.php"] [unique_id "ahKXniPlV47QcYwd2v-hTQAAAUs"]
[Sun May 24 14:16:03.335961 2026] [:error] [pid 49688:tid 49697] [client 20.63.100.211:39073] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-ver.php"] [unique_id "ahKXo2YoQ9V6a_4pBsiTMAAAAEY"]
[Sun May 24 14:16:05.661568 2026] [:error] [pid 2639:tid 2664] [client 20.63.100.211:62076] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-ver.php"] [unique_id "ahKXpUzQncQTd0Z0Oe83ZQAAARc"]
[Sun May 24 14:16:07.248344 2026] [:error] [pid 23497:tid 23504] [client 20.63.100.211:33320] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lala.php"] [unique_id "ahKXpyPlV47QcYwd2v-hWQAAAUQ"]
[Sun May 24 14:16:08.624626 2026] [:error] [pid 2639:tid 2644] [client 20.63.100.211:33285] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lala.php"] [unique_id "ahKXqEzQncQTd0Z0Oe83agAAAQM"]
[Sun May 24 14:16:09.920665 2026] [:error] [pid 49689:tid 49739] [client 20.63.100.211:62065] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lala.php"] [unique_id "ahKXqQaxiY3NxLUD97VU3QAAAJU"]
[Sun May 24 14:16:12.912109 2026] [:error] [pid 2639:tid 2641] [client 20.63.100.211:33284] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lala.php"] [unique_id "ahKXrEzQncQTd0Z0Oe83bQAAAQA"]
[Sun May 24 14:16:16.418461 2026] [:error] [pid 2639:tid 2658] [client 20.63.100.211:62594] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ahKXsEzQncQTd0Z0Oe83cgAAARE"]
[Sun May 24 14:16:18.466140 2026] [:error] [pid 49775:tid 49780] [client 20.63.100.211:30306] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ahKXsovZb8G6T8WpI1hwCwAAAAM"]
[Sun May 24 14:16:20.730474 2026] [:error] [pid 2639:tid 2659] [client 20.63.100.211:22151] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ahKXtEzQncQTd0Z0Oe83ewAAARI"]
[Sun May 24 14:16:22.142515 2026] [:error] [pid 49744:tid 49763] [client 20.63.100.211:56854] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/sbhu.php"] [unique_id "ahKXtjsE5kPdFpUbbHGqSAAAANE"]
[Sun May 24 14:16:24.814731 2026] [:error] [pid 49744:tid 49767] [client 20.63.100.211:45933] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-sing.php"] [unique_id "ahKXuDsE5kPdFpUbbHGqUgAAANU"]
[Sun May 24 14:16:26.781493 2026] [:error] [pid 49775:tid 49777] [client 20.63.100.211:50130] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-sing.php"] [unique_id "ahKXuovZb8G6T8WpI1hwDAAAAAA"]
[Sun May 24 14:16:29.091008 2026] [:error] [pid 49775:tid 49798] [client 20.63.100.211:50151] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-sing.php"] [unique_id "ahKXvYvZb8G6T8WpI1hwEQAAABU"]
[Sun May 24 14:16:30.902897 2026] [:error] [pid 2639:tid 2643] [client 20.63.100.211:39055] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-sing.php"] [unique_id "ahKXvkzQncQTd0Z0Oe83hAAAAQI"]
[Sun May 24 14:16:32.618331 2026] [:error] [pid 23497:tid 23521] [client 20.63.100.211:62597] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file59.php"] [unique_id "ahKXwCPlV47QcYwd2v-heAAAAVU"]
[Sun May 24 14:16:34.182596 2026] [:error] [pid 23497:tid 23505] [client 20.63.100.211:50125] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file59.php"] [unique_id "ahKXwiPlV47QcYwd2v-hfQAAAUU"]
[Sun May 24 14:16:36.605888 2026] [:error] [pid 49688:tid 49694] [client 20.63.100.211:50125] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file59.php"] [unique_id "ahKXxGYoQ9V6a_4pBsiTRwAAAEM"]
[Sun May 24 14:16:40.779735 2026] [:error] [pid 23497:tid 23511] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Sun May 24 14:16:41.030270 2026] [:error] [pid 23497:tid 23507] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-slss.php
[Sun May 24 14:16:41.433704 2026] [:error] [pid 23497:tid 23508] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun May 24 14:16:41.737597 2026] [:error] [pid 23497:tid 23504] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/atkno.php
[Sun May 24 14:16:41.959503 2026] [:error] [pid 23497:tid 23524] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/ff.php
[Sun May 24 14:16:42.178486 2026] [:error] [pid 23497:tid 23523] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php
[Sun May 24 14:16:42.399133 2026] [:error] [pid 23497:tid 23509] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Sun May 24 14:16:42.618447 2026] [:error] [pid 23497:tid 23506] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Sun May 24 14:16:42.835848 2026] [:error] [pid 23497:tid 23503] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Sun May 24 14:16:43.599540 2026] [:error] [pid 23497:tid 23516] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Sun May 24 14:16:43.819616 2026] [:error] [pid 23497:tid 23522] [client 20.63.100.211:30297] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun May 24 14:16:44.059009 2026] [:error] [pid 23497:tid 23505] [client 20.63.100.211:30297] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/explorer/index_.php"] [unique_id "ahKXzCPlV47QcYwd2v-hlgAAAUU"]
[Sun May 24 14:16:46.918797 2026] [:error] [pid 23497:tid 23502] [client 20.63.100.211:26110] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/explorer/index_.php"] [unique_id "ahKXziPlV47QcYwd2v-hnAAAAUI"]
[Sun May 24 14:16:48.149541 2026] [:error] [pid 23497:tid 23507] [client 20.63.100.211:50117] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/explorer/index_.php"] [unique_id "ahKX0CPlV47QcYwd2v-hoQAAAUc"]
[Sun May 24 14:16:50.388033 2026] [:error] [pid 49689:tid 49736] [client 20.63.100.211:59518] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/explorer/index_.php"] [unique_id "ahKX0gaxiY3NxLUD97VU8gAAAJI"]
[Sun May 24 14:16:52.663326 2026] [:error] [pid 23497:tid 23507] [client 20.63.100.211:59467] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xda.php"] [unique_id "ahKX1CPlV47QcYwd2v-hqAAAAUc"]
[Sun May 24 14:16:54.390817 2026] [:error] [pid 23497:tid 23524] [client 20.63.100.211:20324] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xda.php"] [unique_id "ahKX1iPlV47QcYwd2v-hrQAAAVg"]
[Sun May 24 14:16:57.741159 2026] [:error] [pid 23497:tid 23507] [client 20.63.100.211:26081] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xda.php"] [unique_id "ahKX2SPlV47QcYwd2v-hsgAAAUc"]
[Sun May 24 14:16:59.077276 2026] [:error] [pid 49689:tid 49726] [client 20.63.100.211:23727] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xda.php"] [unique_id "ahKX2waxiY3NxLUD97VU9QAAAIg"]
[Sun May 24 14:17:02.705399 2026] [:error] [pid 49775:tid 49792] [client 20.63.100.211:33972] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/samll.php"] [unique_id "ahKX3ovZb8G6T8WpI1hwIQAAAA8"]
[Sun May 24 14:17:03.669854 2026] [:error] [pid 23497:tid 23505] [client 20.63.100.211:59888] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/samll.php"] [unique_id "ahKX3yPlV47QcYwd2v-hxwAAAUU"]
[Sun May 24 14:17:06.034812 2026] [:error] [pid 49688:tid 49704] [client 20.63.100.211:34599] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/samll.php"] [unique_id "ahKX4mYoQ9V6a_4pBsiTVgAAAE0"]
[Sun May 24 14:17:10.434175 2026] [:error] [pid 49688:tid 49695] [client 20.63.100.211:27929] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/samll.php"] [unique_id "ahKX5mYoQ9V6a_4pBsiTWQAAAEQ"]
[Sun May 24 14:17:12.939655 2026] [:error] [pid 49775:tid 49787] [client 20.63.100.211:59899] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-at.php"] [unique_id "ahKX6IvZb8G6T8WpI1hwQwAAAAo"]
[Sun May 24 14:17:15.774887 2026] [:error] [pid 49775:tid 49799] [client 20.63.100.211:56205] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-at.php"] [unique_id "ahKX64vZb8G6T8WpI1hwTQAAABY"]
[Sun May 24 14:17:20.177856 2026] [:error] [pid 49775:tid 49789] [client 20.63.100.211:45188] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-at.php"] [unique_id "ahKX8IvZb8G6T8WpI1hwUQAAAAw"]
[Sun May 24 14:17:21.360450 2026] [:error] [pid 49775:tid 49799] [client 20.63.100.211:56237] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-at.php"] [unique_id "ahKX8YvZb8G6T8WpI1hwVgAAABY"]
[Sun May 24 14:17:24.769593 2026] [:error] [pid 49689:tid 49722] [client 20.63.100.211:60839] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahKX9AaxiY3NxLUD97VVCwAAAIQ"]
[Sun May 24 14:17:26.109564 2026] [:error] [pid 49689:tid 49741] [client 20.63.100.211:7275] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahKX9gaxiY3NxLUD97VVDAAAAJc"]
[Sun May 24 14:17:32.049322 2026] [:error] [pid 23497:tid 23501] [client 20.63.100.211:60116] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahKX_CPlV47QcYwd2v-h_wAAAUE"]
[Sun May 24 14:17:35.876323 2026] [:error] [pid 49775:tid 49797] [client 20.63.100.211:34644] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahKX_4vZb8G6T8WpI1hwZgAAABQ"]
[Sun May 24 14:17:40.324539 2026] [:error] [pid 2639:tid 2651] [client 20.63.100.211:26020] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp-the.php"] [unique_id "ahKYBEzQncQTd0Z0Oe83zQAAAQo"]
[Sun May 24 14:17:44.260711 2026] [:error] [pid 49775:tid 49780] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sun May 24 14:17:44.655503 2026] [:error] [pid 49775:tid 49791] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Sun May 24 14:17:44.872743 2026] [:error] [pid 49775:tid 49794] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Sun May 24 14:17:45.090565 2026] [:error] [pid 49775:tid 49781] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Sun May 24 14:17:45.309385 2026] [:error] [pid 49775:tid 49801] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Sun May 24 14:17:46.018055 2026] [:error] [pid 49775:tid 49778] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-su.php
[Sun May 24 14:17:46.262428 2026] [:error] [pid 49775:tid 49785] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/like.php
[Sun May 24 14:17:46.510275 2026] [:error] [pid 49775:tid 49786] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Sun May 24 14:17:46.728686 2026] [:error] [pid 49775:tid 49788] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Sun May 24 14:17:46.955930 2026] [:error] [pid 49775:tid 49777] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sun May 24 14:17:47.201361 2026] [:error] [pid 49775:tid 49783] [client 20.63.100.211:37849] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Sun May 24 14:17:47.416270 2026] [:error] [pid 49775:tid 49780] [client 20.63.100.211:37849] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/reze.php"] [unique_id "ahKYC4vZb8G6T8WpI1hwiAAAAAM"]
[Sun May 24 14:17:48.579245 2026] [:error] [pid 49689:tid 49723] [client 20.63.100.211:50056] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/reze.php"] [unique_id "ahKYDAaxiY3NxLUD97VVNAAAAIU"]
[Sun May 24 14:17:50.009822 2026] [:error] [pid 49689:tid 49737] [client 20.63.100.211:42597] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/reze.php"] [unique_id "ahKYDgaxiY3NxLUD97VVOAAAAJM"]
[Sun May 24 14:17:51.076292 2026] [:error] [pid 49744:tid 49747] [client 20.63.100.211:34669] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/reze.php"] [unique_id "ahKYDzsE5kPdFpUbbHGqmAAAAME"]
[Sun May 24 14:17:51.910736 2026] [:error] [pid 49689:tid 49735] [client 20.63.100.211:24499] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/database.php"] [unique_id "ahKYDwaxiY3NxLUD97VVPgAAAJE"]
[Sun May 24 14:17:53.183904 2026] [:error] [pid 49689:tid 49730] [client 20.63.100.211:12198] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/database.php"] [unique_id "ahKYEQaxiY3NxLUD97VVRAAAAIw"]
[Sun May 24 14:17:55.162277 2026] [:error] [pid 49688:tid 49693] [client 20.63.100.211:50095] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/database.php"] [unique_id "ahKYE2YoQ9V6a_4pBsiTfwAAAEI"]
[Sun May 24 14:17:56.840383 2026] [:error] [pid 23497:tid 23500] [client 20.63.100.211:37836] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/database.php"] [unique_id "ahKYFCPlV47QcYwd2v-iKAAAAUA"]
[Sun May 24 14:17:59.860278 2026] [:error] [pid 49688:tid 49715] [client 20.63.100.211:26439] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/favicon.php"] [unique_id "ahKYF2YoQ9V6a_4pBsiThAAAAFg"]
[Sun May 24 14:18:01.903677 2026] [:error] [pid 49689:tid 49721] [client 20.63.100.211:35863] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/favicon.php"] [unique_id "ahKYGQaxiY3NxLUD97VVUwAAAIM"]
[Sun May 24 14:18:08.992441 2026] [:error] [pid 49688:tid 49713] [client 20.63.100.211:26028] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/favicon.php"] [unique_id "ahKYIGYoQ9V6a_4pBsiTlQAAAFY"]
[Sun May 24 14:18:10.933851 2026] [:error] [pid 49689:tid 49724] [client 20.63.100.211:32674] [client 20.63.100.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/favicon.php"] [unique_id "ahKYIgaxiY3NxLUD97VVXQAAAIY"]
[Sun May 24 18:23:00.801160 2026] [:error] [pid 49744:tid 49749] [client 34.26.204.147:53920] [client 34.26.204.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.204.147, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "ahLRhDsE5kPdFpUbbHHPUwAAAMM"]
[Sun May 24 18:23:00.804723 2026] [:error] [pid 49744:tid 49749] [client 34.26.204.147:53920] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun May 24 18:23:03.591586 2026] [:error] [pid 49744:tid 49757] [client 34.26.204.147:53920] [client 34.26.204.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "ahLRhzsE5kPdFpUbbHHPXgAAAMs"]
[Sun May 24 18:23:04.111498 2026] [:error] [pid 49689:tid 49728] [client 34.26.204.147:56756] [client 34.26.204.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "ahLRiAaxiY3NxLUD97V03gAAAIo"]
[Sun May 24 18:23:04.862766 2026] [:error] [pid 4777:tid 4803] [client 34.26.204.147:60845] [client 34.26.204.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "ahLRiPtPctoQOm4w5pN0HQAAAdU"]
[Sun May 24 18:23:05.469303 2026] [:error] [pid 41708:tid 41717] [client 34.26.204.147:50213] [client 34.26.204.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "ahLRif4tQzoTxpuHBF7J0wAAAYc"]
[Sun May 24 21:43:29.203760 2026] [:error] [pid 15835:tid 15842] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun May 24 21:43:29.727306 2026] [:error] [pid 15835:tid 15846] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sun May 24 21:43:29.746196 2026] [:error] [pid 15835:tid 15861] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sun May 24 21:43:29.780095 2026] [:error] [pid 15835:tid 15859] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Sun May 24 21:43:29.797801 2026] [:error] [pid 15835:tid 15840] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Sun May 24 21:43:29.814184 2026] [:error] [pid 15835:tid 15849] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Sun May 24 21:43:29.832514 2026] [:error] [pid 15835:tid 15845] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun May 24 21:43:29.850787 2026] [:error] [pid 15835:tid 15857] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun May 24 21:43:29.868104 2026] [:error] [pid 15835:tid 15848] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun May 24 21:43:29.885197 2026] [:error] [pid 15835:tid 15844] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Sun May 24 21:43:29.902682 2026] [:error] [pid 15835:tid 15853] [client 4.197.41.166:14471] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun May 24 21:43:29.917700 2026] [:error] [pid 15835:tid 15855] [client 4.197.41.166:14471] [client 4.197.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ahMAgWWbknYlUM9P0qPdYQAAABI"]
[Sun May 24 21:43:30.019337 2026] [:error] [pid 15835:tid 15851] [client 4.197.41.166:14384] [client 4.197.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ahMAgmWbknYlUM9P0qPdYgAAAA4"]
[Sun May 24 21:43:30.097109 2026] [:error] [pid 15835:tid 15847] [client 4.197.41.166:14363] [client 4.197.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ahMAgmWbknYlUM9P0qPdYwAAAAo"]
[Sun May 24 21:43:30.162788 2026] [:error] [pid 15835:tid 15852] [client 4.197.41.166:13485] [client 4.197.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ahMAgmWbknYlUM9P0qPdZAAAAA8"]
[Sun May 24 22:58:30.657511 2026] [:error] [pid 11280:tid 11306] [client 35.237.129.148:51505] [client 35.237.129.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.237.129.148, incrementing ddos counter"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/xmlrpc.php"] [unique_id "ahMSFoRn5s7laoSxy1QmFwAAAFU"]
[Sun May 24 22:58:30.661628 2026] [:error] [pid 11280:tid 11306] [client 35.237.129.148:51505] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun May 24 22:58:33.047965 2026] [:error] [pid 11280:tid 11291] [client 35.237.129.148:51505] [client 35.237.129.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "ahMSGYRn5s7laoSxy1QmIAAAAEY"]
[Sun May 24 22:58:33.583073 2026] [:error] [pid 15835:tid 15839] [client 35.237.129.148:55134] [client 35.237.129.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "ahMSGWWbknYlUM9P0qP-ywAAAAI"]
[Sun May 24 22:58:34.096548 2026] [:error] [pid 15835:tid 15857] [client 35.237.129.148:53226] [client 35.237.129.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "ahMSGmWbknYlUM9P0qP-zgAAABQ"]
[Sun May 24 22:58:34.571611 2026] [:error] [pid 11280:tid 11304] [client 35.237.129.148:57364] [client 35.237.129.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "ahMSGoRn5s7laoSxy1QmIgAAAFM"]
[Mon May 25 01:43:07.460129 2026] [:error] [pid 15835:tid 15856] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 25 01:43:07.671116 2026] [:error] [pid 15835:tid 15839] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon May 25 01:43:07.884528 2026] [:error] [pid 15835:tid 15845] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon May 25 01:43:08.134010 2026] [:error] [pid 15835:tid 15854] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon May 25 01:43:08.343584 2026] [:error] [pid 15835:tid 15858] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Mon May 25 01:43:08.609985 2026] [:error] [pid 15835:tid 15841] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon May 25 01:43:08.819798 2026] [:error] [pid 15835:tid 15852] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Mon May 25 01:43:09.288534 2026] [:error] [pid 15835:tid 15849] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Mon May 25 01:43:09.560764 2026] [:error] [pid 15835:tid 15856] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Mon May 25 01:43:09.818428 2026] [:error] [pid 15835:tid 15844] [client 52.139.38.60:31083] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Mon May 25 01:43:10.092764 2026] [:error] [pid 15835:tid 15847] [client 52.139.38.60:31083] [client 52.139.38.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ahM4rmWbknYlUM9P0qNEpgAAAAo"]
[Mon May 25 01:43:11.220329 2026] [:error] [pid 15835:tid 15838] [client 52.139.38.60:54085] [client 52.139.38.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ahM4r2WbknYlUM9P0qNEpwAAAAE"]
[Mon May 25 01:43:12.279854 2026] [:error] [pid 11280:tid 11291] [client 52.139.38.60:4514] [client 52.139.38.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ahM4sIRn5s7laoSxy1RClgAAAEY"]
[Mon May 25 01:43:13.478893 2026] [:error] [pid 11280:tid 11287] [client 52.139.38.60:25354] [client 52.139.38.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/about.php"] [unique_id "ahM4sYRn5s7laoSxy1RCmAAAAEI"]
[Mon May 25 06:24:36.431616 2026] [:error] [pid 9398:tid 9414] [client 170.64.221.168:49902] [client 170.64.221.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ahN6pOhIu7KstzsCua-pVAAAAMo"]
[Mon May 25 06:24:36.537889 2026] [:error] [pid 9398:tid 9421] [client 170.64.221.168:37808] [client 170.64.221.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ahN6pOhIu7KstzsCua-pWAAAANE"]
[Mon May 25 06:24:36.643403 2026] [:error] [pid 9398:tid 9401] [client 170.64.221.168:50120] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ahN6pOhIu7KstzsCua-pXQAAAME"]
[Mon May 25 06:24:36.687035 2026] [:error] [pid 50423:tid 50447] [client 170.64.221.168:50144] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ahN6pKJWO7En4nKEQ3gvrQAAARY"]
[Mon May 25 06:24:36.800634 2026] [:error] [pid 9302:tid 9322] [client 170.64.221.168:37830] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ahN6pC1RaFfTSnDQnqFRYQAAAA8"]
[Mon May 25 06:24:36.829311 2026] [:error] [pid 21606:tid 21608] [client 170.64.221.168:37858] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/"] [unique_id "ahN6pGswdp0RYkH5t9XAqwAAAUA"]
[Mon May 25 06:24:36.937439 2026] [:error] [pid 9303:tid 9350] [client 170.64.221.168:50528] [client 170.64.221.168] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||windfc.windfarmcoolants.com.au|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "ahN6pH3bQScbssitjPQ3ugAAAFA"]
[Mon May 25 06:24:36.937733 2026] [:error] [pid 9303:tid 9350] [client 170.64.221.168:50528] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "ahN6pH3bQScbssitjPQ3ugAAAFA"]
[Mon May 25 06:24:36.942498 2026] [:error] [pid 9303:tid 9348] [client 170.64.221.168:50538] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/vendor/jquery.filer/php/readme.txt"] [unique_id "ahN6pH3bQScbssitjPQ3uwAAAE4"]
[Mon May 25 06:24:36.948459 2026] [:error] [pid 9303:tid 9344] [client 170.64.221.168:50558] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/bower_components/jquery.filer/php/readme.txt"] [unique_id "ahN6pH3bQScbssitjPQ3vAAAAEo"]
[Mon May 25 06:24:36.949131 2026] [:error] [pid 9304:tid 9361] [client 170.64.221.168:50564] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/alfacgiapi/perl.alfa"] [unique_id "ahN6pOVEV2qpMC_1UzR_IgAAAIA"]
[Mon May 25 06:24:36.951501 2026] [:error] [pid 9303:tid 9337] [client 170.64.221.168:50586] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery.filer/php/readme.txt"] [unique_id "ahN6pH3bQScbssitjPQ3vQAAAEM"]
[Mon May 25 06:24:36.952654 2026] [:error] [pid 50423:tid 50430] [client 170.64.221.168:50572] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahN6pKJWO7En4nKEQ3gvtwAAAQU"]
[Mon May 25 06:24:36.955562 2026] [:error] [pid 9303:tid 9336] [client 170.64.221.168:50594] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/jquery.filer/php/readme.txt"] [unique_id "ahN6pH3bQScbssitjPQ3vgAAAEI"]
[Mon May 25 06:24:36.979160 2026] [:error] [pid 9303:tid 9335] [client 170.64.221.168:50652] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vendor/laravel-filemanager/js/script.js"] [unique_id "ahN6pH3bQScbssitjPQ3xAAAAEE"]
[Mon May 25 06:24:37.008532 2026] [:error] [pid 9303:tid 9335] [client 170.64.221.168:50698] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jquery.filer/php/readme.txt"] [unique_id "ahN6pX3bQScbssitjPQ3yAAAAEE"]
[Mon May 25 06:24:37.013211 2026] [:error] [pid 9303:tid 9358] [client 170.64.221.168:50702] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file-manager/initialize"] [unique_id "ahN6pX3bQScbssitjPQ3ygAAAFg"]
[Mon May 25 06:24:37.026799 2026] [:error] [pid 9303:tid 9354] [client 170.64.221.168:50808] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/bower_components/jquery.filer/php/readme.txt"] [unique_id "ahN6pX3bQScbssitjPQ3zgAAAFQ"]
[Mon May 25 06:24:37.033491 2026] [:error] [pid 9303:tid 9356] [client 170.64.221.168:50732] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/vendor/jquery.filer/php/readme.txt"] [unique_id "ahN6pX3bQScbssitjPQ30gAAAFY"]
[Mon May 25 06:24:37.036368 2026] [:error] [pid 9303:tid 9348] [client 170.64.221.168:50842] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery.filer/php/readme.txt"] [unique_id "ahN6pX3bQScbssitjPQ30wAAAE4"]
[Mon May 25 06:24:37.038028 2026] [:error] [pid 9303:tid 9344] [client 170.64.221.168:50850] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahN6pX3bQScbssitjPQ31AAAAEo"]
[Mon May 25 06:24:37.041992 2026] [:error] [pid 9303:tid 9336] [client 170.64.221.168:50864] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/static/lib/jquery-file-upload/server/php/"] [unique_id "ahN6pX3bQScbssitjPQ31gAAAEI"]
[Mon May 25 06:24:37.043940 2026] [:error] [pid 9303:tid 9342] [client 170.64.221.168:50896] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/jquery.filer/php/readme.txt"] [unique_id "ahN6pX3bQScbssitjPQ32AAAAEg"]
[Mon May 25 06:24:37.046173 2026] [:error] [pid 9302:tid 9321] [client 170.64.221.168:50908] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahN6pS1RaFfTSnDQnqFRawAAAA4"]
[Mon May 25 06:24:37.079096 2026] [:error] [pid 50423:tid 50444] [client 170.64.221.168:50976] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vendor/laravel-filemanager/js/script.js"] [unique_id "ahN6paJWO7En4nKEQ3gvvAAAARM"]
[Mon May 25 06:24:37.100628 2026] [:error] [pid 9303:tid 9338] [client 170.64.221.168:51032] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/js/frontend/jquery-file-upload/server/php/"] [unique_id "ahN6pX3bQScbssitjPQ35QAAAEQ"]
[Mon May 25 06:24:37.119920 2026] [:error] [pid 9302:tid 9320] [client 170.64.221.168:51090] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jquery.filer/php/readme.txt"] [unique_id "ahN6pS1RaFfTSnDQnqFRbAAAAA0"]
[Mon May 25 06:24:37.124262 2026] [:error] [pid 9303:tid 9347] [client 170.64.221.168:51114] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file-manager/initialize"] [unique_id "ahN6pX3bQScbssitjPQ36AAAAE0"]
[Mon May 25 06:24:37.138736 2026] [:error] [pid 9303:tid 9356] [client 170.64.221.168:51182] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/bower_components/jquery.filer/php/readme.txt"] [unique_id "ahN6pX3bQScbssitjPQ36gAAAFY"]
[Mon May 25 06:24:37.143776 2026] [:error] [pid 9303:tid 9344] [client 170.64.221.168:51218] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/vendor/jquery.filer/php/readme.txt"] [unique_id "ahN6pX3bQScbssitjPQ37AAAAEo"]
[Mon May 25 06:24:37.148891 2026] [:error] [pid 50423:tid 50426] [client 170.64.221.168:51228] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery.filer/php/readme.txt"] [unique_id "ahN6paJWO7En4nKEQ3gvwQAAAQE"]
[Mon May 25 06:24:37.149822 2026] [:error] [pid 50423:tid 50440] [client 170.64.221.168:51244] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gvwgAAAQ8"]
[Mon May 25 06:24:37.153442 2026] [:error] [pid 50423:tid 50434] [client 170.64.221.168:51270] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/static/lib/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gvwwAAAQk"]
[Mon May 25 06:24:37.156910 2026] [:error] [pid 9302:tid 9309] [client 170.64.221.168:51286] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/jquery.filer/php/readme.txt"] [unique_id "ahN6pS1RaFfTSnDQnqFRbgAAAAI"]
[Mon May 25 06:24:37.185021 2026] [:error] [pid 21606:tid 21612] [client 170.64.221.168:51374] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/vendor/laravel-filemanager/js/script.js"] [unique_id "ahN6pWswdp0RYkH5t9XArQAAAUQ"]
[Mon May 25 06:24:37.189261 2026] [:error] [pid 21606:tid 21620] [client 170.64.221.168:51388] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery-file-upload/server/php/"] [unique_id "ahN6pWswdp0RYkH5t9XArgAAAUw"]
[Mon May 25 06:24:37.204605 2026] [:error] [pid 21606:tid 21631] [client 170.64.221.168:51432] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/js/frontend/jquery-file-upload/server/php/"] [unique_id "ahN6pWswdp0RYkH5t9XAsgAAAVc"]
[Mon May 25 06:24:37.222825 2026] [:error] [pid 21606:tid 21617] [client 170.64.221.168:51484] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jquery.filer/php/readme.txt"] [unique_id "ahN6pWswdp0RYkH5t9XAtAAAAUk"]
[Mon May 25 06:24:37.223380 2026] [:error] [pid 21606:tid 21614] [client 170.64.221.168:51502] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/file-manager/initialize"] [unique_id "ahN6pWswdp0RYkH5t9XAtQAAAUY"]
[Mon May 25 06:24:37.224392 2026] [:error] [pid 9302:tid 9307] [client 170.64.221.168:51518] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/jquery-file-upload/server/php/"] [unique_id "ahN6pS1RaFfTSnDQnqFRcQAAAAA"]
[Mon May 25 06:24:37.254956 2026] [:error] [pid 21606:tid 21621] [client 170.64.221.168:51642] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/static/lib/jquery-file-upload/server/php/"] [unique_id "ahN6pWswdp0RYkH5t9XAuQAAAU0"]
[Mon May 25 06:24:37.281819 2026] [:error] [pid 50423:tid 50443] [client 170.64.221.168:51690] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv0QAAARI"]
[Mon May 25 06:24:37.282321 2026] [:error] [pid 21606:tid 21629] [client 170.64.221.168:51694] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahN6pWswdp0RYkH5t9XAugAAAVU"]
[Mon May 25 06:24:37.296647 2026] [:error] [pid 50423:tid 50435] [client 170.64.221.168:51734] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/js/frontend/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv1AAAAQo"]
[Mon May 25 06:24:37.300888 2026] [:error] [pid 50423:tid 50446] [client 170.64.221.168:51770] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/app-assets/data/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv1wAAARU"]
[Mon May 25 06:24:37.315732 2026] [:error] [pid 50423:tid 50447] [client 170.64.221.168:51810] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv2wAAARY"]
[Mon May 25 06:24:37.317828 2026] [:error] [pid 50423:tid 50427] [client 170.64.221.168:51820] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv3QAAAQI"]
[Mon May 25 06:24:37.327524 2026] [:error] [pid 50423:tid 50431] [client 170.64.221.168:51860] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset_admin/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv4QAAAQY"]
[Mon May 25 06:24:37.355766 2026] [:error] [pid 21606:tid 21613] [client 170.64.221.168:51948] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/galerie/server/php/"] [unique_id "ahN6pWswdp0RYkH5t9XAvgAAAUU"]
[Mon May 25 06:24:37.372832 2026] [:error] [pid 9398:tid 9426] [client 170.64.221.168:51978] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahN6pehIu7KstzsCua-paAAAANY"]
[Mon May 25 06:24:37.374594 2026] [:error] [pid 9304:tid 9364] [client 170.64.221.168:51974] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_LgAAAIM"]
[Mon May 25 06:24:37.379127 2026] [:error] [pid 21606:tid 21611] [client 170.64.221.168:51994] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahN6pWswdp0RYkH5t9XAwAAAAUM"]
[Mon May 25 06:24:37.387090 2026] [:error] [pid 9304:tid 9379] [client 170.64.221.168:52016] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/app-assets/data/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_LwAAAJI"]
[Mon May 25 06:24:37.402864 2026] [:error] [pid 50423:tid 50438] [client 170.64.221.168:52064] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv7AAAAQ0"]
[Mon May 25 06:24:37.404691 2026] [:error] [pid 50423:tid 50433] [client 170.64.221.168:52070] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv7gAAAQg"]
[Mon May 25 06:24:37.406534 2026] [:error] [pid 50423:tid 50426] [client 170.64.221.168:52100] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv7wAAAQE"]
[Mon May 25 06:24:37.414449 2026] [:error] [pid 21606:tid 21632] [client 170.64.221.168:52120] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset_admin/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6pWswdp0RYkH5t9XAwQAAAVg"]
[Mon May 25 06:24:37.428975 2026] [:error] [pid 9304:tid 9375] [client 170.64.221.168:52166] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fileupload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_MgAAAI4"]
[Mon May 25 06:24:37.443504 2026] [:error] [pid 9304:tid 9368] [client 170.64.221.168:52224] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/galerie/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_OAAAAIc"]
[Mon May 25 06:24:37.458672 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:52294] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_PAAAAJc"]
[Mon May 25 06:24:37.461007 2026] [:error] [pid 9398:tid 9417] [client 170.64.221.168:52290] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahN6pehIu7KstzsCua-pbAAAAM0"]
[Mon May 25 06:24:37.461273 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:52048] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_PQAAAJA"]
[Mon May 25 06:24:37.470314 2026] [:error] [pid 9304:tid 9378] [client 170.64.221.168:52314] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_QAAAAJE"]
[Mon May 25 06:24:37.488790 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:52342] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/app-assets/data/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_RQAAAJg"]
[Mon May 25 06:24:37.495189 2026] [:error] [pid 9304:tid 9379] [client 170.64.221.168:52402] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_RwAAAJI"]
[Mon May 25 06:24:37.496102 2026] [:error] [pid 9304:tid 9364] [client 170.64.221.168:52390] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_SAAAAIM"]
[Mon May 25 06:24:37.506123 2026] [:error] [pid 9304:tid 9375] [client 170.64.221.168:52436] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset_admin/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_SwAAAI4"]
[Mon May 25 06:24:37.518766 2026] [:error] [pid 9304:tid 9383] [client 170.64.221.168:52480] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fileupload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_UAAAAJY"]
[Mon May 25 06:24:37.539161 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:52548] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libraries/jsupload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_VAAAAJc"]
[Mon May 25 06:24:37.547376 2026] [:error] [pid 9304:tid 9378] [client 170.64.221.168:52582] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_WAAAAJE"]
[Mon May 25 06:24:37.548672 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:52588] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_WQAAAIs"]
[Mon May 25 06:24:37.549850 2026] [:error] [pid 9304:tid 9376] [client 170.64.221.168:52542] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/galerie/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_WgAAAI8"]
[Mon May 25 06:24:37.559599 2026] [:error] [pid 9304:tid 9365] [client 170.64.221.168:52602] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_XQAAAIQ"]
[Mon May 25 06:24:37.577166 2026] [:error] [pid 9304:tid 9364] [client 170.64.221.168:52626] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_YQAAAIM"]
[Mon May 25 06:24:37.594530 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:52672] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/fileupload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_aAAAAIk"]
[Mon May 25 06:24:37.608428 2026] [:error] [pid 9304:tid 9373] [client 170.64.221.168:52744] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/global/plugins/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_bwAAAIw"]
[Mon May 25 06:24:37.613888 2026] [:error] [pid 9304:tid 9371] [client 170.64.221.168:52754] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libraries/jsupload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_cAAAAIo"]
[Mon May 25 06:24:37.619687 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:52800] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_dAAAAIk"]
[Mon May 25 06:24:37.622042 2026] [:error] [pid 9304:tid 9375] [client 170.64.221.168:52810] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_dgAAAI4"]
[Mon May 25 06:24:37.625484 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:52828] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/js/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_dwAAAJg"]
[Mon May 25 06:24:37.655013 2026] [:error] [pid 9304:tid 9380] [client 170.64.221.168:52900] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/global/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_fgAAAJM"]
[Mon May 25 06:24:37.660332 2026] [:error] [pid 9304:tid 9363] [client 170.64.221.168:52924] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_gQAAAII"]
[Mon May 25 06:24:37.667987 2026] [:error] [pid 9304:tid 9361] [client 170.64.221.168:52966] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_hAAAAIA"]
[Mon May 25 06:24:37.669912 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:52974] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/global/plugins/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_hwAAAJc"]
[Mon May 25 06:24:37.678367 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:52978] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libraries/jsupload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_iAAAAJA"]
[Mon May 25 06:24:37.681502 2026] [:error] [pid 9304:tid 9378] [client 170.64.221.168:53006] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/js/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_igAAAJE"]
[Mon May 25 06:24:37.704782 2026] [:error] [pid 9303:tid 9335] [client 170.64.221.168:53024] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/global/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6pX3bQScbssitjPQ3-AAAAEE"]
[Mon May 25 06:24:37.717436 2026] [:error] [pid 9303:tid 9358] [client 170.64.221.168:53048] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6pX3bQScbssitjPQ3-wAAAFg"]
[Mon May 25 06:24:37.720823 2026] [:error] [pid 9303:tid 9352] [client 170.64.221.168:53122] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahN6pX3bQScbssitjPQ3_AAAAFI"]
[Mon May 25 06:24:37.726822 2026] [:error] [pid 50423:tid 50430] [client 170.64.221.168:53150] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/global/plugins/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv-wAAAQU"]
[Mon May 25 06:24:37.735147 2026] [:error] [pid 50423:tid 50449] [client 170.64.221.168:53192] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/js/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gv_gAAARg"]
[Mon May 25 06:24:37.754693 2026] [:error] [pid 50423:tid 50446] [client 170.64.221.168:53092] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gwAQAAARU"]
[Mon May 25 06:24:37.765679 2026] [:error] [pid 9304:tid 9374] [client 170.64.221.168:53230] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/global/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_jQAAAI0"]
[Mon May 25 06:24:37.772272 2026] [:error] [pid 50423:tid 50426] [client 170.64.221.168:53298] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gwAwAAAQE"]
[Mon May 25 06:24:37.776284 2026] [:error] [pid 50423:tid 50446] [client 170.64.221.168:53314] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahN6paJWO7En4nKEQ3gwBAAAARU"]
[Mon May 25 06:24:37.806019 2026] [:error] [pid 9304:tid 9380] [client 170.64.221.168:53366] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_lgAAAJM"]
[Mon May 25 06:24:37.817112 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:53426] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_nAAAAIs"]
[Mon May 25 06:24:37.918500 2026] [:error] [pid 9304:tid 9366] [client 170.64.221.168:53590] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/kcfinder/upload.php"] [unique_id "ahN6peVEV2qpMC_1UzR_rwAAAIU"]
[Mon May 25 06:24:37.919313 2026] [:error] [pid 9304:tid 9381] [client 170.64.221.168:53606] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_sAAAAJQ"]
[Mon May 25 06:24:37.933840 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:53686] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_uAAAAJA"]
[Mon May 25 06:24:37.940754 2026] [:error] [pid 9304:tid 9378] [client 170.64.221.168:53690] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/kcfinder/upload.php"] [unique_id "ahN6peVEV2qpMC_1UzR_ugAAAJE"]
[Mon May 25 06:24:37.948680 2026] [:error] [pid 9304:tid 9376] [client 170.64.221.168:53706] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kcfinder/upload.php"] [unique_id "ahN6peVEV2qpMC_1UzR_uwAAAI8"]
[Mon May 25 06:24:37.964250 2026] [:error] [pid 9304:tid 9379] [client 170.64.221.168:53722] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_vgAAAJI"]
[Mon May 25 06:24:37.966038 2026] [:error] [pid 9304:tid 9362] [client 170.64.221.168:53746] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_wAAAAIE"]
[Mon May 25 06:24:37.973193 2026] [:error] [pid 9304:tid 9364] [client 170.64.221.168:53776] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_wgAAAIM"]
[Mon May 25 06:24:37.974391 2026] [:error] [pid 9304:tid 9369] [client 170.64.221.168:53758] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/kcfinder/upload.php"] [unique_id "ahN6peVEV2qpMC_1UzR_wwAAAIg"]
[Mon May 25 06:24:37.975419 2026] [:error] [pid 9304:tid 9382] [client 170.64.221.168:53770] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_xAAAAJU"]
[Mon May 25 06:24:37.978846 2026] [:error] [pid 9304:tid 9366] [client 170.64.221.168:53796] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_xwAAAIU"]
[Mon May 25 06:24:37.988410 2026] [:error] [pid 9304:tid 9368] [client 170.64.221.168:53834] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_ywAAAIc"]
[Mon May 25 06:24:37.992517 2026] [:error] [pid 9304:tid 9361] [client 170.64.221.168:53846] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_zAAAAIA"]
[Mon May 25 06:24:37.995399 2026] [:error] [pid 9304:tid 9367] [client 170.64.221.168:53886] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/server/php/"] [unique_id "ahN6peVEV2qpMC_1UzR_zwAAAIY"]
[Mon May 25 06:24:38.024456 2026] [:error] [pid 9304:tid 9373] [client 170.64.221.168:53904] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzR_0gAAAIw"]
[Mon May 25 06:24:38.029190 2026] [:error] [pid 9304:tid 9376] [client 170.64.221.168:53908] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzR_1AAAAI8"]
[Mon May 25 06:24:38.030971 2026] [:error] [pid 9304:tid 9378] [client 170.64.221.168:53906] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzR_1QAAAJE"]
[Mon May 25 06:24:38.037136 2026] [:error] [pid 9304:tid 9379] [client 170.64.221.168:54002] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzR_1wAAAJI"]
[Mon May 25 06:24:38.037401 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:53988] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_1gAAAJg"]
[Mon May 25 06:24:38.056430 2026] [:error] [pid 9304:tid 9366] [client 170.64.221.168:53958] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/jquery-file-upload/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_3wAAAIU"]
[Mon May 25 06:24:38.058574 2026] [:error] [pid 9304:tid 9381] [client 170.64.221.168:53956] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_4QAAAJQ"]
[Mon May 25 06:24:38.061527 2026] [:error] [pid 9304:tid 9368] [client 170.64.221.168:54032] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_4wAAAIc"]
[Mon May 25 06:24:38.064166 2026] [:error] [pid 9304:tid 9361] [client 170.64.221.168:54040] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_5AAAAIA"]
[Mon May 25 06:24:38.068161 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:54070] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/jquery-file-upload/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_5gAAAJc"]
[Mon May 25 06:24:38.081105 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:54090] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_6wAAAIk"]
[Mon May 25 06:24:38.081917 2026] [:error] [pid 9304:tid 9376] [client 170.64.221.168:54096] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_7AAAAI8"]
[Mon May 25 06:24:38.094713 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:54126] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzR_7wAAAJg"]
[Mon May 25 06:24:38.103728 2026] [:error] [pid 9304:tid 9369] [client 170.64.221.168:54174] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzR_8wAAAIg"]
[Mon May 25 06:24:38.105398 2026] [:error] [pid 9304:tid 9365] [client 170.64.221.168:54190] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzR_9AAAAIQ"]
[Mon May 25 06:24:38.132134 2026] [:error] [pid 9304:tid 9361] [client 170.64.221.168:54238] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/jquery-file-upload/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR_-wAAAIA"]
[Mon May 25 06:24:38.132842 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:54248] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugin/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR__AAAAIs"]
[Mon May 25 06:24:38.137411 2026] [:error] [pid 9304:tid 9367] [client 170.64.221.168:54262] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR__gAAAIY"]
[Mon May 25 06:24:38.142249 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:54274] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/jquery-file-upload/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzR__wAAAJA"]
[Mon May 25 06:24:38.154061 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:54302] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzSAAgAAAIk"]
[Mon May 25 06:24:38.154701 2026] [:error] [pid 9304:tid 9376] [client 170.64.221.168:54304] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahN6puVEV2qpMC_1UzSAAwAAAI8"]
[Mon May 25 06:24:38.166099 2026] [:error] [pid 9304:tid 9374] [client 170.64.221.168:54364] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSACAAAAI0"]
[Mon May 25 06:24:38.203958 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:54502] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAFgAAAJA"]
[Mon May 25 06:24:38.231163 2026] [:error] [pid 9304:tid 9365] [client 170.64.221.168:54600] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAIQAAAIQ"]
[Mon May 25 06:24:38.239033 2026] [:error] [pid 9304:tid 9383] [client 170.64.221.168:54620] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ckeditor/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAJAAAAJY"]
[Mon May 25 06:24:38.251742 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:54654] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/components/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAKAAAAIs"]
[Mon May 25 06:24:38.253116 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:54670] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAKgAAAJc"]
[Mon May 25 06:24:38.259791 2026] [:error] [pid 9304:tid 9379] [client 170.64.221.168:54684] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/scripts/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAKwAAAJI"]
[Mon May 25 06:24:38.261161 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:54690] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSALAAAAJA"]
[Mon May 25 06:24:38.264990 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:54714] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/scripts/wysiwyg/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSALgAAAIk"]
[Mon May 25 06:24:38.280665 2026] [:error] [pid 9304:tid 9367] [client 170.64.221.168:54748] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAMgAAAIY"]
[Mon May 25 06:24:38.287245 2026] [:error] [pid 9304:tid 9364] [client 170.64.221.168:54786] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSANQAAAIM"]
[Mon May 25 06:24:38.297154 2026] [:error] [pid 9304:tid 9380] [client 170.64.221.168:54818] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ckeditor/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAOAAAAJM"]
[Mon May 25 06:24:38.297740 2026] [:error] [pid 9304:tid 9366] [client 170.64.221.168:54834] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/tinymce/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAOQAAAIU"]
[Mon May 25 06:24:38.298712 2026] [:error] [pid 9302:tid 9320] [client 170.64.221.168:54840] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahN6pi1RaFfTSnDQnqFRfgAAAA0"]
[Mon May 25 06:24:38.309841 2026] [:error] [pid 9304:tid 9363] [client 170.64.221.168:54874] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/components/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAPAAAAII"]
[Mon May 25 06:24:38.313877 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:54892] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAPgAAAIs"]
[Mon May 25 06:24:38.321875 2026] [:error] [pid 9304:tid 9368] [client 170.64.221.168:54900] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/scripts/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAPwAAAIc"]
[Mon May 25 06:24:38.323351 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:54914] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAQAAAAJc"]
[Mon May 25 06:24:38.328242 2026] [:error] [pid 9304:tid 9381] [client 170.64.221.168:54932] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/scripts/wysiwyg/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAQgAAAJQ"]
[Mon May 25 06:24:38.336794 2026] [:error] [pid 9304:tid 9375] [client 170.64.221.168:54964] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libs/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSARQAAAI4"]
[Mon May 25 06:24:38.345047 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:55008] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSASQAAAJg"]
[Mon May 25 06:24:38.355171 2026] [:error] [pid 9304:tid 9369] [client 170.64.221.168:55052] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSATQAAAIg"]
[Mon May 25 06:24:38.364388 2026] [:error] [pid 9304:tid 9366] [client 170.64.221.168:55076] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ckeditor/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSATwAAAIU"]
[Mon May 25 06:24:38.365011 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:55088] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/tinymce/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAUAAAAJA"]
[Mon May 25 06:24:38.366427 2026] [:error] [pid 9304:tid 9364] [client 170.64.221.168:55098] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAUQAAAIM"]
[Mon May 25 06:24:38.374350 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:55102] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAUgAAAIk"]
[Mon May 25 06:24:38.380870 2026] [:error] [pid 9304:tid 9368] [client 170.64.221.168:55132] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/components/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAVQAAAIc"]
[Mon May 25 06:24:38.385767 2026] [:error] [pid 9304:tid 9379] [client 170.64.221.168:55148] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAVwAAAJI"]
[Mon May 25 06:24:38.394653 2026] [:error] [pid 9304:tid 9383] [client 170.64.221.168:55160] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/scripts/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAWgAAAJY"]
[Mon May 25 06:24:38.400104 2026] [:error] [pid 9304:tid 9376] [client 170.64.221.168:55184] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/core/scripts/wysiwyg/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAXAAAAI8"]
[Mon May 25 06:24:38.408337 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:55210] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libs/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAXwAAAJg"]
[Mon May 25 06:24:38.419668 2026] [:error] [pid 9304:tid 9380] [client 170.64.221.168:55264] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAZAAAAJM"]
[Mon May 25 06:24:38.434908 2026] [:error] [pid 9304:tid 9361] [client 170.64.221.168:55312] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/tinymce/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAaQAAAIA"]
[Mon May 25 06:24:38.436794 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:55322] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAagAAAIs"]
[Mon May 25 06:24:38.445746 2026] [:error] [pid 9304:tid 9368] [client 170.64.221.168:55328] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAawAAAIc"]
[Mon May 25 06:24:38.478079 2026] [:error] [pid 9304:tid 9369] [client 170.64.221.168:55434] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/libs/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAeAAAAIg"]
[Mon May 25 06:24:38.482095 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:55452] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAewAAAJA"]
[Mon May 25 06:24:38.510911 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:55530] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAggAAAJc"]
[Mon May 25 06:24:38.512668 2026] [:error] [pid 9304:tid 9381] [client 170.64.221.168:55542] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/webroot/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAgwAAAJQ"]
[Mon May 25 06:24:38.529013 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:55590] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application/themes/admin/assets/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAiwAAAJg"]
[Mon May 25 06:24:38.532254 2026] [:error] [pid 9304:tid 9373] [client 170.64.221.168:55614] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAjQAAAIw"]
[Mon May 25 06:24:38.543548 2026] [:error] [pid 9304:tid 9366] [client 170.64.221.168:55644] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAkgAAAIU"]
[Mon May 25 06:24:38.557844 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:55652] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/ckeditor/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAlAAAAIk"]
[Mon May 25 06:24:38.565467 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:55670] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/webroot/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAlgAAAIs"]
[Mon May 25 06:24:38.573788 2026] [:error] [pid 9304:tid 9381] [client 170.64.221.168:55694] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/webroot/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAmQAAAJQ"]
[Mon May 25 06:24:38.579685 2026] [:error] [pid 9304:tid 9383] [client 170.64.221.168:55714] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application/themes/admin/assets/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAnAAAAJY"]
[Mon May 25 06:24:38.584947 2026] [:error] [pid 9304:tid 9376] [client 170.64.221.168:55738] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAngAAAI8"]
[Mon May 25 06:24:38.586554 2026] [:error] [pid 9304:tid 9378] [client 170.64.221.168:55758] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAoAAAAJE"]
[Mon May 25 06:24:38.591377 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:55766] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/jquery/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAoQAAAJg"]
[Mon May 25 06:24:38.597541 2026] [:error] [pid 9304:tid 9362] [client 170.64.221.168:55774] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAogAAAIE"]
[Mon May 25 06:24:38.603154 2026] [:error] [pid 9304:tid 9369] [client 170.64.221.168:55794] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/ckeditor/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSApAAAAIg"]
[Mon May 25 06:24:38.615617 2026] [:error] [pid 9304:tid 9380] [client 170.64.221.168:55816] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/webroot/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSApQAAAJM"]
[Mon May 25 06:24:38.626461 2026] [:error] [pid 9304:tid 9366] [client 170.64.221.168:55830] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/webroot/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAqAAAAIU"]
[Mon May 25 06:24:38.633847 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:55850] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/application/themes/admin/assets/js/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAqgAAAIk"]
[Mon May 25 06:24:38.634380 2026] [:error] [pid 9304:tid 9361] [client 170.64.221.168:55862] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAqwAAAIA"]
[Mon May 25 06:24:38.639831 2026] [:error] [pid 9304:tid 9368] [client 170.64.221.168:55864] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSArQAAAIc"]
[Mon May 25 06:24:38.651035 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:55870] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSArgAAAJc"]
[Mon May 25 06:24:38.658599 2026] [:error] [pid 9304:tid 9363] [client 170.64.221.168:55892] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/ckeditor/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAsAAAAII"]
[Mon May 25 06:24:38.673853 2026] [:error] [pid 9304:tid 9367] [client 170.64.221.168:55918] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/webroot/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAtAAAAIY"]
[Mon May 25 06:24:38.687577 2026] [:error] [pid 9304:tid 9373] [client 170.64.221.168:55956] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAuQAAAIw"]
[Mon May 25 06:24:38.692553 2026] [:error] [pid 9304:tid 9369] [client 170.64.221.168:55974] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSAugAAAIg"]
[Mon May 25 06:24:38.819072 2026] [:error] [pid 9304:tid 9370] [client 170.64.221.168:56212] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/scripts/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA1gAAAIk"]
[Mon May 25 06:24:38.827029 2026] [:error] [pid 9304:tid 9377] [client 170.64.221.168:56208] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA3AAAAJA"]
[Mon May 25 06:24:38.835453 2026] [:error] [pid 9304:tid 9375] [client 170.64.221.168:56280] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA3gAAAI4"]
[Mon May 25 06:24:38.846077 2026] [:error] [pid 9304:tid 9367] [client 170.64.221.168:56284] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA4AAAAIY"]
[Mon May 25 06:24:38.847008 2026] [:error] [pid 9304:tid 9385] [client 170.64.221.168:56300] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA4QAAAJg"]
[Mon May 25 06:24:38.848556 2026] [:error] [pid 9304:tid 9378] [client 170.64.221.168:56312] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA4gAAAJE"]
[Mon May 25 06:24:38.865695 2026] [:error] [pid 9304:tid 9380] [client 170.64.221.168:56364] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpformbuilder/plugins/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA5gAAAJM"]
[Mon May 25 06:24:38.869066 2026] [:error] [pid 9304:tid 9381] [client 170.64.221.168:56382] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/scripts/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA6QAAAJQ"]
[Mon May 25 06:24:38.869765 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:56390] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/core/kcfinder/upload.php"] [unique_id "ahN6puVEV2qpMC_1UzSA6gAAAIs"]
[Mon May 25 06:24:38.873916 2026] [:error] [pid 9304:tid 9384] [client 170.64.221.168:56410] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/scripts/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA7AAAAJc"]
[Mon May 25 06:24:38.881414 2026] [:error] [pid 9398:tid 9419] [client 170.64.221.168:56458] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pbgAAAM8"]
[Mon May 25 06:24:38.882530 2026] [:error] [pid 9303:tid 9338] [client 170.64.221.168:56462] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/filemanager/dialog.php"] [unique_id "ahN6pn3bQScbssitjPQ3_gAAAEQ"]
[Mon May 25 06:24:38.920377 2026] [:error] [pid 9398:tid 9427] [client 170.64.221.168:56486] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pbwAAANc"]
[Mon May 25 06:24:38.922659 2026] [:error] [pid 9398:tid 9418] [client 170.64.221.168:56480] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pcQAAAM4"]
[Mon May 25 06:24:38.926644 2026] [:error] [pid 9398:tid 9405] [client 170.64.221.168:56520] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pcgAAAMU"]
[Mon May 25 06:24:38.927936 2026] [:error] [pid 9398:tid 9401] [client 170.64.221.168:56484] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/js/kcfinder/upload.php"] [unique_id "ahN6puhIu7KstzsCua-pcwAAAME"]
[Mon May 25 06:24:38.929369 2026] [:error] [pid 9398:tid 9407] [client 170.64.221.168:56510] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pdAAAAMc"]
[Mon May 25 06:24:38.931085 2026] [:error] [pid 9398:tid 9424] [client 170.64.221.168:56528] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pdQAAANQ"]
[Mon May 25 06:24:38.955419 2026] [:error] [pid 50423:tid 50442] [client 170.64.221.168:56560] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpformbuilder/plugins/filemanager/dialog.php"] [unique_id "ahN6pqJWO7En4nKEQ3gwCQAAARE"]
[Mon May 25 06:24:38.957529 2026] [:error] [pid 50423:tid 50427] [client 170.64.221.168:56584] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/core/kcfinder/upload.php"] [unique_id "ahN6pqJWO7En4nKEQ3gwCgAAAQI"]
[Mon May 25 06:24:38.963845 2026] [:error] [pid 9303:tid 9353] [client 170.64.221.168:56590] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/scripts/filemanager/dialog.php"] [unique_id "ahN6pn3bQScbssitjPQ3_wAAAFM"]
[Mon May 25 06:24:38.969014 2026] [:error] [pid 50423:tid 50436] [client 170.64.221.168:56608] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/scripts/filemanager/dialog.php"] [unique_id "ahN6pqJWO7En4nKEQ3gwDQAAAQs"]
[Mon May 25 06:24:38.972760 2026] [:error] [pid 9398:tid 9428] [client 170.64.221.168:56664] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pegAAANg"]
[Mon May 25 06:24:38.974894 2026] [:error] [pid 50423:tid 50439] [client 170.64.221.168:56660] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/filemanager/dialog.php"] [unique_id "ahN6pqJWO7En4nKEQ3gwDgAAAQ4"]
[Mon May 25 06:24:38.981087 2026] [:error] [pid 9303:tid 9350] [client 170.64.221.168:56680] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/filemanager/dialog.php"] [unique_id "ahN6pn3bQScbssitjPQ4AQAAAFA"]
[Mon May 25 06:24:38.983107 2026] [:error] [pid 50423:tid 50445] [client 170.64.221.168:56694] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6pqJWO7En4nKEQ3gwEQAAARQ"]
[Mon May 25 06:24:38.987376 2026] [:error] [pid 9398:tid 9423] [client 170.64.221.168:56710] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pewAAANM"]
[Mon May 25 06:24:38.990773 2026] [:error] [pid 9398:tid 9414] [client 170.64.221.168:56728] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/js/kcfinder/upload.php"] [unique_id "ahN6puhIu7KstzsCua-pfAAAAMo"]
[Mon May 25 06:24:38.993946 2026] [:error] [pid 9304:tid 9373] [client 170.64.221.168:56740] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/plugins/filemanager/dialog.php"] [unique_id "ahN6puVEV2qpMC_1UzSA7wAAAIw"]
[Mon May 25 06:24:38.994111 2026] [:error] [pid 9398:tid 9426] [client 170.64.221.168:56750] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/dialog.php"] [unique_id "ahN6puhIu7KstzsCua-pfQAAANY"]
[Mon May 25 06:24:39.024196 2026] [:error] [pid 9398:tid 9417] [client 170.64.221.168:56840] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/phpformbuilder/plugins/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-pgQAAAM0"]
[Mon May 25 06:24:39.025564 2026] [:error] [pid 9398:tid 9415] [client 170.64.221.168:56854] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/core/kcfinder/upload.php"] [unique_id "ahN6p-hIu7KstzsCua-pggAAAMs"]
[Mon May 25 06:24:39.033748 2026] [:error] [pid 9398:tid 9419] [client 170.64.221.168:56866] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/scripts/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-phQAAAM8"]
[Mon May 25 06:24:39.042913 2026] [:error] [pid 9398:tid 9418] [client 170.64.221.168:56904] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/asset/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-piAAAAM4"]
[Mon May 25 06:24:39.046629 2026] [:error] [pid 9398:tid 9407] [client 170.64.221.168:56920] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-piwAAAMc"]
[Mon May 25 06:24:39.052458 2026] [:error] [pid 9304:tid 9376] [client 170.64.221.168:56944] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/js/kcfinder/upload.php"] [unique_id "ahN6p-VEV2qpMC_1UzSA9AAAAI8"]
[Mon May 25 06:24:39.104682 2026] [:error] [pid 9398:tid 9402] [client 170.64.221.168:57104] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/tinymce4/plugins/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-pnAAAAMI"]
[Mon May 25 06:24:39.116873 2026] [:error] [pid 9398:tid 9405] [client 170.64.221.168:57168] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-pngAAAMU"]
[Mon May 25 06:24:39.123245 2026] [:error] [pid 9398:tid 9427] [client 170.64.221.168:57144] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-powAAANc"]
[Mon May 25 06:24:39.133652 2026] [:error] [pid 9398:tid 9403] [client 170.64.221.168:57206] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-ppgAAAMM"]
[Mon May 25 06:24:39.149256 2026] [:error] [pid 9398:tid 9400] [client 170.64.221.168:57264] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-pqgAAAMA"]
[Mon May 25 06:24:39.151246 2026] [:error] [pid 9398:tid 9406] [client 170.64.221.168:57268] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-pqwAAAMY"]
[Mon May 25 06:24:39.153761 2026] [:error] [pid 9398:tid 9423] [client 170.64.221.168:57282] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/js/libraries/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-prQAAANM"]
[Mon May 25 06:24:39.164154 2026] [:error] [pid 50423:tid 50430] [client 170.64.221.168:57308] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/tinymce4/plugins/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwEgAAAQU"]
[Mon May 25 06:24:39.174633 2026] [:error] [pid 9398:tid 9420] [client 170.64.221.168:57352] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinymce/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-psAAAANA"]
[Mon May 25 06:24:39.176083 2026] [:error] [pid 50423:tid 50444] [client 170.64.221.168:57366] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwFgAAARM"]
[Mon May 25 06:24:39.181471 2026] [:error] [pid 50423:tid 50433] [client 170.64.221.168:57404] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwGQAAAQg"]
[Mon May 25 06:24:39.191571 2026] [:error] [pid 50423:tid 50446] [client 170.64.221.168:57412] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwGwAAARU"]
[Mon May 25 06:24:39.205983 2026] [:error] [pid 50423:tid 50447] [client 170.64.221.168:57438] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwHgAAARY"]
[Mon May 25 06:24:39.206777 2026] [:error] [pid 50423:tid 50442] [client 170.64.221.168:57454] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwHwAAARE"]
[Mon May 25 06:24:39.208248 2026] [:error] [pid 50423:tid 50427] [client 170.64.221.168:57456] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/js/libraries/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwIAAAAQI"]
[Mon May 25 06:24:39.213694 2026] [:error] [pid 9398:tid 9417] [client 170.64.221.168:57490] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/scripts/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-psQAAAM0"]
[Mon May 25 06:24:39.220650 2026] [:error] [pid 50423:tid 50439] [client 170.64.221.168:57502] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/tinymce/filemanager/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwJAAAAQ4"]
[Mon May 25 06:24:39.221356 2026] [:error] [pid 50423:tid 50448] [client 170.64.221.168:57514] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/tinymce4/plugins/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwJQAAARc"]
[Mon May 25 06:24:39.225172 2026] [:error] [pid 50423:tid 50431] [client 170.64.221.168:57526] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/fileManager/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwJwAAAQY"]
[Mon May 25 06:24:39.230979 2026] [:error] [pid 50423:tid 50443] [client 170.64.221.168:57540] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwKgAAARI"]
[Mon May 25 06:24:39.237564 2026] [:error] [pid 50423:tid 50449] [client 170.64.221.168:57546] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinymce/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwKwAAARg"]
[Mon May 25 06:24:39.242204 2026] [:error] [pid 50423:tid 50435] [client 170.64.221.168:57560] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwLAAAAQo"]
[Mon May 25 06:24:39.247728 2026] [:error] [pid 50423:tid 50438] [client 170.64.221.168:57568] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/filemanager/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwLgAAAQ0"]
[Mon May 25 06:24:39.260167 2026] [:error] [pid 50423:tid 50430] [client 170.64.221.168:57596] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwMAAAAQU"]
[Mon May 25 06:24:39.275473 2026] [:error] [pid 50423:tid 50432] [client 170.64.221.168:57666] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/admin/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwNgAAAQc"]
[Mon May 25 06:24:39.278338 2026] [:error] [pid 50423:tid 50441] [client 170.64.221.168:57682] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwNwAAARA"]
[Mon May 25 06:24:39.280437 2026] [:error] [pid 9304:tid 9366] [client 170.64.221.168:57710] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/js/libraries/filemanager/dialog.php"] [unique_id "ahN6p-VEV2qpMC_1UzSA-QAAAIU"]
[Mon May 25 06:24:39.286541 2026] [:error] [pid 21606:tid 21623] [client 170.64.221.168:57732] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/scripts/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XAxwAAAU8"]
[Mon May 25 06:24:39.295938 2026] [:error] [pid 9303:tid 9337] [client 170.64.221.168:57762] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/tinymce/filemanager/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4BQAAAEM"]
[Mon May 25 06:24:39.300206 2026] [:error] [pid 50423:tid 50436] [client 170.64.221.168:57778] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/fileManager/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwOAAAAQs"]
[Mon May 25 06:24:39.305042 2026] [:error] [pid 50423:tid 50439] [client 170.64.221.168:57792] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwOQAAAQ4"]
[Mon May 25 06:24:39.311610 2026] [:error] [pid 21606:tid 21614] [client 170.64.221.168:57800] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/tinymce/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XAywAAAUY"]
[Mon May 25 06:24:39.352894 2026] [:error] [pid 9303:tid 9341] [client 170.64.221.168:57936] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/public/scripts/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4DQAAAEc"]
[Mon May 25 06:24:39.360861 2026] [:error] [pid 21606:tid 21629] [client 170.64.221.168:57958] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/tinymce/filemanager/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XA0AAAAVU"]
[Mon May 25 06:24:39.365472 2026] [:error] [pid 9398:tid 9413] [client 170.64.221.168:57968] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/js/fileManager/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-puQAAAMk"]
[Mon May 25 06:24:39.368867 2026] [:error] [pid 9303:tid 9343] [client 170.64.221.168:57986] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/media/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4DgAAAEk"]
[Mon May 25 06:24:39.380615 2026] [:error] [pid 21606:tid 21627] [client 170.64.221.168:57984] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XA0QAAAVM"]
[Mon May 25 06:24:39.393986 2026] [:error] [pid 9398:tid 9424] [client 170.64.221.168:58094] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/resources/plugins/tiny_mce/plugins/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-pvwAAANQ"]
[Mon May 25 06:24:39.428511 2026] [:error] [pid 9304:tid 9361] [client 170.64.221.168:58176] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/resources/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p-VEV2qpMC_1UzSA_QAAAIA"]
[Mon May 25 06:24:39.429761 2026] [:error] [pid 9304:tid 9364] [client 170.64.221.168:58192] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/filemanager/dialog.php"] [unique_id "ahN6p-VEV2qpMC_1UzSA_gAAAIM"]
[Mon May 25 06:24:39.429872 2026] [:error] [pid 21606:tid 21632] [client 170.64.221.168:58186] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/editor/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XA1wAAAVg"]
[Mon May 25 06:24:39.441404 2026] [:error] [pid 21606:tid 21620] [client 170.64.221.168:58242] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XA3QAAAUw"]
[Mon May 25 06:24:39.446827 2026] [:error] [pid 21606:tid 21630] [client 170.64.221.168:58250] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/events/lib/external/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XA3wAAAVY"]
[Mon May 25 06:24:39.448193 2026] [:error] [pid 21606:tid 21623] [client 170.64.221.168:58256] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/resources/plugins/tiny_mce/plugins/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XA4AAAAU8"]
[Mon May 25 06:24:39.461140 2026] [:error] [pid 21606:tid 21631] [client 170.64.221.168:58260] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XA4QAAAVc"]
[Mon May 25 06:24:39.472387 2026] [:error] [pid 21606:tid 21614] [client 170.64.221.168:58304] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/resources/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6p2swdp0RYkH5t9XA5AAAAUY"]
[Mon May 25 06:24:39.472688 2026] [:error] [pid 9304:tid 9381] [client 170.64.221.168:58312] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/lib/filemanager/dialog.php"] [unique_id "ahN6p-VEV2qpMC_1UzSA_wAAAJQ"]
[Mon May 25 06:24:39.475741 2026] [:error] [pid 9302:tid 9314] [client 170.64.221.168:58314] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/editor/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRfwAAAAc"]
[Mon May 25 06:24:39.485084 2026] [:error] [pid 9302:tid 9316] [client 170.64.221.168:58360] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRgwAAAAk"]
[Mon May 25 06:24:39.489658 2026] [:error] [pid 9304:tid 9372] [client 170.64.221.168:58374] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/events/lib/external/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p-VEV2qpMC_1UzSBAAAAAIs"]
[Mon May 25 06:24:39.490563 2026] [:error] [pid 9302:tid 9328] [client 170.64.221.168:58378] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/resources/plugins/tiny_mce/plugins/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRhAAAABU"]
[Mon May 25 06:24:39.502866 2026] [:error] [pid 9302:tid 9310] [client 170.64.221.168:58400] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRhQAAAAM"]
[Mon May 25 06:24:39.517768 2026] [:error] [pid 9302:tid 9322] [client 170.64.221.168:58414] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/resources/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRhgAAAA8"]
[Mon May 25 06:24:39.520803 2026] [:error] [pid 9302:tid 9327] [client 170.64.221.168:58434] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/editor/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRiAAAABQ"]
[Mon May 25 06:24:39.530437 2026] [:error] [pid 9398:tid 9420] [client 170.64.221.168:58462] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/assets/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p-hIu7KstzsCua-pxgAAANA"]
[Mon May 25 06:24:39.534696 2026] [:error] [pid 9302:tid 9317] [client 170.64.221.168:58470] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/events/lib/external/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRigAAAAo"]
[Mon May 25 06:24:39.548630 2026] [:error] [pid 9302:tid 9312] [client 170.64.221.168:58502] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRjQAAAAU"]
[Mon May 25 06:24:39.654139 2026] [:error] [pid 9303:tid 9351] [client 170.64.221.168:58650] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4EAAAAFE"]
[Mon May 25 06:24:39.717467 2026] [:error] [pid 9302:tid 9326] [client 170.64.221.168:58698] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRlQAAABM"]
[Mon May 25 06:24:39.729812 2026] [:error] [pid 9302:tid 9309] [client 170.64.221.168:58722] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6py1RaFfTSnDQnqFRlgAAAAI"]
[Mon May 25 06:24:39.731289 2026] [:error] [pid 9303:tid 9347] [client 170.64.221.168:58726] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4FwAAAE0"]
[Mon May 25 06:24:39.732703 2026] [:error] [pid 9303:tid 9350] [client 170.64.221.168:58742] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/vendor/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4GAAAAFA"]
[Mon May 25 06:24:39.762354 2026] [:error] [pid 50423:tid 50449] [client 170.64.221.168:58760] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwPwAAARg"]
[Mon May 25 06:24:39.773696 2026] [:error] [pid 50423:tid 50433] [client 170.64.221.168:58806] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwQgAAAQg"]
[Mon May 25 06:24:39.775433 2026] [:error] [pid 50423:tid 50430] [client 170.64.221.168:58818] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p6JWO7En4nKEQ3gwRAAAAQU"]
[Mon May 25 06:24:39.776110 2026] [:error] [pid 9303:tid 9357] [client 170.64.221.168:58832] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/vendor/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4GgAAAFc"]
[Mon May 25 06:24:39.815393 2026] [:error] [pid 9303:tid 9337] [client 170.64.221.168:58864] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/plugins/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4HAAAAEM"]
[Mon May 25 06:24:39.818052 2026] [:error] [pid 9303:tid 9340] [client 170.64.221.168:58890] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/admin/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4HgAAAEY"]
[Mon May 25 06:24:39.819099 2026] [:error] [pid 9303:tid 9342] [client 170.64.221.168:58896] [client 170.64.221.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/cms/vendor/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahN6p33bQScbssitjPQ4HwAAAEg"]
[Mon May 25 14:01:09.415462 2026] [:error] [pid 3698:tid 3706] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Mon May 25 14:01:09.757893 2026] [:error] [pid 3698:tid 3718] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Mon May 25 14:01:10.098212 2026] [:error] [pid 3698:tid 3701] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Mon May 25 14:01:10.438703 2026] [:error] [pid 3698:tid 3714] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon May 25 14:01:10.802796 2026] [:error] [pid 3698:tid 3724] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 25 14:01:11.168820 2026] [:error] [pid 3698:tid 3722] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon May 25 14:01:11.509420 2026] [:error] [pid 3698:tid 3703] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon May 25 14:01:11.847440 2026] [:error] [pid 3698:tid 3723] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon May 25 14:01:12.190248 2026] [:error] [pid 3698:tid 3714] [client 4.225.163.177:63730] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon May 25 14:01:12.868389 2026] [:error] [pid 3698:tid 3710] [client 4.225.163.177:63730] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "ahPlqAtZBEwA4fyFLKN7ggAAAQo"]
[Mon May 25 14:01:14.186149 2026] [:error] [pid 62426:tid 62432] [client 4.225.163.177:36038] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "ahPlqkj3D3Mo8ANpTRCx3gAAAAI"]
[Mon May 25 14:01:15.423383 2026] [:error] [pid 62427:tid 62457] [client 4.225.163.177:55434] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "ahPlq_MUa83fc4GDyBxDSQAAAUA"]
[Mon May 25 14:01:16.474298 2026] [:error] [pid 62515:tid 62525] [client 4.225.163.177:40706] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/chosen.php"] [unique_id "ahPlrBig0_XsOwmnrv_JiwAAAMg"]
[Mon May 25 22:32:09.507685 2026] [:error] [pid 62515:tid 62522] [client 20.104.227.76:17707] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon May 25 22:32:09.722804 2026] [:error] [pid 62515:tid 62518] [client 20.104.227.76:17707] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon May 25 22:32:10.179685 2026] [:error] [pid 62515:tid 62525] [client 20.104.227.76:17707] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon May 25 22:32:10.394172 2026] [:error] [pid 62515:tid 62538] [client 20.104.227.76:17707] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 25 22:32:10.992688 2026] [:error] [pid 62515:tid 62528] [client 20.104.227.76:17707] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon May 25 22:32:11.208964 2026] [:error] [pid 62515:tid 62531] [client 20.104.227.76:17707] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon May 25 22:32:11.422989 2026] [:error] [pid 62515:tid 62526] [client 20.104.227.76:17707] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon May 25 22:32:12.065944 2026] [:error] [pid 62515:tid 62520] [client 20.104.227.76:17707] [client 20.104.227.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.windfc.windfarmcoolants.com.au"] [uri "/randkeyword.PhP7"] [unique_id "ahRdbBig0_XsOwmnrv9eJwAAAMM"]
[Tue May 26 08:09:28.687949 2026] [:error] [pid 20026:tid 20111] [client 208.84.100.130:2042] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/backend/.env"] [unique_id "ahTkuDXIXIr-5BZ8nR4HyQAAAJM"]
[Tue May 26 08:09:28.689296 2026] [:error] [pid 20026:tid 20112] [client 208.84.100.130:2018] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.local"] [unique_id "ahTkuDXIXIr-5BZ8nR4HygAAAJQ"]
[Tue May 26 08:09:28.689697 2026] [:error] [pid 20026:tid 20116] [client 208.84.100.130:2026] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production"] [unique_id "ahTkuDXIXIr-5BZ8nR4HywAAAJg"]
[Tue May 26 08:09:28.689983 2026] [:error] [pid 20026:tid 20094] [client 208.84.100.130:2016] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env"] [unique_id "ahTkuDXIXIr-5BZ8nR4HzAAAAII"]
[Tue May 26 08:09:28.690106 2026] [:error] [pid 20024:tid 20062] [client 208.84.100.130:2030] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/app/.env"] [unique_id "ahTkuFdk7QtxEB93NpcjbgAAABg"]
[Tue May 26 08:09:28.690299 2026] [:error] [pid 20024:tid 20038] [client 208.84.100.130:2038] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/api/.env"] [unique_id "ahTkuFdk7QtxEB93NpcjbwAAAAA"]
[Tue May 26 08:09:31.941968 2026] [:error] [pid 20024:tid 20052] [client 208.84.100.130:2100] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.env.production.copy"] [unique_id "ahTku1dk7QtxEB93NpcjegAAAA4"]
[Tue May 26 08:09:31.957953 2026] [:error] [pid 20024:tid 20048] [client 208.84.100.130:2124] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/HEAD"] [unique_id "ahTku1dk7QtxEB93NpcjewAAAAo"]
[Tue May 26 08:09:31.958452 2026] [:error] [pid 55988:tid 55994] [client 208.84.100.130:2120] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/config"] [unique_id "ahTku_3kVIz2sql52seVXAAAAQM"]
[Tue May 26 08:09:31.958771 2026] [:error] [pid 20024:tid 20040] [client 208.84.100.130:2252] [client 208.84.100.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/.git/FETCH_HEAD"] [unique_id "ahTku1dk7QtxEB93NpcjfAAAAAI"]
[Tue May 26 12:26:02.750064 2026] [:error] [pid 20026:tid 20110] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue May 26 12:26:02.909836 2026] [:error] [pid 20026:tid 20107] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Tue May 26 12:26:03.070373 2026] [:error] [pid 20026:tid 20108] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Tue May 26 12:26:03.231737 2026] [:error] [pid 20026:tid 20103] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Tue May 26 12:26:03.392754 2026] [:error] [pid 20026:tid 20109] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Tue May 26 12:26:03.553176 2026] [:error] [pid 20026:tid 20102] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Tue May 26 12:26:03.713755 2026] [:error] [pid 20026:tid 20092] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue May 26 12:26:03.873917 2026] [:error] [pid 20026:tid 20116] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue May 26 12:26:04.046550 2026] [:error] [pid 20026:tid 20097] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue May 26 12:26:04.224752 2026] [:error] [pid 20026:tid 20096] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Tue May 26 12:26:04.385814 2026] [:error] [pid 20026:tid 20099] [client 20.196.89.109:6230] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue May 26 12:26:04.545772 2026] [:error] [pid 20026:tid 20113] [client 20.196.89.109:6230] [client 20.196.89.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ahUg3DXIXIr-5BZ8nR5AoAAAAJU"]
[Tue May 26 12:26:05.226844 2026] [:error] [pid 20125:tid 20141] [client 20.196.89.109:4047] [client 20.196.89.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ahUg3dk9jeWERFDLJc7vsAAAAM4"]
[Tue May 26 12:26:05.858126 2026] [:error] [pid 20025:tid 20085] [client 20.196.89.109:4054] [client 20.196.89.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ahUg3X7k8Vts-JPOkgVR7gAAAFQ"]
[Tue May 26 12:26:06.583435 2026] [:error] [pid 20025:tid 20074] [client 20.196.89.109:8755] [client 20.196.89.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "windfc.windfarmcoolants.com.au"] [uri "/as.php"] [unique_id "ahUg3n7k8Vts-JPOkgVR8AAAAEk"]